Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 13:05
Static task
static1
Behavioral task
behavioral1
Sample
b4c39621c5ddf2381ec488c5950febbd.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b4c39621c5ddf2381ec488c5950febbd.html
Resource
win10v2004-20240226-en
General
-
Target
b4c39621c5ddf2381ec488c5950febbd.html
-
Size
166KB
-
MD5
b4c39621c5ddf2381ec488c5950febbd
-
SHA1
5d0905257feb74f673cfe052e0ddf827ea4b170c
-
SHA256
3864a67f34a0fed2437b64a7a73bd27e52d4c452fa3b6403f00ea8d0ef36ce40
-
SHA512
6b3f721182b3fcc3d98c80854f0ed9232fd3a33f92ee44c8a0073889e63e9a20979d4b9669ef75371837655591d1cbd2f9f1bc0b0c5d863b766aebd38f523448
-
SSDEEP
3072:n35RcVhIVs2LQegU0Dzvj40MZEPjLpUxAfYxslxNcl8CLcXmNRSx99aKR7ISMLmJ:rcjJ/jXmNRP9RkR8S
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415805831" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 007973edfd6eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000fc1c704ad8e197c06e023e4764d51a3aca653dd5ee41461ea35621a8b648ec2f000000000e8000000002000020000000030c8bf8665066a75f749dcda0640c7d896ef75fa2cabedcc3c13aaf613adbfd200000000dc9672f8035732c041193e07ea3316540e98b6636349f8e2a1d1abbcb92604e400000002a37335af4a77f6c84ebde7beb6c5693a2d930b856a737a3015a270b93763a485f9e5ade2d5bf525bdb8efa8956b6331636510716958938c5881843abfad2792 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000000a401a5c0b8b5037a39f0dfd6a6d052eb3302090d44ad10452a076d479c31f54000000000e8000000002000020000000fc83feb2b18d656c3edcc684c051869f24a0c3edafa459cc823d5599a646404590000000377a4c8f435a4960b43b360498b517525bfa6c602ced4bed6e66070a166256b5d4f92f27ed1ef1542088da0b8624f1ee91eac4c176044e344d54bb612f8bc5aa68714ef1edc9b37ba7eb48965cf6e66f3fec7e1f8e149e59d59d3c2d8dcf6ab8ede3b248bfa079ee91eba156b26a14ac190f7201a379831d0999abb971cb64d6cc6ea13a1193c89d9c4627292afffbe4400000007de4f9993be3e2804c627cee33005f927b698b0f5b05aece67ae020d95f1b09867f5fe735b1d9ffed0059bd771e83bfe13ea6e57aab930a48dd1575eb270c6a2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{15CFA7C1-DAF1-11EE-B33C-C2439ED6A8FF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2416 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2416 iexplore.exe 2416 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2372 2416 iexplore.exe 28 PID 2416 wrote to memory of 2372 2416 iexplore.exe 28 PID 2416 wrote to memory of 2372 2416 iexplore.exe 28 PID 2416 wrote to memory of 2372 2416 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4c39621c5ddf2381ec488c5950febbd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD578d4456c0e41fa3fed2f664bdcc51251
SHA1761b3682c4e4b2354c9204c195a6e98e6c896263
SHA2567b39ee48fab93f9f48ddb11ffd0ffed62e4c7da07c93e88a56fb2c8c978e231e
SHA512726d7bcf21fc0b8bdd8f95d99f017835bcfb45d2ff88b6e4980b822cc5c04542e1c8a124e7b4ede423c5bd8eb3cc4e07b698398cfe23dfe0ee9083a9142d5e62
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_C62530F37AD5C5022195EB4B959CB082
Filesize472B
MD5055ad5e5162ffc5ff1e4173c8967a26a
SHA1438b1054de88b204eda0a27f9b5be6ef636ea068
SHA2562e192fa16be69986e235a52a059500a6726ff54639b456194964c5285c4ec790
SHA512cd93122ac6d857b0ee890395ab25c2f5f9f527f809a625835c14c7791106824a99d8d5249f600e550969e63c0f3349143840a2373e83b59703608ca644bc6df6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_FA49E055122F4CD07E54AE9E838D66D1
Filesize471B
MD5834aa3f03be24732aa5ff42f72401c86
SHA1515ea93b3c3a72076eab7438890e8ab3cf21c315
SHA256f11878fd14a04637d150027ab41c1e4fff81b39455484697dc1c4274e5c97a3e
SHA5126d14c404a940a90ad31d2397d49ef439720b607e4a32a2a0f52193b4de1dc4f7ed12688b4c162e406d9cc5d33ae0fd83a3e049c82e6ca6d8e2f3db0d6dfb3b71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD561987e3cc8b027aa530aa21c18fd7224
SHA18c4ec519b34fe3b66e39261f4013b9441c02617c
SHA2563dc985f7ccd72f838b6489d23d077b17fb896fe1b5c4c8c9ea020f42cc0df7b9
SHA512e1415c8ebedc4e3787656acd23935f3733ca3ddc047374f634a6f0c85269cfa1765b94570d244752c6e2cfe8b6fca5ce710b8281b049381f5f416d0d4cc58d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fa7f2ef9b9646a2ceaec61a5547aa0e
SHA14dca21283e4347a1bfe9a4a5cad4a7e9c45a1d4b
SHA256f185be0e35efd6e98a03beb586d062669ea62b434b3a5615eb54673d66822a53
SHA512bb826eabd052ad141b46b7d32f8632c5cd6ff7484c8ee1ff6dfbcb726ba7c5de2bcdcf0199718b5211601ba3eddcab2b74b34f0e39cddd5e4bc008da0060befd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589ab2496a5a886ca57c07a8d1f0f70a0
SHA17441ccc7ad593a6c054484b95e59b384a683b95e
SHA2566c28853c975dbd3fb024c7f19168d1fbb0bc58083a069a67588efd09ad1d9464
SHA5120fa86c6fadb225222c2aa52f6a7b6d7f8a03383197a8a8cfce2e5e778557f5dc3cfd5cfa89e904927bbdf986952b6c116d0543ce3af1698b7abd759510db0bf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584de84b4bfb3a9ab641ddc3277dc4273
SHA17a1928302a9d7d74c7f8516d7493c195c8f1d11d
SHA256f384ab20d60e9d0dc59b8d446f97a34636064a6e4acdf110319e4fea581a2a48
SHA51278251066db85522ac4ad0bef506662e20611c9e0fc9fbb044628766eb7b0a62e7d5c3b6bf373ec05b30ebe71d5005cdad765a460924b65b416b958d09e94450f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3d0c9043f992b7985ddff2506655be2
SHA10793ea79eb8e20cc8ff8bceddc910521c120deb2
SHA25654fba0cb5a6a3c34697612dd487837a493927e8806e78bac4a4adba80795ac42
SHA5129dfb92b23052ad7697f5465be80adeff57fdf7af4bb92535bc6a632d2eb558be75bddddcad8df9113cd8b24be703af873025a719649d6b7d7ec9ee333a5b07f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577635c277bc2a4d7241e2309b209b245
SHA1eaed5deb143ae38a8c3c34d5d1a94939d4f03d2e
SHA25635c207f4deac19cc4db6f09c31e242faa239766921c5f9c0cfe46746c69606fe
SHA512f6a864dd4387fe125fe99d06d749aaa41d9a127130810ea80b5029094899d9cf91b0913becfa1fcce46b36c6b0fed3ebb11fb2a1a5b3bfcc8c0ed3e14e20207d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500446e459fda37e1094a0a333eb8074e
SHA1776d90dbf0700cc430b450b6c43a793ca284666b
SHA25641f507f6f8e861968ddb11f4f39496978feaa7d28d73289f6d8213fc8c7cb162
SHA5129d78d8abd142ae834fd39b8d9119bc048c4a9b85e291747faa32336fbdf29bb3d916cdd8e53a80d44e73b30ff5c3e381b280d2b91dd7cc15ac8a74c6c70b7170
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52600c5a40c1227c8c635e93bef035c48
SHA1028a513bc1083a2ddb54164e69af4fd32833e696
SHA2561e4eb866cc06025482204369c1c090f6e13470f0747d9d6c099f3a6074fa25d5
SHA51256b9d2bcda79002f1b93dae17381f28f7de35be777bf81fd40306c05532395d660851aeb3eb27c1c0386f3853743c46f1f1a73aacc828889aca947aaacea9351
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\673IEUYT\cb=gapi[3].js
Filesize133KB
MD5c8be3350843695958a33474aeb3ea8f1
SHA1ad92694d9b189ee479c1be438636e39247b216af
SHA25622494eb4f5fc2ef8c229b9df2e171990687e4837282655145cca0fa302af1278
SHA51254ba5d4076fe9fe4c4ac22f45cd7d2ebb4e8027d8b8f82580436dccbcd60fa2adbb948ff1234d9912c663bf1fb33ac834007850f5a3f2abfb96a7a4feb110bc8
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\902LKC6A\plusone[1].js
Filesize56KB
MD5b9dd4bc0c774f6e47fc7f6f84318d3bd
SHA171e659af69facf4538bde88422c6ac7574c3bb5c
SHA256e0f79422a5e14ac8ca345540ab58da18651216e375c4fe02143496bd9dc046dd
SHA512419b21dd145dab3ab4b543c87fad7fed6281c2300ac7f1cfef1119703e5ee97930f1c07353b2a1274d4879b481bb673ce3566306c9b0b91b1e573ee43486b342
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63