Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 07:00
Static task
static1
Behavioral task
behavioral1
Sample
b6cc0fbcd5cee43e27071cc49d252271.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
b6cc0fbcd5cee43e27071cc49d252271.html
Resource
win10v2004-20240226-en
General
-
Target
b6cc0fbcd5cee43e27071cc49d252271.html
-
Size
166KB
-
MD5
b6cc0fbcd5cee43e27071cc49d252271
-
SHA1
154e9f31c6489f6b9dbb1f643629fffc633d101e
-
SHA256
abe0d1a74cc4b6eb80c49afc844f5a04a7c56b13365d3f905b73cc867002c3ac
-
SHA512
1061f76637d4699cc709637ffcb317fda0eba957a58816de856cdee0e4e1a59abcae6d7ed0a5a90dc314e912887a2d4f1bc2cf6bfbdb4ee9c928b7b312fdcd70
-
SSDEEP
1536:Lax71REfBchUY3mfgTbwUEds6WUK5T0kRRCad5W8uHZZdeaDiZtKsrwOIUb/yyWf:GxZRunxRChr85b6s5J
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000058c63fdc71436ea77be175d109d86c6e9148574b224ab03118b885be80873bc6000000000e8000000002000020000000baa3bed5c01381291e26ec1d1160d2637e6ac2dac7d7db8f9d5517b8f00ff4a090000000cb09238bdd421e5a64b5ab510393f5b3f2a230f4c14945c4ac3624c0e23b66c6b8c66cc79369a5da6ac594b8734205c8d1131c1c94cf25cf2c77bac9dc5fbf836685bd8d0c92acc1373a13e0154609b7e1d459e8bc0161a99e3911bb4d55d138c98ad869b4993449819ae07ee85b8b49b725347862320d5b745a4d01902e59d04dee933542c7e8a287c58b8e6790a54440000000efef4e93bf3646c87d4120c33797f3949b7008aa5e4cfc84b617d3106f5d5e82c186f0117b6646a98dbec6bb96c4bf467dc10ae91f02926a7e9a9c92bd1bbd0f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000e627f180f4f7e7834806707b098512aa9fa2488e01ec38546e46c150528d9597000000000e8000000002000020000000d857c785c03ef28ecfc59e2e0595ac4f983eb0ecd1279cdb41ee18a7cd4395bf20000000874404f7a4b041bbc4052d32b70803512bb16eacdea10029b4c956aa21bb65004000000032b0a8bdf0bc85f5b84abd8044b74056ffd391b61f7e45892d1fd2c9229985c02e4ef4cd5a3ea807a9cc224f3386aad588ddfa6d92a8c7008c565a0423fb90b1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5016cb0c946fda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415870296" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{351A4CC1-DB87-11EE-A2CF-6EE901CCE9B5} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2312 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2312 2316 iexplore.exe 28 PID 2316 wrote to memory of 2312 2316 iexplore.exe 28 PID 2316 wrote to memory of 2312 2316 iexplore.exe 28 PID 2316 wrote to memory of 2312 2316 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b6cc0fbcd5cee43e27071cc49d252271.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59415fe0545b315989a6f295907e7ad84
SHA160a15c01794bb5b400199f578df2825a38a02976
SHA256bf8a3d54dd4c659d8ba4007931b2c9300783c8549beedbddc7de5aca1a905396
SHA51271d02db4dd6e016fd37a1a89c94008bb92a336a4f9b4832f433e34bc6c4ce6d5f62fa6302d26e93256eb6af917784b99c3b3d53b69dfd4b1fe9d4f7fe131df80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549519ce045bc51dc1abc03e3c1ddd28b
SHA156583d5b702f8418dde38bba0ede02b4147c8cac
SHA256e8f9f5189e84de72cc33ed2bdb883f40512999ed094104cb78ddbce50d7ec071
SHA51253a320e0e8dc5e1f7ab653d5a73b3b3109088d1fadf5d36cc40a15e5265617527271660add9bfaf5d7dec49bb0b632d22d7d7054dba1760140107ad6f90b3f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500164b85ea70f599d1aa4663f5cdba05
SHA1ea0bb71143a8c865c3b1c4965586e7cecbfdaef5
SHA256d5de152e2d52c5c5a0fdc2d72910ae8d8eb02ccc367ef4edb861369cd1f699ca
SHA51203ce1a09b0e0a489d204511a828a5cd57d89241f8840cfdb83d0c167ed6b63d6b9afbad31de93d4dc64f24cc148f7c0626cf6244e2ea4cb1d72011b9a487cacc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501291140b08cc205abd26f893c5f9fac
SHA1cbd88f41f0bf7d6934839925e699209acc1ed650
SHA256a8e81e0524c9ba267ced9a580d4f95672a36334cc3e114bd698ac662a5550e24
SHA5124678ceb104c8a8fa7ce9f10a811e841399d425c03f333113964f3cd1581dae0e0e5b3c4823b273e03fec5d791983a52ee5b0645460134f5aea6d617d6e87dc42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591fc36dfbc6ae63ec26a39f0d48a8d9b
SHA1c6480fefb14655c48c510bc40748dfbb292d97fe
SHA256868a79977e58e029e2e69184317dfa32a559614049e35847866cd405d56b79e1
SHA51285c85f58be4a0fae9e46f6edd3e631cfa1ebde93d2e643c2d4e3f4c9beda23ab5fcbd1ca5eb6799abbced5a447818f62a82428a74699fe702f20cade697c5dd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c560ab275bec3a4ae023bb5dd327241
SHA1c9cdb684d17439efd2124a1c35a51cd4ff72b528
SHA2567dddb11d52815d3a0fe25a10a945acafe8f3d44ff5c74867d2098180268a0d94
SHA512140482e5b8695b4a9c6d2efbd6e4e3ac78533321bd4cd9ef3b38003670c7c15fa08bf2de58ca18d92343013cbd71a4143696a05ab569a235dcb1591cbfd5ffd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54de198836c7641f827b11c2214b37799
SHA1f125b110d0af91aa52fb6a438295d0585a94c884
SHA256b1297555ba3f8494996a0cd3afce67c908106cfd55edc6bfe1c8b780fdd2a7ea
SHA512a2de46bbf3c2335c8ac0b9342061f2a61d5befc7ee11986d19cd073f2a9044cf12a0107ec17ffebdd7d58206742674f8572791d8ea7ab70f812c54a1718020c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e400c120cd51ccbf50736b591b63819
SHA1428a3d6a17b33f5eb46e4936a348607eee7458c3
SHA2568f7a7f4eec9d368e2edecd35f4d19aedda8acd564f4f6a2201a71150dc2e2175
SHA512e9109ea58ec5fa1fce74719d16bc723660822ff6e3cd6a1b54428764a3a2f85c9d4e9426bd7c0c1510a153d9a1e2cb6a38a6e7aaa7fe129ae118067153244791
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfacb84821d96c0a0412368b41dd4b54
SHA19f76005884c748a5dc267da39e3c295d6c92c353
SHA256759fb21d46c2739b167fcb1841ae7d70bd8011600dfb07e1992413e64b52401b
SHA5125f59b7dd399e2242dedb9602a651f3142a6762318db6e015b4b4368eb04e6a05dc047bd079c240a0c7e89807c022e5219b564709695c8cb2decea22c5f38a645
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5455eb600b10f07db4039cf30c9d7b7d4
SHA1956bdc9b38aaffd1883a27ec15c61f5cdd0bee47
SHA25626c1dface402646e30116493c135480d0b1f9d78075fa59c76f9067fa89aadab
SHA512accac83806e80ad7da16c17d6fc218e7d71587b0cda94bfcf6838773d138c106c31f5da6ee0a3c6fe9602ff6ebb3dfa93403f1fb88ec016b4752960f9eadb2e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50470f9c24e81c5c4743c0bf1594b4cc9
SHA17475291c68160d7207a6de11ab0224862cfe685f
SHA2569f6e1f47aa90d12f4b21469c57f5dc114fbf217c1f14b3caa26dfcc4c6c83891
SHA512569d1fc75b5ad63ea41be7a037c5737591c93a7cbfa193825ac98f283462c2ee4701188b5f418c9ef8b5a9772c6daa5ccd1066c9cd88e3a51dfa2db5fb78a46e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5feb3170c7171b8ea79d680c956df9d3b
SHA1bef36b7036e9c7f82e1618315f35fddc8ffaa3b4
SHA256e5ae61c9a84e96e1423fc2cc8003cd03abada20fe9077902812dda61c439ee25
SHA5121c980342a95217ea7f5ef3fa38120a49ffc71ddc966681922ba6cd812508445b59b7da6b4a5cfe73382bbb80d94f6c2c38aeecec53e0bf89be636115802556f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7b61bdb7da17dc19c8674d1c72f0b7b
SHA14e2c3cbdd4d6424c710238cfb779074167e3d654
SHA256c173bba05f38a28295c6cf6e5b522f06c627c2a120c4d0900534d7f014f830f4
SHA5125b3778852cb1c80b28e257f0dd10facb43883eabbdb1641bbf69ba05ab08716a5d92314b71a8feb22855a6286515ec1670ea5eeb0953c97ee0b6a6c5ac0c526e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b47834cbbfe70bca54581ab28a3d2a68
SHA1d9b5f860ede7e78a71013de20b516e4e00cf1345
SHA2568f296671b73fe75b42b99c3a91058c20dd1022ba52b6b4b9ac853bace315ebb7
SHA5126cbd697067a84e78bc28686b6d4503226701fdba068ec1d6a45abb98520442856c4988ef507ca0925811c040c95cba9761704605518a5aeeee7ee83b79a07572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59661e5267e3875fad4e2ed38a43bc169
SHA1b9db9eb214496bcde8345511694641787358c05d
SHA256ce5c4bf4a49942c698678f4301ae1a0b898e092fcdd3bc8ca5389ba3dd7389cb
SHA512f7d7253adc0582549dd0ce63fd3530070f2d800b2d9fbd3248485c4ce019d4ebceceafd7e9fefe7765d72c7959f15d7430712f5e51f0d8a0152b74ac996253b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7d70478fa7428a2239d2cefa1d8f501
SHA1594485db480ad237c0a438b4558ad6035d5c6806
SHA256988670ce15b0c5b67539ae3cdb1593513b2df1fadae475588c09ce4840475ddc
SHA51250558bf9b5d845a84508a4f2afbec7393c43f6599141ecf4f90826db7529657a1d744f20e8d282e5d726fd325f205ed6c3e2a7184a44851441e3a00b4c0e2ea1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63