Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 10:38
Static task
static1
Behavioral task
behavioral1
Sample
b7368214e21c53b5c23055416057df52.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b7368214e21c53b5c23055416057df52.html
Resource
win10v2004-20240226-en
General
-
Target
b7368214e21c53b5c23055416057df52.html
-
Size
13KB
-
MD5
b7368214e21c53b5c23055416057df52
-
SHA1
44ed51bbb1e95bf08b9757772e0e337d17ed160b
-
SHA256
a022c218eb70583167dafac7f863bdc74a9c7cd4230b6666178cd908f4ff16ed
-
SHA512
cd37e159f72244b9aa5d8ffac4cc265ec84a7ede25d5f9c5317921195a431ef2e813830b5b98b6c63df7868e5cfd69ce103c7d0dccf30a399b47acc4f246b5b7
-
SSDEEP
192:H9KbqTcUkARSh0/foqzCY1zRHciXxgrguERUGOCaNOjHhO9Y+wLl0bcLpaqECId:HQbqTcUpvBwU8t2HE9Y+wLntM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2034f57bb26fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9E116921-DBA5-11EE-92D3-66DD11CD6629} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000a38153dcae04e9c6e863379ce6613ca8e0849420a5c766fd6f2afc14ed973ec2000000000e8000000002000020000000d90a6de75fa20cb4dd093bfa741ab1a94977cca73994259cc31adb8648693b7c20000000c3e1083f4e1e808877acbd4e1e6fab99f6c452d54ec81d9a930ebfd9a6b165c040000000a00461e0743df637fc7050d781dafbe8a1db21c4951adc9013955917d3c2d1da49231bd69c70d78283b52b7dd7b386eef716b8cbe87f784b4abf108bc757e2db iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000008b957b2f3cb5350f3d60f709cb0be85d401d2da86e9ae676b0d622049ec061e1000000000e80000000020000200000005f18acb8416bc998484d2330851e41b2cfb190bd06404109e2a1662582ba029890000000689e69afb6a9f8c69260ae9313badcc126fea60ce15c6b8a86e73d5a5dcef74f2db4d596f4c1ccc7ad34040e2e3391e96bfde12ef26f923129fb19f091a15da341c3a3ef76dca08df88b1b4cd7a6f7c019fbf83707a123acc9414bfdf5c60bbfd698ef8fb434dca6606e97947e2c72e1febc2eba10e8fb7132711e0fdd3f6c229a31c7ab643269b0f58ddf87db344ed34000000094155f46e28d93c9886e5c914f5cb74e536b62511951a95811a0755fbf979cbb56650f157559f2ceb0d7c458db42614fabc1bbfcaf561c9a0c1b97bba2404910 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415883364" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1460 iexplore.exe 1460 iexplore.exe 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE 1448 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1448 1460 iexplore.exe 28 PID 1460 wrote to memory of 1448 1460 iexplore.exe 28 PID 1460 wrote to memory of 1448 1460 iexplore.exe 28 PID 1460 wrote to memory of 1448 1460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7368214e21c53b5c23055416057df52.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1448
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b4c82bec37a8b5b69af312743b4f0dc
SHA1658ff18489433cd29fb77fcdfe9f552d86245ebb
SHA256629c6669b6428ff75a2c980759073e6ba2fde61fa19e4356dec98472141eeae1
SHA5125d28a45d5f3c2726aeadfeb536d38d75358c2266681b58084ca1dd5220d06776c0fb22bc75b6e972a2fa9dc844fdae700e0a6157508d29b9299c6ca04a111fb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553d48851ef8b63834a1ee4d640c074ef
SHA15910853d07c3761c727d050996e9e7ad120bef91
SHA25652de2d237fbd762e011983cb544e96161f208038bb7ee6b727b121c671861761
SHA51296838fb33e848ad93d0bf9ea3532e122279b364dc209470cf04a6543bbcf076a18f68b4fb7e347fee51cf4df25a3f0606ab1e2eb9b0aa61eddb679334fb8a245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5348d898a5a07deb60b249c9a80f93be8
SHA10dc35dbdc09b44d6dbbcadabf66be619b7bea98a
SHA25615f87fc3dc5762ff8a8bcfea7054b8bf7360632c60cbbacab8a9900b4417bba2
SHA512692bbeffcae5349429ce5cbf6bd4680f12cdd7e5df107b1d0bdc06e24fc4a4d94ffa95f4d9341285d6e62e5ea754a0e93e49393181ffc992aa589927c5ab6d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f9d4d132c65fedb70a800c8053572c0
SHA1e018f3d1fef52f30ba107b30c725dfe0bdcb1eae
SHA2561aa31192f8840dcbbfc0ba4cf51753618801281a537fba5556f5086c1ec172df
SHA512f111f832f161826bc4dfd221941d56cbef47ec4266198609516c1a07058b2a9a7efae2ef391a1c54b6ba649f73e0631eb62dd63cc716ae7637f8f423b4d04d9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591373aa1c580a9c734695aa321c6debb
SHA18b89e77d1bded415e122177ec8fe8483962872c5
SHA2564f30de976f6f3a60de8356b5f53584f2ea69e4ef828f2615355c306cc0fd1cc0
SHA512b7271681e740993245d25ab2034fc54bf08722eb4c5af0fbdb9aa6555910cd68dca06312e8af59c6b91dd9640215a1d4f7e400d1dcbabe49da65565df7834340
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c1ac61d0875b07690a94a4ca85f6d6b
SHA1b3d385a53c6a6b62cdba88ccc0256251ab001ea4
SHA256ab815221c267e0351ee12d8e5e90aae4ded2c1a0f2f88f6f879e6d689622cc8d
SHA51227269a972edd9aea7696c9f900ab71a89f686730247b3a01abdc714648a7614e0e3bf831fd664200954607daeb4f33930748513ea0f82be8e177add44157a2d0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63