Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
b78ce614fa4dbe76d0c0addf04ffa5eb.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
b78ce614fa4dbe76d0c0addf04ffa5eb.html
Resource
win10v2004-20240226-en
General
-
Target
b78ce614fa4dbe76d0c0addf04ffa5eb.html
-
Size
38KB
-
MD5
b78ce614fa4dbe76d0c0addf04ffa5eb
-
SHA1
e4a14a86062cb44d1c4c58535d637b77078bd116
-
SHA256
39cc3a0e2ef98bb3efecd5fd297a0153629de04b0cbcd99fd3e611c2f4a82998
-
SHA512
2097155e856e952b8b342b601673d971fd882da7780b79de69f3ac68e3787208daff18fdcecda97bbd0958bea09041e7f8fc08c15646af1ea97f2ba5ce4a0ec5
-
SSDEEP
768:/7BT0EipB5voGREPzZjib7O4J1NzmWtdHcC6ZGskLofH:/VTupB5voGREFjib7Os1Nzj6tZx
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000034fcceaed9152ecf41cd717ffa199b8325803f3803c2bca57bf8724822d1cc8a000000000e80000000020000200000002f5fb07eeff1e884d2edf985440b774116fc6a42c8554ab0fd9bf9108da3e463200000005ab70939cc96774075f9aa24044e4aafcecdc041f8700780eae5972aff6ddc0f400000008f06f9460ac5cbbb49aec15332f955faf863855d9058243c10a7284720507b56aa2dd13b44157559e9e276404cfdadfb70498649bfc2a6825a29de3c79bfad49 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d250f4cc6fda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415894727" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc2330000000002000000000010660000000100002000000055e1b104b64612be4a54cc749346636d5dc812bef25a14b3bd1b5caf6814345c000000000e8000000002000020000000e3c7892116d1bc92212c6fd9df4339a130f354752cb639552155d0dc0f47fe5e9000000079cbc1abe9e68acc0ede7420523df8034e838f4ee731736832b2686a413bfa1982fab9b3a606fe751565dc3091985440366e51a1b4103b4bf4759b3712591ae7c9dff5611ccddf1e802be6e3ad0b5a2adf7dd99d98e643e5fd07b7d14432eb4c4d3033170f06b0abaa4d554cd97dc3a0007cac320bce5c5a557eb084ffe9a64416f7b8296da78a7a01405473935fdf76400000002d09f439521430e21ba4505bb98300d488ee965af95be0c6addd08c317e68b932df10a8748757be5d45e66e40281a87a1d3972d37498ff5ae1f3bf59a8690b48 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17AF3451-DBC0-11EE-9A4D-7A846B3196C4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2924 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2924 iexplore.exe 2924 iexplore.exe 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE 2492 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2492 2924 iexplore.exe 28 PID 2924 wrote to memory of 2492 2924 iexplore.exe 28 PID 2924 wrote to memory of 2492 2924 iexplore.exe 28 PID 2924 wrote to memory of 2492 2924 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b78ce614fa4dbe76d0c0addf04ffa5eb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2924 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502c1a9907c05595db7431533a73b9d22
SHA19a5e3290ae0255508c264fac805cde299b33d8b1
SHA25680aade1e388001fc4dc01e1fb7576e04b330bdce20d88c36835470630e850842
SHA5122c1673c45970818b8e8a16aa20eabef611fc432b1feb38b7d8d3855e13a2d32030942bf163bfa6db3f1e03137e7b026ca10a649444da58ce82ca85be315d10bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffa73a9042b99d93aa0b9f2d2d2c7122
SHA1be9405ce37831fd7feec8a970f4aaad4dfc073d1
SHA2568ae3baf5936d6414df3347b6adc19c4e828d61fc3960dff935821eee600479eb
SHA5122c7fcf2e932c9468f18f995496abdb9667d8da77a942d320f57da5b4faa1b346de8a078fbcd36b16636b424210cddcc6890854a0f106fbc037f8d9befa1b7e39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b479b0731cf9cfe27f8864d4282f10a
SHA1796a016617dcf301a9feb7326cf78a66b32eb802
SHA2564abe229226a759fe6fa9b1570c01aaf80d52e3a4581886feafc2879a293753cd
SHA5124410fdefff8d0d2b22978d54ce91ae204ef6c692af590fe3d3353cd7ce3a6786caafec020b4d81518fdb48ef4054ff36535a43f2eeacd02e0f2dfa80588824f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513c22adb7b31bfcffe0152b667546157
SHA101a3d134af6d721901805c9bffc6342013758c03
SHA25657d13617e4edcb7209ccbee85db7c299d94e71e087c4ee3df54e15da8d8fa9a9
SHA5128d11f1175c9433a3b33f9e09e80eca45711c05761a3ebf0f1f2fa498324136b3eafd4afa8a36486d387f07aeaba87106b686b3c7d47e80faece8794963623eb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c33920bebbee7482a751ff2ec2f6022e
SHA1161f630889ac18a8b1ec488875a2b5a136a59b4c
SHA25669dfcaeb1e31b9e2eeb1d000a500474a0918a0492a7dcb86f1fd1db8c5f72ab9
SHA5121e30a321dcd833785a5f7a5de225670f9f33e6a47ef03f5064eeaf79707ea96e545b75fd04051bfb1e3038670070c8c597d2c093449c5e9fef05874b9beb9add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd3c4cf663d9419068341c62200522de
SHA1c45b43d4a6142aa4032e4c15833474366f6c903e
SHA256854829885df7a153a0689af09aee9df79dd5e94bf1fcb3ae164e467ccc7764a7
SHA512befe4aa28757ee313d784bba52f481f47985273161bcd878647103f391dc77ee22869dc968984b3e4d428e255d3b2bdafcc34f99c0f92612f1f5a0ae9ba06ab2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ecde972c21aad2c7ceb0c6367843b3
SHA1e1ef3d5a4b4b1842ec2544494fe860bb3ac8e9cf
SHA256fa0c59ea458288156bb2c98a7a02ca8e0893253cfdbc26a8b26895553c289793
SHA512e65543306838575b134d64fa816a2f1392e4eba75c7403d05550776716318584cb853af5ef6878c73fda42def5da0f8a74143921685e426ee5a093f85a67e60a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562c39f3005f99d35520bd29ab53c6154
SHA1044f2c98eb0c793826b43244b8d9802e2f690c66
SHA2565dbee747ed6759c957ca717087d48dd7a5204a85e2c5d2f997574becbaccb750
SHA512e1721b5bc1bc1b319ba770eb8ead2ccae126db6c04d3f2d6e00b96043848a16d5ccb9742b4988e87deb0e7c50773e211c1347803225b26d5dc668bc123247e8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e5ee666306f8ba704247778ac1aa278
SHA1377b4dad41e071476da632e404c8b7bcb3665f77
SHA2567ad95c6da02bfef7cdd06ebef0aa1cbe004899ceec536bcb851eaf2bdc9abf0d
SHA512457e820c71eebfa8671fcf34e5ba556a212e8840660fa653eb68d47d8d9c51a2b429c134ca457cd9a5eef1c2dd629683a0c9a8d164b3be84409579b5beb7595e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51eacb14844e8af0190741f11d8c4d84b
SHA1481b6d46f205bfe2c379e335c761d105ccf01606
SHA256dce96fd077ff9067dbfe8c2a8690104e3ab00ea4c60974a25c2efcb4a20f0f1f
SHA512bde56b25c77a68e18b8aa9d8e135c78db4e289745b83a96755b66212807a1b275e4cbc09ab946aedcbbe9e73ee1412959aa6e9bbb0028b76042858bb77214057
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578592fcd8bd09746944be18d88a312be
SHA1a4a63f456b51ea0dd42712f84a74d34e5f6d3dc5
SHA25668e09ebcd651a133c90123de22282281e58004199654831ef5a684eb4350e0ca
SHA512f820e5d652ab94e9f430d53887663397134ac30086d95fe174526a48d4df65effa5bda910cb980b663a55a356cff53c05e1b9efb88c2561e53f45d28f8cb876c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c51c830b91f150c5eae1b2656e7a39e
SHA1590b9170191756daf4186b21e20380197f2ef60d
SHA25622163fc94cb3f214b7fe3e07dc5058769ba65322a1b94cea3f3d709bc91f6e8e
SHA5124c2d95c4f211dceaf62e85b35d2301665063e9ad72f5405c5ac6643bd6977f2cc5f47840263f58cf610d879ae89358a26009398b797d3f9d8663f858123e7bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55761f75be1ca8e4248d0ce5fcea52ee3
SHA15b900b87a1504f7d1be88368a3cc49b016b8d187
SHA25653d10f54ca53999a1bac23fdfa6ee8853293186fe6d927953c81c8adf4d89bbb
SHA512538976d88d93b1ee9f9b92dec74818de1b5eb066d218e4666eb08fcde2396346d542867ce8c3a9faef553cb2caf968029179a76858ffea619a66ef79bc6110dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4e257b10a456633a696c21d20b9e4be
SHA121531804620f970b1176dc644a359e9cc981c635
SHA256eb8be8955ce9959f2a4b2ff1f4b3f99f403df1ed4b90c1150abcc379246905e0
SHA51296e983d0aee15d29f0e381811e9b134b1d033dff47ebfbceb69f2c5fb219a42c5160cf7a11297d1b43359ab6135457935afae1bce3d457284c8009dc06b30cea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba957fba015f7d72eff4da0499de8d60
SHA159bf68fc98d3f7d7f3a08ec36cb896bee2a052d6
SHA2563ae3cad577c15fd7d1e51d77e2763453eaa265b292cbc9c415f30eeb622e7e87
SHA51251cb903cc6573a8eae6b6f3127d04ba06a596363e80e37518ec9c4e028b0794d003f8f810f99d8630b62e8eb1e6995272042873bd6116ee2caf53c15f0f3b20b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\I819HQXH\plusone[1].js
Filesize56KB
MD5b9dd4bc0c774f6e47fc7f6f84318d3bd
SHA171e659af69facf4538bde88422c6ac7574c3bb5c
SHA256e0f79422a5e14ac8ca345540ab58da18651216e375c4fe02143496bd9dc046dd
SHA512419b21dd145dab3ab4b543c87fad7fed6281c2300ac7f1cfef1119703e5ee97930f1c07353b2a1274d4879b481bb673ce3566306c9b0b91b1e573ee43486b342
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RSAB58HZ\cb=gapi[1].js
Filesize133KB
MD5c8be3350843695958a33474aeb3ea8f1
SHA1ad92694d9b189ee479c1be438636e39247b216af
SHA25622494eb4f5fc2ef8c229b9df2e171990687e4837282655145cca0fa302af1278
SHA51254ba5d4076fe9fe4c4ac22f45cd7d2ebb4e8027d8b8f82580436dccbcd60fa2adbb948ff1234d9912c663bf1fb33ac834007850f5a3f2abfb96a7a4feb110bc8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63