Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 23:57
Static task
static1
Behavioral task
behavioral1
Sample
b9fda4a3d860c28da4aab03ed56de095.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
b9fda4a3d860c28da4aab03ed56de095.html
Resource
win10v2004-20240226-en
General
-
Target
b9fda4a3d860c28da4aab03ed56de095.html
-
Size
1KB
-
MD5
b9fda4a3d860c28da4aab03ed56de095
-
SHA1
0747301195cea33d41379122a3647d6a191c00b8
-
SHA256
5e4f4320542d1f94d14f6300bc3632602fb6a2b55558d81c0feb720fd9f96834
-
SHA512
0471ad120aaec8ef775b7e2290841d3bbf4e93172b7ec01a8057c4dcfb1deab0a20e52c9c5a6ce83fbc9e46d2a8aa70a000a61d0a3dc5f1d21e5dc44e99e374c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001ba800212b54df418a2de87e31fd1a3b000000000200000000001066000000010000200000009a578b4e5aa8dcb15c5dfd0460a3eb05b7eefd8b56bb79941389b263854bf4dc000000000e800000000200002000000038a9524c29e79294a8f0fe41725854fc2004fa4f05106951cb582022f836ad489000000064841288baba6b0446f41fb5ec46afc222a07c6e97ed4ad89b21cfec20f04645ffd4a38d969b3f5d8098b97d421458e1baf43e4e3acc6e64bd34acdb5ad52d9e71c74ed52f1589089e200fe41b22801306aadd54e8b2b47638423086d500481c0a953bc60e54ca441ed736b57455e4760b1064c4bc3dc6b4f2042d46233827ef3e03f3bed218e3bce1a3b1fa9376ab12400000007ac35dc218014364813c0c03ba6f410b0078ed6030345bb48fb66f8fba31b29a1d7741a3f5015f0bc84abe317a5e4610ce0dc8ca8919b976142cef7cb55bf71f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e025642beb70da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416017695" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6658AD11-DCDE-11EE-8EEA-EE2F313809B4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000001ba800212b54df418a2de87e31fd1a3b00000000020000000000106600000001000020000000e738155b017588aa83d353de7630e7f6eb445b290aa5559b950dad1b17eae3a0000000000e800000000200002000000040e710944390cc746fafd15900424eb73ab2e2efc45f096b3c8520d54f1d687e20000000226421c7a76913f25d27e61590edc3ba4f0c735ffcdedea68861dfa709cfdfdc40000000011d12a82884e5aaed0dd0d94584f4c8e032ac39904e642bd6be4a6d96e7f4f23268a43cdc3e8ab7179641554bd0a9707f0e6ac00672d491377903f52b8e7783 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2936 iexplore.exe 2936 iexplore.exe 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE 2848 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2848 2936 iexplore.exe 28 PID 2936 wrote to memory of 2848 2936 iexplore.exe 28 PID 2936 wrote to memory of 2848 2936 iexplore.exe 28 PID 2936 wrote to memory of 2848 2936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9fda4a3d860c28da4aab03ed56de095.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5c635f2d0845ac68d89982eeed089525a
SHA1c6c58d4c9b25e4ec642d281a2cb8635f86e813ca
SHA2563dbbbd6428108b4437a7928b96b6dd85c066a665877849626e4820c095ad92c7
SHA51273f1635b43f1c4c4787efe5f0c09d01fedb366557f5f46b795c18d3619bc48b56c48612013229337276cc9facf572da2b651765eafd4639b2d4e03846ccc0dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5654983c795e6cfc91a1c160ecda5cae0
SHA1ef3bf7aa43a3a0baa4de252e5ba3d164a9fbc244
SHA25612c0ccf1118b612b6868c19782b9a05053ddbd351b2bc5d2d4479945bac93949
SHA512067bae0c5cfca62ce2ad380a1169f3c812355a4adeb029131b575c1261ade07e04afbf7c9d63345416e59b8fcf4cd0e45a6ee125d3200e1aadc93e6849c6f7f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de7bc5fb9d0b872eb0d43d9734d1cb59
SHA1d1b234eef20a5771415500f26eeeeb42d6da4d2e
SHA25620569c9e0ee2e796d07759757d9f01e6674b2614f72229a81e628a486f9e894e
SHA5129c2870edd1e9f811a543ed92e7edf106b94b54d5b1553aff103c05f562a8c43e973c37f4e07833a44341bd24649c8fdc1f8de69a6fc92e1f06588d58a82a5236
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569eda8c56cb53497a4fa00c0b3fc87bb
SHA1ccfe37aab1803f2cbcb471b94361092abebef34a
SHA256e1085ac73e14b9ea43fb74838255ee06be8d197585cb50e9ebf0d9edcaa3759b
SHA51230a259cfb1fdf7aa4c62bc9f9fdccbea05b8239e09975dd3d6a30585adad119a695b558ae3b225587f89375baef7759a0751030c769d3ae208e46a98bbe79350
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e85dc174021218c57f395c59a75a2191
SHA181dc75da8b5656c0711ebeb72a94083d941384c1
SHA25658bb4ce9ec559b509c4acc9df1daf43cdf8bac229672d9ece4f8af0a95df3a60
SHA51218bd1ebec145959ea10372f83bb3ea8d42cf5ad09992f0b6d257d864d2112a1e774ecd7cb6bc0f5f2160e9a73bc53b5765b3249b0888d42b728ee688cf1d6f70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5553081cba3d9fb72cb11955be4ad5bdc
SHA1032e65e738d096f160b9e3bdea33a8e1b68edf89
SHA2560d94f3e12a98e8e415c0d9df490adc615f6973eb31a45450bbc2cb0db0af8fd0
SHA5129ba8cc5aac5f9979a6f798bb99d7051ce1a3ff9c38dca2df866472d6186e5f6d61733df91fbb61d2d2c4227aa8fc9266f82baf6693df61eb89c0e7aa8d62f2cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f953649156fd607ffab48b054d184c9
SHA167ab3d0c7b77372357ad7ae6cc55797e1d7828cd
SHA256410bfdac639a65712c96f324c75f905abb9e6da466806e2e870001ad9f37e894
SHA51278cb813b8f29c35ed9912be5db56af83b10f542fc431921ff673add737b20ff57c31e70c091cf254c5b3ca5485ec84b97b5bb0ee9d121f9158e0f7443d82f495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cca84dcb8d683eca3a6f4acf930643c2
SHA10050182cf845edf6f813daac3aa8a4a7e6d7f966
SHA2568201adc1c71ba8b734ee0454f1c57187178ab876f061d49cfbcfa362299f3873
SHA5126e2cb86873152e65fb426ea5676d8fb7e9162e911db187cea20d61318187dc4522202fd19d9f2b264ad61aeb956ced91adbde1b2e883515ea1cd83966edffb99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517fd610a6a4a40fc25422bf28f23fe03
SHA1f038e2b7c2c3f4479801edb2ad1ea9b2e4335161
SHA256e025ce6d0f815e8137c44975902ee4452f004a3d9f88284e81c97a5939eb77c9
SHA512dfcc045790b915fea6e552b297b5c12e086cd6944f18e6886456f1c694a6d93908399b00b322a2c0d9b3d7cffa09cf2017c0dd5fbb3d438ce9b1c8f456e70d65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576f17027c0ae8a57db3f8a9a00109e46
SHA1f5e50d8db1ba185a8505fa8198548eb39ac10651
SHA25617861bede5262480aa8675183c2c457a28fb4a787b37b5bffc13f6181e305e3b
SHA512c7b4dc699a5330fad0d7da76d9e1eda09eb926b2575790934d6775ddb65f78f42f57b5d5afdc073b32d1f9f2cea5dfcbf99d096023ec32801abf36c00a7def4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568048c5011701b030c0b1b1a7976ebfe
SHA122b9d87ff247c53969deca4409814319f0565e2b
SHA256f3120292d3c5e35f016486161e818f7d445cf8c1aeb42a620d6d2978541cba26
SHA512d4a4d3cbc0ed195530b5c7d39fe3c37a73cbeeb487d5afd349e43fa968a8b32a969e4c917d896b0ed40d38d4b6cb9f178f5d4c0e961be021dc32cf8aeeff4264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f763db3eca2bb10490d16a5153cc215
SHA1a71d4cbd54509b73a4d5f0ff0ceb88c060f0e3c9
SHA256582ca7b8de031ef0c8b2f77a74512237d9eadc12b2f5347e919e1e534c9324bf
SHA512cab5f8f119d2a3e933355f75f74615c15e20d3414febc4534e549456178f7ce87d01a344fe259465189b875d604245e7dd318fd7c4f07068f0f2d27982583f5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbaa9f3bc96e36e6ed7802dda3fe1703
SHA100c40b1ce827e93708e72183865e24f0aa417367
SHA256581d1d9b26441268865f7f3abbe340cdcc747843f8a11d9275e2e03855b1faa9
SHA5129312769657e1e325745b3fe9f116a82700473fff57217254597d2e20956b6077fbce3a09aa92c8e5d9f59d510be752ae64c25282b909e72bfe432b89878b0e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5fee9f373668d2d3b660d6c2d062d66cc
SHA1d1a666dab452b737eea4ae03007b1803965e15f6
SHA256b63fff82e08e9fe848b05a8bae7e605d334bc871f6cbd09d2ff44c0c075c84f5
SHA512b9bfe570f244d3424de4056a722410bb62ff26cbc25b1490679a0f025a70f7789ca1d03571d4029045479dec3dc55ea7b87295b861fd1f2c359b4bc92c4eaaa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD50ef7ca5682ce568d32ad3075b5ff2894
SHA19a50d7a7f719359880f6e194899c13b7a763b8a0
SHA256fba324c40b668a77bc8e6c5faa17c0ba69bfa1adf5c0b360346b396978359f0d
SHA512c1c970694a58f7b5441bb989abb6aaab6059e899c9c7e261613281d0040deb61ff3cf205ea7cc5532879306448e6aafab46e73b9206ae48a8711fa601e287e00
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63