Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
07/03/2024, 18:51
Static task
static1
Behavioral task
behavioral1
Sample
b96c2c00536a5af54b08b841de38dbb9.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b96c2c00536a5af54b08b841de38dbb9.html
Resource
win10v2004-20231215-en
General
-
Target
b96c2c00536a5af54b08b841de38dbb9.html
-
Size
63KB
-
MD5
b96c2c00536a5af54b08b841de38dbb9
-
SHA1
4573cdf4ad4f0d2f56d8442ca5fbe566532f4424
-
SHA256
c0d61d905a463d35a59273a5872614dd14018d069c271356d95fb941b5194504
-
SHA512
d11826f5acd54553add286b0a26971a8289823b056f0b60fb0a18c101fc46bfa85ab38a6a795629d7bacef7123ead6f9a7a158ec0b2f84c0b3f66db2ee02a004
-
SSDEEP
768:x6B2db6OHzuimyKL+3W54yUMHHu0SV7/eSLpMAFTvfPYmNle0hB:x6B2dhT+OyHu0apM4TvfPYmNle0hB
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e05c10b9c070da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BBA622A1-DCB3-11EE-9960-CAFA5A0A62FD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ae983d20af2f028eed167f3ea948acee836cd14200d7d601359f9bf1276ad2f7000000000e80000000020000200000002f5cb382da423609ed5e4c86893cb567143bf4e4f094d4268161e48c1a9f17b120000000c83b026e54cfb3d5592a786e229792385396c6b0c6b6aa15fd8ab270cc530af54000000020ab8662a64dd4180c757201f24c596ac1dad66c045390bbd6965912479b6dfe20e33a4fcbdfd06344f6820ce36728bc0a70f05a17518ddb384b7a7d77ec4287 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415999376" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000eb972a07972a02ddb921551fed2327ed7e5e3d9bfd78d302edd1bd58a542920d000000000e80000000020000200000002daa34f601bd7ceeb8b806420c33b3bc5e2a15f0b08f6384876fe5f6bcc02fec90000000e0f504b60a36489ff230d244e22fd67c8bb641f07eba5eb5693860942ec35853e591a6444da6be661e8236e08d4f1a6b09b92903292f777418c86c390d53d2fdac00205f01f512627d4d54da06659fd2204c2d9a9e1aff10571676a22fc8d12b0c911241266b0eca5fa38ffca1aa997c8c87c1adff507aed632f21556d6886de867f97fbab3457d4ac723801f778357a40000000aed1e5bb99e3850e78ff11a39daf990a8ad8ae097bc01f3df5ee313a2dbc0f11164432ae4c710563b49bceafc07f0c5dcc2125fb2a381da98b7e731534cf686f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1500 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1500 iexplore.exe 1500 iexplore.exe 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE 2900 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28 PID 1500 wrote to memory of 2900 1500 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b96c2c00536a5af54b08b841de38dbb9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2900
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efab92d9455be9294726d7e10718f599
SHA1509040170e01892a5145eb30847de441ff1bd2af
SHA2566c7e9eae1c4b39c129582db63e4704c779f087f861eac9a1bb4c9ab02871ea07
SHA51242912a1ef88b9759b9b0d70839515269a2428503af325e45511d43d6829cc95c06310062ef136cdacdcd09f816f20240c98921d73f1845f9bd9cf4e3dcb6d6d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3ea56bc707ef00209bf5fcb521dd30d
SHA1ce07fe8770fc9ca77b97ccb9740fea4988acc803
SHA2562ae5c55755cd9f75298acf372ade550246f9cd1834b9798a7b037cc2038abfd4
SHA512d152a2a1aeb1d3842da7fb0371a280275bad3488df3a50a09bb8e399176993213d6b66d45cbb6fb0f99996ff85ef3f5ee34341ff2cbb98c6a0013fa9ac429207
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587b5ede71fdffa3f65ab25f26563ec84
SHA14b71fb3ea1ff53dba18cad69bbb440c8eed4d363
SHA256f44e21c33a3c009a56da49d56026a0eef74cceaafed8b8b287539860f3127c1a
SHA51225ab8bebdc303b53e6f7c6e95699decc93e65353a94f28c56798471f46fb2d2207d2f0f74c0cf9123f9ac025da40b5f6fb4c0570d1ceea659c18b11a3878efce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c44ead0f00c561eb380d6dde5b302883
SHA1ae6cc882c11aa87d34504f4d1a4eb104a87a7967
SHA2563f5f26f7001f9bd0e20d1cafe3fde0fd5730d1fd63a3a6f391854b253afc8d79
SHA5122bd8869c11d16e7b3b42c20861801f16238fc8bf6a4fd48c77cbb29a3cd0a4e9abbf699166c84c51cf6da5006128fb00c0fc2ce508510bc7725dd674267430d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fd48482e93ec389fc54965fd3775bfd
SHA149c20ddc8fabcb3da2de531080c085e274e74ecb
SHA2568d9918aa971105e7436f7040e8baaf1c29e43d3e80656474a8a0b59e50d88788
SHA5120dea34e0a025836df6c41e78ac296c099c14cf11e8d434b97d93a1a36a54eb1bf92f0685c06a9fdd2e40387ab075f19569e2b18aa5b98d0510bdadf69ab36ea1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5719f4b39aafd8e6d2b2d0d53476b1398
SHA13ceed062fd8b1ba7f2c9f1952aa1af6c4ab9e229
SHA2560d89f6ca06ed2677bc04bb9aa4fdb530a26f5df521eecefcc519b52a386f6887
SHA512b7c5841d542fd2ed6e6edbdcf4db22cf4b29c4aabb072f23596445ece5d22a09793da6f879e0499cbfdf0e8ef71ca3d8e46429d111874f8826636375487d7778
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e090fa0aea813c627ab5bedc1b357e4
SHA14dc2944edaa3abfbb1567a6d7a076bb2fb4804a0
SHA256665a6938c570542ae44a3b890fac3ad3e30f66d010449bba541c2c9458646a8d
SHA51278bd3e8cf6002deeef2fab19df964a6870e2df7b105ecd4229c609570326816f3b0a3af7839de4a8f81f582c7993113064e247865acd673fe76776bde961d393
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e8a1184a2ccbefe93cc069de1ce8ac7
SHA18a95ee51a11e06273539ab6e3f9cb5225d3d98ec
SHA256f5db7059bbc9bdfdd9a7a91bf86a20729b8606dfb6a1afaa7086a3eb9f31304e
SHA5129e6ae1ac926b4ac57da3fb09218246b8495f52da2dfc75e9a04398115bd527ae06fca8fc94576ad5f04fc46d74e7266d6e87fadc0bdd84c750f5fcd25b11d322
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea1a6e0d0505f3f7fd47a72f7b57857d
SHA18ab89c56ac5193d095e2cd262aeac873d1475add
SHA2563460e0a60afcc35f8b4ef4fde67c63110b38c879df23eccf8d14f0417783ddfd
SHA512f5629b894a8c9e2abd0d7b76e95f2a7937f6851f4af95a99009029d468eeb1895e037978b1ded6fb822cc56812a281772235dedc2ff8fe6de783ffcfcdfe1829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59acb931b65395eb0d340077c14712b2d
SHA1db25c791b9e92037427995bdf2f22dc49562ac58
SHA25689eb35c3039f3805be5ed3dd5f70b9ff281f00694bbf24f498b69ac7781e1649
SHA5121b9f853a2b4b0b3461c67c3a3b219c1908bc3f8aa311b9ba5ee9629fe9e7ead58eb77fd066eabd93a123d8a265790ef37c15ad6433622e6102508017cd4c92ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c4e800eb312cbfe5e67a61f681a00fc
SHA125f0815f25d2afb05111063162c86d109646ec20
SHA2565223afca2486dc24a0d6b0e78ce6ac2230e4ec4e073cc86a065511cfb06acd4d
SHA512b35884c1ade6f7d81aabd5c9144987bacb1d49928420040bec03edbdf1b3fe1d5d1a5df28242aa5c00abf43a4bc120afd7522af1585a5d3cccd680b2b2cf8f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bc1e24af0b1bbc75e149fe862f3199f
SHA177636f3c5dbe7642d2eb2163226df5d26351fb6e
SHA2568fc27f400e23a163c4ac3beffbf9a8ad6cfd7418cffb7b634567fbbe5b160fe5
SHA512a2b58af5ffee22a819af8e666207ea3f6a90e121c56ee111bcac514097ba1dd29410f5a10b53de651c0ba83f2fd4037254e9553ed35e24d2466974b8711e95ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5840c0a063545763add29d7619366548a
SHA1d1fb8ea927ed374d6602967cbcf8760e9bfa7ca4
SHA2563b6654e51a56abd496335ad8284d98154076afb5b56c3b67af4cbf51673f5855
SHA512deda3ec04b0ef0b79beb60db52b081da11c542024b8f23fc3a5186ced951de4dd895fa90338722c22d4b0285c1b25cbde56d723fffe62f96aa4126944dd56d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59199a1a23c1bbcf649c00dab5546c809
SHA120456d765a7f3af47c4cae60dfd9c2e1e6085f7b
SHA256f173ce19b35623a43b26fcea18e060e511b278d519b1f4203293247c03bd956a
SHA512489e2602f7cc2b1338b3d3374e0d1081dcef56f42da1f8671b0997d15ca677ff0ebee9c3c6bc58e00192b610fd7d49dadfd4227578428b73f658e6442a854bc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553e4edafe750c5abda5d4efb0cc1fb20
SHA10b97534d164cc86b9e3b86ef94c271a6e2958a2f
SHA25621a987b93861f1b409d5928f911acda4f11609b3fc9f0f6aa1f9266e4ca26687
SHA512a49cfe658382eb4881767d38a28112a1a30c981411469c36a304dad42ebf969b7be536ca39fb7962ef7cbcc47031de8f298a3004de7ff512ba5179f14e9f4ec8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb79f90162a3c38be7b70fe342aee62d
SHA1a1bb48f5f1b2b436def8fe3b9783d2fb5893c3f2
SHA256723d394e654b6f722eacad3f2bc4d25b9094c25003da3d1d2cd931f0b4f89f44
SHA512f144359eeb3dc51a5f8db2a27ae9ab6e7d65e90e23f6717f83b71efe13ed150f25cd0b32b5f705b27c5519f8809989eb19e1451546a5f7227861e218d124c00b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552917ec87d0c041f6ce554a3ee356f65
SHA1579303100603ef28a5eac47dea10a7351e7c4fa9
SHA256f2e033f63f0de43fd3717ce359c35c83c422aa1d3e2ea4fb808187e52d0ae069
SHA512a905c01671211956f8539b7df234f8ea70ab8b861d85187749e8b107b4b06627d6da0fe24fb5e0376940875222d2870c41b258474d1068b824cc069d9c26f6c3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63