Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 13:02
Static task
static1
Behavioral task
behavioral1
Sample
bbdfd66878338f18882be002a23ff94d.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bbdfd66878338f18882be002a23ff94d.html
Resource
win10v2004-20231215-en
General
-
Target
bbdfd66878338f18882be002a23ff94d.html
-
Size
6KB
-
MD5
bbdfd66878338f18882be002a23ff94d
-
SHA1
5f770224d2276a4ed6038dd185777c0092a77e24
-
SHA256
e3574088f97a97f119d5548bac932e14912a0042c95808193af21cecd8c012c7
-
SHA512
77360b6b978c042876587c22575d817ad84690b5fb4dc0708db00c701d74a1a31692a0c32000401961929d11ba938712244989cad329045c9792da0bd60ba2e1
-
SSDEEP
96:uzVs+ux754lLLY1k9o84d12ef7CSTUQbolcEZ7ru7f:csz754lAYS/Volb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605feb2f2272da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416151246" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5A23E771-DE15-11EE-8C0A-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c23067700000000020000000000106600000001000020000000f80e64eb16b990f475f8a21ba92c5752b36ded61ba81efbb730ab983958cbd9b000000000e800000000200002000000090e343fc0cc64e1827ddaaf02f1106da5ea73f3606ad0970185006b62e3d2fe620000000c806271e1083c0b445046e7a93087da62c54d47fbf7792e834972e316e33bc0b40000000a1b889aff1d136b50ab0a3ce20fd914b856a1e57cf17ba2a5fd6170ccdc387e3e4715070075fca409e390e274695fc3056bb26aee299af01c0ad1330af23226d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000c12c25e2ddfb54dbf19c8710c2306770000000002000000000010660000000100002000000006170eb9828031c94ffa5a5c659a8483201b0d59b50a915afb909c7c2adbaac2000000000e8000000002000020000000c62760c7f2b888a37a9dd56a8dd0bc41a4cf777fc7710ea2412841811133f436900000002ac4eb129686f9e319baeac5c5151915e2b0cd40b2d6b0c5ae4db8b419eb9818ffc248c4be756800427166cfe904b96f83728ce97164607f2f0e663422db745334d8cea08ad0c9eb9737031131e23439938f891d511f871015dc8d4bf24dc7da6381be4da6579e5feb65361c5f4fd3c4de4f947cbd380a10e212812231acff57741585900c81c176bb8e5fe5db665e71400000006fded0375666494b0588c8cfb0f030c33d5ae0b9b45bf4ae38d6e3b42e8382107cae97535e311877959cdc2da180e4218cd2c0355079c65dd5004d7c6a881cd0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2176 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2176 iexplore.exe 2176 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2068 2176 iexplore.exe 28 PID 2176 wrote to memory of 2068 2176 iexplore.exe 28 PID 2176 wrote to memory of 2068 2176 iexplore.exe 28 PID 2176 wrote to memory of 2068 2176 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bbdfd66878338f18882be002a23ff94d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570000d1ecafd993c49d291383d66107b
SHA1a80d35ff3de84766803f0ab84559c0640838beab
SHA25609808b6112dc0d7ab51faa642cd212bb80a54faace8bef2aa4fd5bda67015638
SHA512189864f5d30a1e7454588698dac4ce07bebee6969f4be736475e639a3cb9b158b3c99ef54310c014ce85367a15bc6123269f71d58bb09fdf03db1aca0a1e26f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb0c8955ec1cb169410373a5bfe5b35d
SHA15e26d4913810e8638cd39e8bc1dad164795a335a
SHA2561479606d516797d19c63b1dd7ca862b08807c7a4f23d4bd45291ff1ce6521480
SHA512650b3ac4b1bca56bdffee416c290051dde75a207d1a00d7f93fb9115fe8a283e1fed922e4f546806b8db795759166f81c85944255ee5c7f01a45db4e65e80986
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53160b095c5c024aa334b31b6b1e8eaf6
SHA13be2f39428bf5fdec14f2ce715c07e83071c6e30
SHA256b095fd316d3ca24c945cf589d60692bceddb932f72ec6c101a22a4ae46dfe200
SHA512919879a9dd231e26a718ce62c4dc477176b3ceea03d5b0d1edb21f15a9475cf1d8fc3258cdee5eb5c3e60969a91d17f83f94eb46ba89df152a483463e6a4854a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cfbc91163b9a53f179ed439a45092d7
SHA12e8d7cb0ef6c7a1463bb7b16b5704d623cc3ce21
SHA256eeca4afeee48e59452a0df23873630a8087694c6a4bbc1138bcc5f156d77f7ef
SHA512eb7db48371becd7c320a5a13afe6436aad53b6ee371db02175c8017f089d3d60cfb9c40220637e0d5e82ea2f86a15d9881fe55a917cdab64d9eaa9042c69d7c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6d38661a07db438d9bc5d86114479d6
SHA13ad0fffce0d8fe43a8c11f5bdbfcfd6ae3feb1d6
SHA2561291452c9b38685db1a834bdee350baea815ae9ba481a60d003ca4073edd1cef
SHA512e9fd5a70f192f349529a5e28c09c3337e0e0a8453911aa5115be62529999c9a04f9a670c24c5a4e34bff7374671a4fa637262c46a4a60007c843d8a3f81a9779
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9f031aa4aedd4be8cf33f10881f836b
SHA1507a2e21d6caee52d183967c904d42961154cf50
SHA2567e9eff30234a0e3ca9508bb1ea0393084510138ab949ce61de3d7fa7d5fc7686
SHA5122797306b7d5722228e702d7d215a55350655ac27bd75fdb5dc1032ced8f809ccfa8d6a5f2a56c47311d3d49b58c1a1d02b0a86bc47fce1a2ea54a20b4eced461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c72303f48bc3506374249a2e40e4813
SHA1d834b7a639b4a7eee30ae90241b60c9326f7bfec
SHA25659cf68b08b6fa3e11b3f875f6aee91b56c1805b91cb1491494e38b2077d59501
SHA512fae241996c96e662436325d021156461dd67e4c31d4c910257c56a29945e527691038f79436e5dc414db3c274b2577b6329723a44b18e137b0a85fec81265cc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1b0492233d8b9e5a99faa957f9329a8
SHA1b62554046e4b65285ba170c7e5c56b2a9a13844c
SHA256dd8412a3338fe292f6a80145e50a92c08c6586d9db49ebb6bd801454e7b82c0c
SHA512a70da032d3d4bd3390648ecdf49e4c2b087399a24c57b9ddd34bc7279ff9fa209ec957a1dc682be6cd380a4bb584a6b446553dfab9cd6f99b5a07cea9a7615d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca82c83fb1e3f58a316e9e8aed22e7c1
SHA1bdb38719d268a96aeebe003bd0d19ca3f2bf606f
SHA25662d0009f16ab2770461b906740ca0563a4f63f5b7c8a577ceb39bd058e7cdc7b
SHA51216ae329e845364e38c74eb0d4861f2cddb22140f81dd2fe245821101de3c96ad0583b698e0d503c187d43915c5b419a768b2544a5aa379b7e8268432da01ad34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5580471ef4f9a988c24eb7827a259bc12
SHA133158528091c37b0596a0f957f09b09b75d6f8c1
SHA256442eeaa84398560d4fcd77d51ff98466da8778f65b4e3c94bbb9c98058bb2698
SHA512ee76a249a2a8a57262343bc9482b8ae8d22090ef7fcaa89ef57f831976503945854de8ccdbd0a7777f091c37fd2fe93a02f45e6ee0e39e97f2d80e6de02ce15a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4456f5ccfbb7c4ac811bafa1380eb15
SHA13b195eaebaf075f241096c726d56b7e641d878f1
SHA256f061eea1d74d703bf528eaab78a94314b2613ffa1cb0d8f8d83f9fd29a4f3e66
SHA51248943900a628f760aadf74d6969da0255362643329834218946e9dc645d07e7a849b624adb404235eff80d22611dda261b68149861fe817607ac77fe03df2c40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f9827a4bb089294385ebdda0ddb2b6b
SHA163f42638ac6756257fbe0bf41f7ba54812522df2
SHA25690bcf7a6a5376cc50f5be315ac6d3bdff80e393a17ada49a906c1683365cb0ef
SHA512ea3721327cbbecff77248fff9f65bf394db027d4c4f6083d526bd054e9dfe20e33c766cfebf3108c26d43c319db861bb6605eaf7da02a8bc2f2a2f9af6062fdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594c10af4e8f81b8cbaefcc3f77b17b3e
SHA1cb4ec7f6acbd1e338017bcbe59a13539e4840a43
SHA2560913c0562b34a4e4b2a4e6943aef50bab99cbc3cd0fbeca449bdaf8c2d8467b4
SHA512a228726ecc0eac4f09c6e407a3687487528857eaab6f6cf2536a96cf115fd7659a19dd19d03a36647f7554f6fb5a583dde2a16ee2388c1b6e1a33d85d7979653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f717bcb1ec988102304178c65912a4d3
SHA183759147d0b936d43264d93f07d2b2f746d7f552
SHA2567c0de2379fc449f203dd9fb445c35e3caf0c53a05e1122c3fc441d791f919369
SHA512fb4598d2fc0aad64c8d5392d2089b16fd0789532ee90e8515b544213b786ddd3d58bcac6ee690b02b880830df64a42da66bb2e24d3f2a853517064e031c1cf3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5172a8afe2cdf73e14427720cb1726536
SHA1cbeeb1ba23665b27970a9a173a8f0877904c37c7
SHA256eed719a38f51ac5462a3745058705f2b4e8dbc670bc0f66efbf46e2958bb5b05
SHA512f2534651a6594f99736a0cc8df786fe60f7a737ab90c02090fa9d6e4bc7010d358b402a41eecbc212aaf29ebb8b1574b72f55bdb5376dd3e2a4e0162b2a68aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5680f5da3ee2f95930b2f57462f47ef77
SHA137194f9c7f1d9e68744d62f2a75b29d6b9497273
SHA256590fa6e1eeb5c8947024c1bf7f5f5e602b3e504aab78ee4d96781b0e06a1caf9
SHA512273896551a506c18041bf41f6dc6f81b3cc9c3afdade9dc773db82056c2666aae5cdbf99bfc2b5c7826fe47f79d38f26ee75d9a035411a852d14f1f5c734a3f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cec23ad64d1cee95bd49dab5c669a6ad
SHA17c5fab12da5e65b2574dbcee4421c958ff28988d
SHA256acef162e7d9f2f3c50b74f40e36839db5bc6d229fadf860ec985368a984d201a
SHA512218e40bf8ac81a09c1017bc7468ea0abd5965ebb5f03be398403c0a25b7c2dc26e2b4371b33ed6f74d730bc2f21cfc940612257ee33dc435881dab65cad46c00
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63