Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/03/2024, 15:57
Static task
static1
Behavioral task
behavioral1
Sample
bc36d8e82652964d29d476f794103c15.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bc36d8e82652964d29d476f794103c15.html
Resource
win10v2004-20240226-en
General
-
Target
bc36d8e82652964d29d476f794103c15.html
-
Size
12KB
-
MD5
bc36d8e82652964d29d476f794103c15
-
SHA1
66efb1451ddcb1117ac9d3d400520d9ed68a8f40
-
SHA256
23bfe281ecce32babc55edc32776fe934e736e697937333fce397ee4a5ac97bb
-
SHA512
a7cf6e00f2bf84643a3f79d09bc3f69e4f78c81e4ce84842d09ab314e277e51179db2070a5a79d70206de01d9f9d74871b92e344af7b31b8359c2f7cc04371f3
-
SSDEEP
384:u3u7YQ1bJld6rTyv6Rb+nQKrlibQmYMH/pMF1E:BHt5gyvCAdhi8yfpe1E
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BF820D51-DE2D-11EE-B686-6A55B5C6A64E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ee06953a72da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd000000000200000000001066000000010000200000000c66f5bb79116f0cb5347f50948c19368df9176ca952cef6f418c09939a11d5c000000000e8000000002000020000000438f4dfeb432d4260640e52f9081cf4d6d952126eafb2ed67f071939820d3e8f90000000da86aac9fc27f9fe77699361d4b3d6c99189db2b2abd9bd71ac2782790e5ce522d0d72f668e253469840a359206957dcfa31aaba7cb6977bc713bd166981078853f3aad0fb5fe4af038b42fb8fc8a1890ba781149ac9cfbc656caca496daccd9b12cdcb4676efe2773d7ec53f7447059a24ab70589e78f49e3fa8108bb2dea9bf739060468046d2528cd7b7832fa233e400000007468961f0d5412cd6a732ac674289b3af3cd220ec2aa8ef53f537581545525221166f2df01a5e9a9dba450cad8fc7cbbbcfe99e18d9749d5eb2d48fcf748f86e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd000000000200000000001066000000010000200000003626080d6211aa92df7be855ebcd35a0840ae24c7bfb7aa4c0b45216346b01bb000000000e80000000020000200000006871a819bfdb1c2f65899f0dbc0bd01bb1730c639c8e0ed6d3ca08fe6e1c37dd2000000097c0f388a11c1e91febddfc58143a3a8c9225d5e7fd09ac54b742c2ef0e417da400000006b2ec2f818781945c01327d63e3caa65fdf85b608bd6733ec93584965b8950f5208f2223fa5e02f2051432d457bccfbaf5f44088bbf37ffa3aab92c3eabbdab5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416161731" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2476 2112 iexplore.exe 28 PID 2112 wrote to memory of 2476 2112 iexplore.exe 28 PID 2112 wrote to memory of 2476 2112 iexplore.exe 28 PID 2112 wrote to memory of 2476 2112 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bc36d8e82652964d29d476f794103c15.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c634c41434496ec7e87c460f85670a7
SHA1f752e0a8ba9cf617e3bf4539301980ed77532087
SHA256d9e5e45546a0670863d87aad4613f6d7ed46b2a3f1d0ed6e79c442ec263ea771
SHA5129a3bce5c2a9cfb009e6108277a663646ec01bd75afdb64c39af057734a624d295e074870f843c8feeaef408f51c22feb36c9c9cf7ea626cdaeca05282b7cbb95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c86fc6d33cc9ae759f5bf286e3794867
SHA1de4750ed16ca62fe155280c52415451735c15a29
SHA256ca192a4844839c1c85c981fae1084b53fa6a59ae9b33bbce60f320695225bf49
SHA512ec834228c16a85b0277211a974ce076b5d89f1bab18142568ad36bda5c621aac9396640fd3932d667f0998cb568837f5545774a0e6ae44e917df0c5506180c69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57616b8282c58fabcb6b986b1f6c7cada
SHA1182036f0650117a52ad8bcd40c0d66375f707c89
SHA256205a58d9e970bf0d3fe9f2fac0215690841887699b5ef640effbf9baf8112778
SHA512c418ffff7cdde62f78feb35ed3b53970553f9388ce210d44ef426f6c6aefcc1cf20668c569476ae10cbbdd46f61f14ebc97331e270a4400e68cdeacfdc314dee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1bbe61fd83f5abdf323b0cd6855ef07
SHA1fd14b12709240487ec7a7446fa75d195987f5adb
SHA256e5759d21ca9a7252df086d2919356b540984d9e2ba54ae2b0b2f47f26ecd0aeb
SHA512bffa123e53a7924e7d6c836505e17e922524c0967dafa7da3728add53ce8cce2c25411c5460e392b1a58d9098ccc6492bb3f3dd80d4d89f25a30da05e61931e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d4b9980f4e729a25022837fa60598b4
SHA15e3f17f07015de1c3c319a128993058c2ee052df
SHA256fda00c33cee58df47cb6a9ee81720e06a243b9ec884110e6e635229696168d11
SHA51262cb96b2287e5457a12bdb84701b6149b349c8ea62bac252f511fc0c4960e4920e9dc260fa63660e5ee31710520fface1a8c3d68a2ea75657ab4ed87bd7ee51c
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63