Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
10/03/2024, 11:23
Static task
static1
Behavioral task
behavioral1
Sample
be7b7837c77e072ee86416bf06833584.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
be7b7837c77e072ee86416bf06833584.html
Resource
win10v2004-20240226-en
General
-
Target
be7b7837c77e072ee86416bf06833584.html
-
Size
67KB
-
MD5
be7b7837c77e072ee86416bf06833584
-
SHA1
010a5153ddb3ed11a2c6ff647b3f9f2c372f0a9a
-
SHA256
e05c1032a11768c92efdf61d27cb6d0ed5aaab5686ce671bdfdbcd7e8ea97bcb
-
SHA512
921c1fb855221d2c46c4e804188bfb40fe0ab6d683040a8a31ec36adc91f783e9b2afdd9272bd6fb155bbdeee129410e822d42d8b3827c65899a5ef4be98d922
-
SSDEEP
768:S10hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/Vk:SQ0eIk/ltnwOHtQNucx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e0000000002000000000010660000000100002000000008932e2f4bdd40ea431da075078623ead68ae9d9a7a86688afbf412d2fd629c6000000000e8000000002000020000000bf2a53b68aff43c2a397cd9a44b03f386726447f8136675281fd4fa306f8b4a790000000cabd4ef94bc2d03da5b7551ba0c4a71989aa844454dd56ce6f8fb128c0da0cb1d5ed888831537d766f85ade656b42b48ade25b38812c88839676e2f0ecec60cdcdfbd4daa17d786706b1f36ec09e7809350824a7766cce5ae4389cd68b12d253b39228bdad34a745d93dc2f63619281846428ce9ebf67d19f05cc864bb12222d86c10d834847efab2917877d7415bddf400000001e2478e9cd2c2e419cabdc1807d106f137d7aa146df56bb97480e71264f45ba68ac9f6c56f8a812ac06ce93836ad944f07a2bae0167651a4a143975a0b06ccf2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9FBD9631-DED0-11EE-A54A-FA8378BF1C4A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20d26f8fdd72da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416231680" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-778096762-2241304387-192235952-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d94d2d3723739f48802cd6414eea5c7e000000000200000000001066000000010000200000004af97288806b9329659dd9ccf51b4dae6ba68e65e481765c6344b891d9c6e29a000000000e8000000002000020000000f5a4e6b3d475b3a27a95e98e271d5fe944d0b75d79b7f8888914bf23dac567dd2000000018a4bab6c62e71c930f375548256522a37dcb1ead45f15520324f4b251c1f12340000000003d78db8a2f2b8231df0a67575e02bb0fcc9a2308b5aeaf48ff0de8775ca34f296a4a527feb2929b7948a0a6543ca1071e85be2b8a6f6b07dffdcc8890d8be1 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2976 2224 iexplore.exe 28 PID 2224 wrote to memory of 2976 2224 iexplore.exe 28 PID 2224 wrote to memory of 2976 2224 iexplore.exe 28 PID 2224 wrote to memory of 2976 2224 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be7b7837c77e072ee86416bf06833584.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5154d0f9e66596b1dfa0f683bbf246eb5
SHA1363015aaedafcdde9a4846254ae948fe1b7e78b3
SHA256ece27a140b98120f0668c5b74384044692e079c5f6b11e575019baa91e871823
SHA5121dbdd02c1db6332cac6a0878cc8cf207c6a2016af2186c97e4f40da62a4b0c9a79ba84b449082dc476a9e730d62c500fa48a893d21c9009a8579b524b17b3337
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5916d3e769e2652fe537ed82f7c16f8e5
SHA1ee401703fb14464e3d52e4452a414c333fd0299a
SHA256b9abf3b23794520abb835a25699e063ed0b5f19cc6634edb1cf266decd4ccd10
SHA5127400ebc16834a9de90651c1d5a4767c65e847c99507d1a27153778e8e89f633ba4c18a86d92eda091bb73c6e6f3aa5ccf0586930c94e609ce74ba417f764119a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52f47c5009a7feb7cb786e81ede1e7c58
SHA1a9f35331f90c777e8a257a6302f969b5de3c3eca
SHA256ad930048a3a6679ef3a7e5fdfb6aa4533c8ea4767d3376d24674116a6f036bf1
SHA5120a00589480b815ddf1aa780d4eec1ca83419a8ce653d06619b49ec882f0056382ab278e9c5f2f3e8510d3d8a47a35ef7212f3cb00bf47c8b70ab2873fd36db9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d9c2294dc0607933558f2edc6f84390e
SHA1dade20e23f4d9eb3d307cad317c0a89b7021ddd4
SHA256af052d1ca461090d327c7d7c28834b0ffc9b7de3cacacb9648219bcc30ae5cf9
SHA512f0ee92eaf87cad24c38cb918f9cd184745e87b4a93766ef60afd34df58e27fb123de76d8cdb0eab4003ba9adf493f0721223a96f83fdb6d22cab75707faa7acb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD597d23fbe7a8fa87050827473eba7a90b
SHA130656b61c1cb5e9f0a3fd0d665040b8aa25fcfae
SHA2567abf46c2b58e6de68e2737904ad2ab2da514ea778ca468a65c09d56bbbb9f686
SHA51277e2a3eceef7f19c5f95666cb68264b2f651e806afb5b56fb5ed3af13d96f2fe02369c9ba8837dad5d7959ff0bc41229081359ce4a21a6f3558178402dc3b7d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD518967657ad7bc80b8c23228cbd4344d8
SHA1cc4faa89421add0e8cc58d2edca02bf4257bc35a
SHA2566531ba4a7353798ebfe306d7c20d5e3baf58ff062749090f46db04b36e896d6b
SHA5124725d26a624aee1b86dabe48f7e6c1f0906d226b91d43e1c53c9d6f89619620d0ff3b740e5105790ef52456f59ceed6b720a1c6595afe28d19d868f67a07f33b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD548ee1948461dc04c6ad620ac56f105b1
SHA1d5894e22b2b008aa22ff016ff5c3096933876aff
SHA2562e2513cfc1729a060ab8abf261a988468be320e02da32d70cbf4bd518cb23f95
SHA512e8ebc99a187899b83747ba973838e057e711971ba150112a4a11fc8614c5cf300b72553d2becac8b8226b3fa5ada0d16a65cf3f602c95beb0254ff88181eab62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58071f573d9eafdb7cc27f2c26f2f3d1a
SHA15656832cb775a34cd6033a874aee46360b2883da
SHA2565689e5733218b4e13e8b5b143e758c5d53115c67b7f35580465a4ba48ca92d93
SHA51242a763094b574243b2135c46974e051cbd85e7285e4fac1239375dfc61c37122fc0a8d81b3ce8c44b3f2817a41fe8816543a3e7e700fb97733f45c239af9357d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582e219ffb8d1cae565dcdad8a158f472
SHA1e933b520c62e68397e93736ad6e28e45d3b11b68
SHA2564fcbcff125db8c2c3657d536444db37a797f5c2890881167dd96eebd092f534e
SHA5124568e570a45ccfdcbd71098b02a117f396ed4c66b2cdee93883700ba4b9b3de7843e3e92830aa7e08162198c99a7c662c7c1237e20dd21d3ef094f672c7c32c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a32fa014eaf58c190e10285339a6a143
SHA1018106639b8341b8078abcfe4ebaacb788ad0289
SHA256d66e7c060e48b5370fa9013e746d2a80d8378a23de8987185c5fea25c7ff7f61
SHA512ba068bfd450b72550eccff70eb6ac304a2b647ca625e93f1cbd6f49a1cce89618fca6d2fcd818e5b162243491eab8de3f13240f2a780bead6039f2f73498da13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57fda0e60a015bb42d9c66ed6d46fe0d2
SHA1fa2e12bb63e03f533895424533834bed47021f92
SHA2566409ff61819e919d30bb0154c0dc793427bfe8ab5b6ded31b6ac3e7829ea7861
SHA512e9fda0ed9daedf2f6c0ab27b53144bd59d5d0372e9b7e5c7454af69b080a0bb4484a65755fad5874e056ebc44f842487ec482f1b185db3a305e7df94a6bc092c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fe6fd92b7b1bbcec921e7b056a4571a6
SHA14b1a88f2a787b40db6e06f5ff70e3ab9eea46bd7
SHA256f337444cd1f19c7ad1bac3d7d1f256aa477276fed688409c83cf8b1a9b6edf0a
SHA5124c22e3629f60accd3d852ac238df90bd6e81c482c1fdde95c241ea1f408da0908a1988d499823bdadecbf3f09292197efad9987c915cc862f05ec89abb6813f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5be95e5d0037348db12c13131a800019a
SHA1a35e6614e90475cd075efe525256b26133d2d58e
SHA2564af9a852ddd15984ec14c2ac211595f8459ba0e3621156148e52bacc2f752aea
SHA5128e514fd53494d9794cf6d3be77bfd211b8063529aa4dc95bd6b552a014b3498e16e82bcae440b95beef74523b93c2506be7c9567e316759276665443c5ec2d9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56d40920ef9a36e8de47ea04186852416
SHA10cebeb67a57580da6110eac029f20692b18d35e6
SHA2568220556db5b77fddfd0e6684e2fe7403944f3d12ba90bd774469acaf3c7ce02a
SHA51217840e14e481105ca485243dfaad04ab07f431b6dab42d131e7fd18aff10e238eaba29a121a161df590a2897ce1c69d98e10ae9511cf015a4b55c7beb79c8c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD583cba04bb26a22b608554c9884bb6133
SHA1fcd8facf792fedafe51d598fa900912381d9cae8
SHA2561a4d7871980fd0d054199fbf22c58ccd7e0fd1f70797fc875e1cfea8865b273a
SHA5127182119d33f74085eb63c90a6b3651a4087183e3205daff7450d69e52e8e645210cccd65861d65b5e34fb9ae9a7f988faeceed334387bccbd76474178812d3d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51ee43b20259e9fff1c5513d600825b35
SHA1e485ca783e456db06600b57c4cced3850ed47222
SHA256d0a8f2ac8eca74b34c58170ccc37cc2b5bfb0b4afc2f312c4afe0dfac5500887
SHA5127b49fdd54b0c4c4fc5e38a10c4243eb7c44d8c28602b402b85c0714e51a79d6972a8b61d66728e46db6f3cc1dedd3c92bc40504f5014ec8a6712ce31455e5f2c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CTT6L9LH\ga[1].js
Filesize45KB
MD5e9372f0ebbcf71f851e3d321ef2a8e5a
SHA12c7d19d1af7d97085c977d1b69dcb8b84483d87c
SHA2561259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
SHA512c3a1c74ac968fc2fa366d9c25442162773db9af1289adfb165fc71e7750a7e62bd22f424f241730f3c2427afff8a540c214b3b97219a360a231d4875e6ddee6f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63