Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
c1b224d2c48023755dc8932202342e4b.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c1b224d2c48023755dc8932202342e4b.html
Resource
win10v2004-20240226-en
General
-
Target
c1b224d2c48023755dc8932202342e4b.html
-
Size
19KB
-
MD5
c1b224d2c48023755dc8932202342e4b
-
SHA1
aafa1e1d8542dbe7c2e97b1c9e9903f7b00fe1d4
-
SHA256
e12ad379bf750de1ceef9facefcc8de9cbf446d44d90186d8ada0a75ca1ff9f1
-
SHA512
6259e0bb5bbc0d0a2e09f3a5449192e0b5bdeb6767676e864db738b4cb890b902add2cae59b5aef2e25cde99dc9b4fa7ad17439241b39724ecbfa2cbfbae75ff
-
SSDEEP
384:4+QfPFd9QZBC7mOdMQUtKfpC5IgSnbmFe7AcFE6kVLDPd:Zcd9QZBC7mOdMQFpC5I9nC42Pd
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008690c0cfaea937c237ec6a539e7dd2db72185d220160eaf46249e4a445477942000000000e80000000020000200000003b1b4b0663d48f6abf5450c2e29e9c84c2c24852790971d1ee955b81ca7c1fa7900000003a54d46c67c524a951486b801003cc84520d6a752fde9dc48679c23aa0f3c5701ced905e11f3b5e0541f70ba0e5f16dadfcf45f1daff2929fbc7f75d780ae3fc01c24a1ec4ff3ccf4db46d71fecf3662101a37c7c1002bcd61fe75ee96939b164ed8a74a90ce26428f793ab6a0595d101e21f0066d1a16ca7bbe96f58195809aaec269d4a2394bf89f96ecc4c40c8eeb400000003c47d0f6f7f845d08eff030decd4a2944cb9dae8dc7710b80862f511b6975b9b98c22431fbf76576312e275b5088f716be8d5994ac6c9df53bedbeb394f7f598 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D10BDCC1-DFF1-11EE-AFF6-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402c2caafe73da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416355890" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000248fa0e87d9ee04f13e4a2665829908dfc5d001f62c3b0dad9d25637870fdb13000000000e8000000002000020000000108c9cc98d6db0e0f2e3fbc0df202a4222f5e05179d8fd1202c45404fc56c8842000000025b03d0d1dd33e081e7f2cfae9ebccf6d5d05ab2d2d6ea498054dd091e4a9fff40000000cbc806bebec2d813b18b45bb4412106871e6300df38ba84f0c699ce3c14e9b43ddb54afb781d0bfae378e1a489e391b9f63de7ec39dbb34e2a5f3c9802a7e9b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE 1536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28 PID 2240 wrote to memory of 1536 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c1b224d2c48023755dc8932202342e4b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1536
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e77fa1b779a34ea941aeec8d8b048c4
SHA124e100bf5d52852de48f1c59ca62482da2329299
SHA256d2d26788841ab556e1b617d688c86d035cef507da9ec0c9a56ff780f75036e6b
SHA5129ae6793ac22603705f78077abb07060c6f62e0bf982fa3bd00f31dd0a714282d72e57be103c78612a1ca984683e436953a565888d43687e116d8398c9437b2db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51346c32b06d097dab82fdbe6a537d140
SHA1a03b0cf3db91539d72e541056d44d0b559abaa51
SHA256e0459609825d6f649f463db839a2e2ecaf9620a2232dcca67576fb3981a91b6c
SHA51295f332d780185d08738d14f36b7af584655569dd49d05df1a57eae240dbe9b50fc62f55b4c85922405199b838e78b9d749d46748855946233f14c1cbbc9cea6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aeb9414a012152f445605b122814f9c7
SHA1cbf6c60ed9eb267529083814c44f4079adbcaf88
SHA25672c1d9d8f59b6c7ead4815c0717655625e9bf73abf09d5a40220ab2b09329bb9
SHA512bebe65155a83a9a9e009e9a95a303bac9d20a4f1330377e61814fa63bc8acf4c5b5929bbe8677dd75a743604ffeab710a0db8a88285cf66d42bf0b6a57e1de22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526c2cae9efe97cd57d184b75364887ec
SHA173bca0906293567fdbff56890f69b57a13a93130
SHA256d2560bb8b138577bc778aa8d33237480ebaf9a1b733308953f3aa84f2e870bb5
SHA512e3ca9f638660113f5f9c9c84c2cd4a532ab34f4f1379a7c074e28d40fb1e1bde6db230863b089b6032ae88de0a504793a0d2be76eca47b2caa59fa60793cb43f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cf26d49f67bcb144af1b37e78ca2698
SHA170e083f9b93e940797196f9c4d0c41ee50118546
SHA2564bc6dad4c15a64707f556bacd92816aad100c2ab70f9b8befe077f4e87c27126
SHA5128641255af0017f62f4a938add457641580e4375b1c45b1cc12efbd967cb5e67572b500b84e222e582ed92e9526d9becf4f2620f7ea2ec9cd97ff5591de46f4b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ea55824f2b345bb2a4f898a61ba2330
SHA19caa692c170cda31737029a41547d078f45ed1aa
SHA2565fd3d213125bdb94fbb8c840141866a84d2fca62b9ecdacedaca35542f53d65a
SHA512e80ad1c522ab01ed3d0c68c8e66b4eaa97099b0f26d8dba57383b4d0cf98ddd86158ee824fdc5b89892df8021bf0a674f1ce113b46525c97c3c0f2929ed88fd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5feabb78ebdba0aa5f331300b388ccd3b
SHA183f6c475faf97a2b1fdcfb2a7243fe9880dc8ae5
SHA2561c211b413c05f20f54d1fe7bc64cabb04c2ead218c24cf4f02a2e1bd1f08eba0
SHA512a79e02df2067e61bbbc674f88c86e0f09f490c6ac478a66613d8b217390dac1283f2fa07ce3f4d27047cc01c59ca850445f5bd49e218b02def134a3c83c847fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54585f846d512b78e63b93b92f24191fe
SHA1e34452c2f06c0ea0e547c0851d48ba7a405aaf7a
SHA256d1eeba3264bb90950244c69c51e0b5b639cfeb79d12b99166144ef53456222f0
SHA512c1c03b2be7fd1e5a0b9a44b28f42a3dd0b65b441bdb3d0c2329addb9587ae0f0f8a4b9bed1e1ecdf82fb2c8b1fe75b40c5237964529013ad165f9b526703eb55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56202eb40ec44fcc4d57d8c747fff909b
SHA12aab8ad863769d9a80d8c60b1855c87dfbc1d1ca
SHA2563bf280b9cba9617c56345fde9c59d352b9c75edd556652c2be8d4d17a87aeeef
SHA51221217465880f2f87a05416706c8391479633452cdd34b481b3e05bf67c845fd5bcdfcfaaa8bcf11cadf0ec85048f0c4716cc9ba13f785a45a74b669c31c2f75f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4a881968e7de91a8432cad6b782cf45
SHA1e94992663fa91f58a8e33036dcafa3a330c2f3df
SHA256cf0560eb6d2704c76d0b278764f1fa3f6b7754c3f3a033d498bd066d2da023ad
SHA512bff8dd5bb7f022ba6932437aca176307453d0d982eba57fdb00fa6c21c090400c0d4ff099fbc81f57474d719376b805b1ea70d536dce7d91f1335d8617a5c6d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571da7fdc826fd390fd050f794410809a
SHA1aa6cd300dbab27ee7204e576f1ba0bffd7b28781
SHA256e81ce5c1b52f0a24aebdcb3870005cf684379973ea52ea601ebb359e85237fc2
SHA512893606ede37274ac25177ff61945a201b8b56f4e430c62a75c29113462b50e7897f5d3ff895a32555d3654a7fc6a4edfac449e828d642df387f0774a6ce144ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57749712a1f22589821755df928996346
SHA1e048502743bd65fb75bbf5beeabbe6e44e02b0fe
SHA256a55673e4f2fcfca9a61a822bc29943ece092a83f5d73bfd8757441d172de1405
SHA512e2ebe88cbe9358f8f7ddca0310471e20537ee376fe22efd62cdfc176be70f677f4a29a7387de43f91cbb8fabe30ec1b9c2b2f7b23006f46048c4d36eeb7ef48d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c92dce7a0b9a024532990e82670bf35
SHA1d364b6700b9460746b5fa0311bc8aa1108edf676
SHA2567b9452b6096c44f21fcfb9c2dde700ec1c50eac4e606afd9df17c3401ca4ac9a
SHA5121b32b8b828d836c2e3b13b5eaca6574805f6e14c75fdd957a1c7cc461316ee4acdbe9cf2ce2d05d377111d93fbd143e2731f92cf1721988e4816133bf71ef014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ae33876ae9f48a72cb2260cb28d5b16
SHA1524405b63e58e97f048e20b7a02f187e89c31b74
SHA2565a2fbefef7d422ace00668100f0fee98c312b5fe5eea1203a9dce5f2dd8405c0
SHA5123af7e8502424f9b05d602360c5a9e5d2b38b074183958e764652e9a1ce2f4e7c5e5cd8992028fb2249bc96c6af3504c593c7642ad99e0f3e5f59492a5d237b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5574e2f73cbb89af2f2abcbd55f1972db
SHA18785c628fbad53075b614994d417507793814317
SHA25613e45f3dbf49fbfa5ac15d712525759bebeb35fb8bdc29559e2350f404d9db6d
SHA512c40b808e87f88ea7fdf1b1203675cf3be4bbd7245594bb2e7abf51dcf574dca7360702fa777f78f3e1f5b1b1254cb50581f5ef94bf47abb79aa3dbd3ca6b1c70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a750dab4d954abc1ce1034b0bb70af62
SHA12c98003e97a10272bb0a01e52e0600ef7ef89192
SHA2569829d26a8c5a07eeef94ddee775fca0c0f0ef1499e8caf8c7bfb46aa5deb2c6a
SHA512f7f006d21ccf2013b76ddd0a8b08657fb7900770cc381d24894b53b5b81d59a5bdfe698412c14206a033df924e9ad34e116bf7e3a45f1ad8692d6dd39cb4fac1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba496adb55ac5df02f42f7da2f9b9207
SHA19592fc9b76683f866df383a5fa5c6078e5159929
SHA2565641463e7190d08ac229b0f6e44005b766dc380a459629a85d64ecd4d9c610c3
SHA512fb3b0b9f146a9d49ca5c82a1457966e81fcf8e9c29ff272e79bffb278ff185b96e01d440fe9a8879ecf69959a7e3822ed521e5a3f615eca456d8a7f0fe65c792
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63