Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
bfb0904f18e9a0d21cdc11418f363c1a.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
bfb0904f18e9a0d21cdc11418f363c1a.html
Resource
win10v2004-20240226-en
General
-
Target
bfb0904f18e9a0d21cdc11418f363c1a.html
-
Size
25KB
-
MD5
bfb0904f18e9a0d21cdc11418f363c1a
-
SHA1
061eafaf4c9242c12d6f925ee12b08e0d503b198
-
SHA256
9079f8d98dac528afac0472a5d77d12fb007cc91ae978ba51949b141cb6b5d93
-
SHA512
8322dbd3c933c6ffb5045c6e3a9dc74223581e60b7f92ab96132d416e1af6f7c073a948f9022891d470c4ae4ed71900de18b193ee15500224d4ef1c141ee9cea
-
SSDEEP
384:lmnA4ywUOpCt5FztvukeKXXTuHwP0aagMLIWQQ/U4cR1LeeIYECdG55LkuxOk7gO:c1GhtWkekccfu1k90t
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d65ef06173da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1B9E7601-DF55-11EE-B1D1-D2EFD46A7D0E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c224e38b4a0ddee6c58f57067619c452680519fa2ec9f173197b66e89bd4477a000000000e80000000020000200000007fa5d0528b4079ba54a593e9a0396aa63c0acb4aafec8726a60af6a235861fca9000000098d6efdc446867232a7b0bc7b3c299287c9eff15e915087a81f97a6d445dad3e649d4e4a35bbac63003daf962e7678c558a97f136b68bf4f28047ec60770fc2a17529730c1ecbc8efa4850f763e28ecd7b40b520947e362604a46c1eacf99c48fc05dc77df8586cf91975d1bd1a574d355faa3a10e0f292df90d0f3d40a0e40852b843cb3e3330c42ca3a02c239bf73d4000000052577db6be059a36e3ac71a7854659b74fc44dc32fdb260c7440a5d4b4f8d88d2235b6fc0243a7217216c312d28797d32ac5da7dd0f45cd2b7faa9f01233a55e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416288581" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000003f18d9b3fa727cc64c17b36a19b25ea417717f2e3632b1071d5829533e66e473000000000e8000000002000020000000c88fbbab2a06a56c2f3560818d1b4bcbfe0373ad1b8c204ec1ad0536f96d715b20000000e84453e0ee664438f3a7daf5859771fe544d7a5d64cd98ddf67043788549a50f40000000fca7b39831e05f38f7e7a4299b96c84e196115dffe41a0bb957a1dd66b1ea8688c8f883aa5d2b0d006da3fb6d134333e9c3ac530f8a7f45492ee35ccfd0a76f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 756 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 756 iexplore.exe 756 iexplore.exe 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE 2620 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 756 wrote to memory of 2620 756 iexplore.exe 28 PID 756 wrote to memory of 2620 756 iexplore.exe 28 PID 756 wrote to memory of 2620 756 iexplore.exe 28 PID 756 wrote to memory of 2620 756 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bfb0904f18e9a0d21cdc11418f363c1a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:756 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d280095c44a966a58766a375daadd68d
SHA1ca4ce92b1edd212a35b7e348f666fcf79fb08751
SHA25603e49c1320ffd85bf9cf9535348afa634df4ea13e09371a22efc790864509c7e
SHA5120f08a28fad178d1cf7bae9dc54a60ab419d987f98453aa0cc69e95fb119ef405d13e9c267b118cafac5e26ced7e8fe8ff4ba329bee1ea58e8a4ff417630d5304
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c3be7bed86a433201113b67d523c7fd
SHA107c03fca1ce6b8ab81b7a64d2a4cedcdb30bfd3f
SHA25693381f0cdc5c049276047289da86cfae47fe21ab655340ca68a8417bd2e580c1
SHA5127591fe3d9763c96aa87767d0e2ecab3f6fb06ed559a89c29039ab9fa5e91d4097c4228cda48e6ad4deaa23d0bb9e682c1aaef5ec7a7207baa35fe3dcf087e9ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e1d78578fddc13e9ffb56e7ef407edc
SHA1ea9fa091a84bc80ea8db9e1fb06179807f3715b7
SHA256feb57d8afde667bd8bca8e49871762b626bd7ae40b06036688a38e3c8ae3884e
SHA512600fe77018c88059799f7b443f239566ace6c53c283db6e227d0ffabe9755a61cb772812be346adff17ef127c665a1bc3bcf48405065175edb187302ed3dfcff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e48dd4bad26dcd425020b3d5c87f736
SHA12a47a086f8b431da0d76ed0de90e13218dab2dbc
SHA25653bdfd133d1ed16de0432f151c70029949064096c2ed45bae9cd2cd21787ffb6
SHA5122c43d8eec94b03df30ec15b589b349f62892f92ed7d66f25c23e8c21e2e6fb65e68968d7b43277e1e32de98e182d1d5faf60e0f6dab30ab29067a6f6f702d14b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f88b5c6250d64fb2e7f56b6893703b3
SHA1029a96909f20947a791cd4dcd01a5ef0493f69f6
SHA2567366f168a3fc0e5565f4d22afa97558af1fa31c124dc74306759ccf57d92ca25
SHA5124c320b37929cea7e5fdad4a09619978ba6c1c4f81174777eabdc863f2942bf352adc1a61bb0628339df2044445073864607be02f4cb1100c21459ed1c8a95571
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540434c31afa268ba09e7940b017dfcef
SHA1c1cd8ae9efd52176189144302e55a4c0f74c7dc2
SHA25689bc118598b5460ecd7a911d7d16440c73675d61b9e7ab017c1e7f1e217459db
SHA512469614c2780322ef3cd4abb353a178ae45ef46136946a676b280d7ce7a740e773ac82997a0d4865ae3a42766086c978cb3b297e2441bfb0188be810ccc23f009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5a8de1a3c94acdae49fe3cabbb0f27f
SHA1412b321e5c04feb632eb763d65bcb197d486504f
SHA25691cebbe76e7d7a7532786a9e4a1155fbab198dfbb230f1cef0e109db6f76f2c7
SHA512643ceb2f59079ef04fe8c3951644c6abac37d06ff8895bbe91a3a2eb9a3a450b00219f6ccc8410c19ec952fb20332a6edaf428d0b9c4c37e9801b73ac7ea0e9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f2e7bc584c8637052e5a2db1d1a909d
SHA12171ccfd70113043568d75d8e74b2cb0b947c515
SHA2562f516619443f328de606f20b2573ea977a20deacdf42d8a9c21c09e5063f20d3
SHA512c30bc00625d605bf83b3a67aaa1ade2e01dd54bf7e13f2a1b0525f6fcf9036b43cda3433ed2101e8ce7cd0bc3288726eecace012cb6acd6ab4b93eeaa54bdbfe
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63