Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 10:08
Static task
static1
Behavioral task
behavioral1
Sample
c052643bfa493491419fef19821f80dd.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c052643bfa493491419fef19821f80dd.html
Resource
win10v2004-20240226-en
General
-
Target
c052643bfa493491419fef19821f80dd.html
-
Size
28KB
-
MD5
c052643bfa493491419fef19821f80dd
-
SHA1
74d3addd5ae5f54d84245fc83df2a36c2e95a819
-
SHA256
86568e86764a85f74069c50df89c98ef92e85507a0d8db4159ca248493a4f8ac
-
SHA512
8bab5c661b53599ae9b74646c9d2920c7f152bdb9eed8aabf365b7ed75b4160d638391f3c0e486f86e557a88a71465f68fe53b51c0c8f037e8db17d03d2a993d
-
SSDEEP
768:vp8KipkoiHyQv35+N21b1bcvtuNpgyZMavCJaW:vpZ0R2vp+N2R1YCTC0W
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000c97a8fff7ff9151dfb91d4845e7a957cf3f35698eb1afc0ecfa666d58faa7947000000000e8000000002000020000000ccbec539eda4a9ee5af3c1000b4601432a536450a117bc460f6034f6c4215f1e900000005434f08e4755900351010c5a2116fb6375bea9e619c0795c7c95bb6142ef64b2ea4a493aed0d4bf3f56eb551dceaf752d867811b338b9e3d989def00bfd86299cc7280afa308ac9f5c6a968eb367bbef82d3454f6a520f351e6cf0e0aa5f77c3d5b3be0b13cc27b266ce9ed16c2a54044a2e66d6795a363b4ff867ed6a43baa6ece2d7f068da4503e585a2e6a658f8d640000000404bebc1ca1a6de395e4838dd5cebec59aa0651e6acb72860190dd3f8cc5b0660ccda5b72f547113074ef24ae2e8f55e2d6756cae2f146da05293e9603be179b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d060e82c9c73da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{558E42C1-DF8F-11EE-A8CB-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416313589" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000b00c1c1ae8331861ab0d75ae3fb54a376ad912081c9353a1ef798aa227d05573000000000e8000000002000020000000fdf94eaeea6de3c546c1490da0b207c0afcbfc17c6a69ffed091204483ae0c792000000079eda08d9a62f5f880b71043e0adc35339b35bb827db921e29ac0dccaec42c6340000000670ee3b26796dc24bacfe98c94ef21f3bff9375b325b5f0ef8fb16fc99304bbcae1ed9435cd7b753e31161d6a73a86cd2a9aa28346d62ce92f24990dd8350550 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2352 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2352 iexplore.exe 2352 iexplore.exe 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE 2092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2352 wrote to memory of 2092 2352 iexplore.exe 28 PID 2352 wrote to memory of 2092 2352 iexplore.exe 28 PID 2352 wrote to memory of 2092 2352 iexplore.exe 28 PID 2352 wrote to memory of 2092 2352 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c052643bfa493491419fef19821f80dd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2352 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5443c860dee4fccf6cc7bc42fad6943d8
SHA1bed2f99f6e7a6031bd39c3622858df6e8f06cc65
SHA256f5a23d97491fb62c99107ac46a748f4ba26d332fc0dd2e52929f731aaf57b19a
SHA51249fd6e0bba2ac3cb38945390d3196f8b6326129e5f99dbb980787a12668cee29585e431c6285acca27de69f784f3c84bba260441ec03940051763fddacc585da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e11778333099f605b0eff8f6b2db1144
SHA191da87cc5d04e34b2228c6f145fce01cda3a281e
SHA256859badcbcff3b9e4fcfcea2b0183416551accbbb4658271358b4bed62032d7f8
SHA512a19ca5e3b43469d0c0b98b8dd7d7f08f2ed40606a7822ee2d8319c9df913e489fbe0ca97a435a3e62fdd0dd624b55523c4857ae575212275211419c849871fec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a1a68da48f88e46dd871cf15d6abce6
SHA16e71a9d26b4f0ae79141ea2c7f837a96aff2dd97
SHA256c6f96be0a24abe1f62ad5e12862aa38579b1ef01e437edcbe18541cdb23d80c6
SHA512609f145144607f3fd82ec7940ffcea03938107a6e52ebd8f845d1d969de2c8f5d66a289b5c55e3c65677f6fe2ae651d5fedb42b5cd6f3ecc59696833d2f22639
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cdd97539cfa073e7f54dfaf33c94ac1
SHA105f6f26bf8d6a551abf7bfc8ca1e84840610f9dc
SHA2569389b4e998570257459027064afe864f1ba6e72fe1ed2b7c41b7391378c19637
SHA512e5c20c5c5aa4871b0fea6dac4e1981a6680e1831b1d0d443486c433948ed1d01607becd02b131460ea4049b74233b9257844071c209252c69789449ed9e7a4c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5931cfd4886cd38e253066994b1f67fa7
SHA17fe39a0bd349ba5d22f4ee0c84577a323fa60c6b
SHA2561d2f0deaca193dc0d88d0a0cd7dd8e733e8e1a38b41dfe198e27f11615fdcd5a
SHA51261b50d895ec03d5a09928c07d35999f58cd0f8ebaeeebfa4218caa90b182ca88ef7404128371bb5ca375e61182aa5270ab586aa2856ec993904c83f057b51d1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb38d87b5c1f15a1329d02bd1298a63f
SHA1618b68a9bd4788733ccc228b1fc7670ce22d45ee
SHA256a9607294b9e92812f4360a9f779eb139eae3cdd3dd913f31a8d5c7a25ed51b09
SHA5121b43cba93c9701cac771af167cc48ff7454cc4f602bcb010196856e34b94cc59e55d0324af8d504b3c8d7eb33465ad8d68d61e1ac0ba1e7f18a50e8759207234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5438900ce57658657d9477c9a8998e6b4
SHA1a53236fcb934dde08e967b16fa25374d943ac163
SHA256132b861e03afff5357974918614560bc20fac48f5d46198ca31851e2ba6c0187
SHA512c354ee4b58ae1749a8cb7bb4db43f84935041c7da3926b922881e754ec5055a9460993584fd1b1c6c1eac6689f7494ece8ce8d74658c759ea81981baca14c655
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2c172eaef95734fa3dd6af13a87d747
SHA1a40e665233e27a66ea73efa968c8f6e444849d6d
SHA2567ebea3615c0690b2c2531afb7d59af3ef675b0d675cb388ef92612f1d8c075ca
SHA512069aeb820a8815faebf99b610f2845b6602baae6f13fd224fc9460f1d9c17aeaa5a8de5fb36610b6748a76801a29065a1aeb64455895373a36179e099ae1028b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b43499f488cb5636b2f69fef13683afd
SHA132745d0188f4321aea9399642ff811a68a3f385f
SHA256eff8d08b3365acada2248ad349694695780dff0334d5761885f46f54c849fa2b
SHA51257b66fe23662c9ab5d724bffbd5223a4b4664e96ac04445c26897d983408f459ca3dfe68fe4b2ebb64dbbe1d4579bce23164ad2e871aef49ce77116b02295d53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a090b0d3068d6bdada2baadba5ed2979
SHA19a9f6c216dc3c7dff722aee7ba18a656a4add6ea
SHA2569bbdd2d862de62908657f9a4edfb61b8b1389c3a38b3c0ee7b64ed403581fc8f
SHA512408fbd710060f9a1200b4b394a38824d0a5e035958d1af43814d70a7599bed1c0ccb9116264e105f4553a5d2f09ee1e29e08cce82aef36b29814ff7c2ff4eadb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553b7f816f71f9f83ac32bf431dbae928
SHA1aaa7bb3073b018d222ad09a37d03a4ad13060d67
SHA256c147b8f3b3f746d97a704adb57cf5e708588722c55c88ebb2ce891ea5e3c90ee
SHA512e445b0b42aac3ed18ba3e2db544645d947706e8c8ecc4661b6b97c67d8aadb5f29d188574b4d210cdcc020de49dc795443d2510beca1164a9dcf7a27687bf1d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544c3b6760ae2d62afeabc51212152aa4
SHA172faf5022f9df3fa2d3cdee0ba8dfecaaeda6c86
SHA2561536326558d202329a5d7b13e802df093eaad3833d1969502b6a0884119a765b
SHA5127e5b64ab607af9adee49efd69e18ae0d0be2ca472e151327c2b7c3429c1ca7b62daf3f8297ae2dcc7ce60b1afeaa1c0eb0cd21e7b9a7994ab333d023e98229a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cabfb814fd59c1d0896587ef90e6007c
SHA1f141d77866789261c3f86eb3a90c16f1b7f49720
SHA25653544c14ba2b7ec366bf5ea46b6911d571be51e6120941cf8a1b476dc7e7d96f
SHA5125f306250d32d96a843083731ccc543fe29bf86d9cd99f65659bcc8ccea4346810c063afc2021be08c6d19382e52c0726c99a2705a1b10cd17834864658fc8f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c76e0218132ac34026bae52a6c57b522
SHA185f0382030ddc04e8465c16ea01dd591cbba4a33
SHA2561d84cb7dd53d7c89dc6be74cb11bf1d396c7444327368403c9259c7562d7b24f
SHA512b6f23eeb86797b441fd8370e4dbba322a80a824e512929ae4cb2396da16db4987908449b515a74f8d461f7e12de59318a171089e81f9892e8a1521795df8e259
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52665c3d259b2b62dbc43fc6b5045de28
SHA12b4475b361f46599796d4a1a5bd2957cb5f480bd
SHA256eb7c217bc200339222ef17a38587d1bf8132227875f283582989615c60f5ad2e
SHA512dd05091df563838a0128bf942c9cc7efc27c4b8cfe74a9f8468a2f6eff6c062a3a66de929c3397f9c08e199fb57803463b20cf53171280559730fe3138d3f7ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adf863e47ae35529a3100bb377be58fd
SHA15d0dd3230b3aad6f707263bf6a30d872287a52ef
SHA256033a233caf4efb282ba2d3f36d290e035777823d281d5638f4be7b9859f0e3b4
SHA512eebf4bb381801f9cddd7368d5b5c8bd307e3aac904e7083d4a684466082f955113da3fe91c858bc96d9527ef8aa5747181292ee8b23c71f4025bad6ae4db40f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b2099b2c776835719fe6ca449ccbbf4
SHA14a84c9fd282928b753ef8d5ac8f94489c6f4cceb
SHA2565fb67c8a9daa7adcd6c996d23fb4ca65a6948ceb464ba10e7fe62f60ae39e279
SHA512ecb6ef97051a7796252c114370255387ee48af1c74a820c3026c33482db53b1a98943826231c5e45e95a412ef7d4d6dbb0e1fb5d62c91c1a24becebd6f88ec33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526aed9dd69e27a84dbfece7940e6493f
SHA1bfdb6e9a512655ea5d7e955efd17f6a131d3c790
SHA2564f365faac0f5cdfda02682867a30c3e105999e2df96612ec44939bcfa0ffabab
SHA5125d2751fdfd783d5c198cb1abc94299a377aa74aca14777830c189e892ca7855d45e2c7687b5436805f404ea7eca93dd54503e29159ca401578d929b591167098
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63