Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
11/03/2024, 09:29
Static task
static1
Behavioral task
behavioral1
Sample
c03ebcc47ae0b75385cfa2ab72c84ec1.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c03ebcc47ae0b75385cfa2ab72c84ec1.html
Resource
win10v2004-20240226-en
General
-
Target
c03ebcc47ae0b75385cfa2ab72c84ec1.html
-
Size
4KB
-
MD5
c03ebcc47ae0b75385cfa2ab72c84ec1
-
SHA1
3c22d1360da6550be28774c28d4b2b1f156cd963
-
SHA256
6fed809b655d3df1aeeb7bb8a49636c842bbba8792c360deffdf06cc7b36608c
-
SHA512
9e4e7618be1091e9409479431c1cba9580191309bfb557ccea3ab2d768ab2c1b33ff1889b560d8ca8c12a46e5bf14a16bda0fa64269c71ff66e2cbb664c29231
-
SSDEEP
96:iLcNQ3KA2f1fcf/XQtfifof0XNCyflYp0XzoGkfl1f9tfXAoDPQimPf5fMYAmpvs:STNC4hk/DPQDmC7zSPMUPZYE
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000c362569d8b94c58e5858e81ea2bf0af05008e5ad3b748a12ad9c18c6bd023df7000000000e80000000020000200000005c85c0485b871d804afc6fb69795487f90ae27940134fad8194436c62bf7b1fe20000000dc1c4797308de0935bb546036e9c43e3630ac319a1fe6587959936d408d25c0040000000e30e7229ab348db14232fa2e7e362baaec53b86fef4935f3b65cd79b811def9c2ada0b90b56377622a0c41769da57137a8e6d6759adda99af1f500b0be57e281 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416311262" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc500000000020000000000106600000001000020000000989b1689867e078adc0442bde9310db8c899c6140ac55e164138bae7f79c0478000000000e8000000002000020000000f11f5e6a927cd55d9344db71d885dd41a938e18a70eb2849ccdb8fc67ff8ec08900000006304be8c30743b4a451c945036d53b3174cc0360037e241c08b149ce6ab5f6b9a73cfbfe4acf133611cbe013f07cb223e44f5b4f7d4721963fc977b0f256206cc5ef44255fefa8037ef60675a349e082854cff31f7a9639b19314b00a0c5edf28f27508bc22a9b21dddee16d3375c35e857060bd821c1f8050fb671ba45361eaffdb4c91960ffb0883ea9ad7452a373940000000fffb85b0c2acb59a5c3b20762b3494d9bcd470e3ee8a2aea700b9239d3b1feca057a857661f9d26260d8c0ef3985352ac96b3264f98665165645227a6e76914c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E78F2641-DF89-11EE-82A3-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60ca7dbc9673da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1036 iexplore.exe 1036 iexplore.exe 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE 1952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1036 wrote to memory of 1952 1036 iexplore.exe 28 PID 1036 wrote to memory of 1952 1036 iexplore.exe 28 PID 1036 wrote to memory of 1952 1036 iexplore.exe 28 PID 1036 wrote to memory of 1952 1036 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c03ebcc47ae0b75385cfa2ab72c84ec1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1036 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5345885117378e08e6b41237c1f0a4b7c
SHA10dc56fc8f10d00bbe054550555db31ff74806fab
SHA2567de92a106ae405e7a637cdbf4345f08654267d039353e21c9e5f9b35722c72e4
SHA512934e3e23fbc6d247f6f0a1476f733416fb58cd45d2541c487fa594457ff7277b10e1cbbeb1b0f1b1331e315a7be3db6482cac0c13621b40298c0f83bf40b6792
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb61607b9f953fa9b33998858c71233f
SHA16a6a63a2de035c28a742317eebef81950e2ef954
SHA2568ca883db806b51ba6a1f03e8f1174b09e7d6ea6a9e4193dcd4e785241d0cc403
SHA5127de5e8f59f47640ebcc1763b27aba6902f58ff944bae93a4debae1ff7d9613d42b84b63c5f0d2db8d6e0c9481e753566ba5e1fbc32d9ff92d7880f3e37c4467b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f69ebdbde0ab994bd807a3f13a71193a
SHA140d0440d7316727a70f696062e79866e7ad7e653
SHA2568ccb5d420e575bf8184bd1c32d2a51801a7fa3479a9e859a99024616cd9ffe97
SHA512af13c3eadc2c127c113c3d3854b1b123e3a26a7f7f1da5765a608237294e46d5d3a8295a36324c3ef55f26cc9d5de93b962c6e37acd2a13f5919010cbf061695
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5093f5bbee545e5e11e9bb7a305d20eab
SHA1d83a5d86658299f0e558b71ba7fd9826b64d8df1
SHA25622382f5709bf2622c3ecabcb1dad0faf3174cf15580aa260c61df393111c75f1
SHA5123b2a3f1beeebc28ad6d15db2b46600652ebda9769f29afca22a12bf64969fee27ba771ab0b2315277a3bc4b0cff09216f99fdbb72c6ec8fceb933ebda8545b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559bdaec132e27faeab8dccbe02f53640
SHA1d4c8c616781f0a9562ff1f3a021b9852cb507337
SHA256ef8772657ce521be7219d12513edbc3b2a317dd56406a816102cb3ce333877d8
SHA5126b8fbac09a18d47bcbc66b127749ea611bc7a36f3bc13c3d164e38736b157e2bafacf8276bb52a6c2b80fdbaf68dc293cd30614dbeb7c0a537de4e5b54526e4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5062cb601e39821d80ea7a46816af53c1
SHA1a556782c60271555cd18a8637a76a00d481e2397
SHA256eeb986f75b93c78ec2e02ddf2cb9b603eadfdb48a65987b977d5fa92c0968fc6
SHA512a021d0a201a173d308ecb04787f0d87f3ac8d3f76ffc07f5382a2377c3e6dc2393b3b4b615242c6a45e91ddddc10e269b1b73cafca36e2da0e4f1aceecc287b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aac41d429ddbf2ce4d0c3e805df0e325
SHA17d777eadd51db2aa7d367f7a5de991eeb0bc52ab
SHA256d5d1256de75c81bf73d9d80fba194621a762848ea8fb06cfdd0f1802b7eddd7d
SHA5120238ccfa2f38c6a8bc98764949adc04c4a8f6cf821f700ac3b700c15bd61fa7af68c19671508289af092b10fcc7286b125f9edcad4556ec3f05ed9d9b0807b13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5478e3b24dd9b45ab975c6d85096eeac7
SHA16d8cb0e30b663711cdb6fcbfa2dbeef253604a81
SHA256dd30112694e23ee1e40440bc302a63116e2d83470c1af05aad259fe501927b1f
SHA5120d68fca4f4f701e0d6e14757d68208bec209bd62def8463279b89a9c81774b8d0704d3aba3b06205cb7fbcdd5b241345ad465606477cdd93c6df3aa56cb3dbac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d26ebb9729f587c1c60f09c06acdc47a
SHA1bab1e8b49e8b95967505b87de4802a134fd21aae
SHA25654b15964e4562ea394f49ce5840f2809dfd18b467e88886f97fb99c7cc7dcfc1
SHA512a0c2cc9084ea9cd0e8f0c4f0abbf6999d9ed905a063b429033d7fc4fece3e808c7f834f15e4e8c12e0fef3b457df3d9ede474307625097229275757d4b64bdd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd863c556981b1e933a7c992dba77246
SHA195f33b5cc4e9f404ba38174b39f683f6f68fff05
SHA25623153658ddb8a626dae4184b4bc60635b3b754a5bbd14af3f8336db0679c1047
SHA51240bb2408e01b371b9860f9a2254b51a202767772f0c267b5906fde394c00355058556f6792fa95ed7928f15b245c54ded388aba830efd0ea222fae35971811f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599f8064c00f1fe313caa3fdada2bfec4
SHA11c0ea92536df2bdbfd4419ac64a947ccfa3fa740
SHA2566f4caafc5b9d9c861382fd767daafeb9978aaf108c5d6fcabe6765068b0478c1
SHA5124c2d56641b3904c2cb1d01e72578906d09749e36ed932f11d0842a3f43473bbdac8497842c75d5373de4f2aeda10f57d2c22305709bdd7a8fd646f480791bfde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555c94369066acfd577ff679fa1e8a8c5
SHA14965ad1b512be97b47dfafd9c66cddfbf95fa804
SHA2560991897d16745a3da19b3b218906f657eab3ba02cf355a48382203ae54bd9863
SHA5124910d4353d4034fa28b0e24b3bdbafb115e034e84ed3384455b82ab57dba49fc7e21774d6be52c076c388a0c00736515ffb1ce5ce6edbad773bf7b9f7b2c3cf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beed57aaf6a6758e9aaac6359dfde593
SHA133ed817ed6855bbf481c5565f3964e99892792aa
SHA256d8bffd3297c7d5ab993690ff47f042b4c2997fecd58072c671245dc7f50104c3
SHA5129e2b7f468c633ac40127a412110c3662ad51e83c3faa4ecfbcde3fb31d86f45a81f71e9d2b43c1ff5fbdc24e25687f2e6d94e3878a4f2994b9a72a5f223e0681
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598f80cd752fabaa0d597f25ad73c8a87
SHA18d3b56bd9bde473cc6429f5664406b6d556e2a58
SHA256638d45e48276eb4d1327a80c54253d5ad4ed05049cfc79f46d36847e75613495
SHA5124cb477387bc1d1a3fe1cdfbf39b29d12eab8a40c643cf51392985824397a4b2b63b4d34c37c099f01450b0e667e1df4c140ce5d85c5da08e24fd74d90579db0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb9ae857173fe3c5d4df331bd3fb9c7f
SHA12e25f02a9f120f612a5889d6dcab892827ee668f
SHA256cd265e19dc39fa4dbab30010de2b59556ea414014af61201a574c9594795e07c
SHA5122e4f5d84aee916484e3e9c58f6a9ad8fdf80b1d6417d64ddbb3d185bc82f9c94052fde9843b82a39aec7d52e339bc42a311ddcfa9ac5f3048fb22d3981ee2698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7cb9f02d47a25202625b89d52acdb6d
SHA19f2c8bf9b6de31d401234117960aa50cafe2cbe3
SHA2565a1f64138cadeafb11031d045600883af6616aa41bdfdd1492e46055fecb9b01
SHA51212e218edcb691f8c181795b560673f01d4fb05a4192bebe4efd896b74dffdc62a3535a7071c6213eec2db01cc0ad6d663cb1921b8011bcb40e01ddf16241a1c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56962686259d3148ac24a7f690edc6289
SHA115c393ee0a84ac3aa75e2604c336167564c36336
SHA2566cdbc2bc99fe5abb4253c2fff7cc1775dde92ae8928516e5274f6127a3fc5370
SHA512c30dc6d83ebd4fce25553988639b587512480b2ba9435770ee40c41c41a8c7b212db0172f6a654ded1c2ad261dbc4831fe021caffeffda0c5d56d26ceae2c159
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63