Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
c39704000435a4e7a32f6f0541f2fb75.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
c39704000435a4e7a32f6f0541f2fb75.html
Resource
win10v2004-20240226-en
General
-
Target
c39704000435a4e7a32f6f0541f2fb75.html
-
Size
50KB
-
MD5
c39704000435a4e7a32f6f0541f2fb75
-
SHA1
c646b2372d5e682310e950d1f0abe9b996f008f1
-
SHA256
779bca5528a6b4da705d991068739c4ecd69f72e4927e22ba0171ffb2878fcc4
-
SHA512
6b66d1a02c1ee186d56799cf8b7dc9c982ab5060e81c9fe2962b8fed2dc3630a065b3ac02ef3a74e211ea9a0061d246ac75992122d9d5981b20b6e8548711527
-
SSDEEP
1536:mIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sj1hc:n1hYwdzAS2AQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c60000000002000000000010660000000100002000000066de9cf98141c525fd315bb2347336a52775e6298da22dcd7cf3aac6b93f0958000000000e800000000200002000000062a6e1f1174dc2183aebb63b34e379c84b02f1d4f011fa2990842a44fb47e38c900000007037a0224b650fd831b1955dc5b361d4bf619c44a6cd92d11f86927a3d9cf4f36f315c50b58f1a2539c69c561c140336aee91b2e1f2fa2e5f50906090d958b4f3148d91f9d08b49ad994c903d0ed67f64ddc645c34e435ed4ca11722d9520d9d5311b83f384013046f04cb80b07309a256f5e95cef6077dd7cbdf53e94a19578a4128d3a0acbf724785c3d080e1f592f40000000b95091fca48a15c69b5fd0fb754645d9aa7b6489d73cf5cafea7fb3810f153dcc5021b286915126e23697a05faff27963825c87b863490a4814cd055e4c32502 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{272C4011-E07C-11EE-AAE3-FED1941498E6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f240fc8874da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c600000000020000000000106600000001000020000000b4507175713c19b4625b27a68ac429c0b996d349d2b1fe239db1dbda57931d21000000000e8000000002000020000000d76a398238b12bc5425a4b6d1ed753ba2595b79da703af770ecae4d1e97b745720000000f8e3457f69800c957c2dbebead83fc7a0e5b5e69bca78777b9effbfad54040c540000000fbbb379abdba7a7ae2d6989de59edbf4e32e0c81e79a8b9c13c2f3cb994ff2e1a4e3d1a38cf3a16c6e751178f950bbe2276a4ae0a0f5c7e762dc1fb1d56457f7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416415301" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE 2976 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2976 2296 iexplore.exe 28 PID 2296 wrote to memory of 2976 2296 iexplore.exe 28 PID 2296 wrote to memory of 2976 2296 iexplore.exe 28 PID 2296 wrote to memory of 2976 2296 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c39704000435a4e7a32f6f0541f2fb75.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce5e6e1f69c4d7578c38c2f1941d1b0d
SHA1d8c9a34fbc38edf34ca81b39275396854c7c0e3e
SHA25677323a319d42a1b6afaddcdad183537beafec590f72e0de1cb8518ca9226e768
SHA512ecd3957efb11aceb883c16a29197f31b3264dc51da867cc21002e749546016cf3aa507c0a5aae5a5168466614512241f6440958321791f419129fc7843bcb602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afd0d0fcf3627850ce5ab698ae01f35d
SHA1d33b749527e68aa63649a8c464621d2fb1495487
SHA2565d2a77cb5b9e9dc2b7f86d8d910564a9d0e776830d314a4e515c047e3798efe7
SHA51237c86dc4a0e6abb1c97f43d119e7aa3fa143665b31d3ae67b4076bf455c309d1c6b547ec1a2f8f3e58af2f682d312d6be1f74ae430b6bfb980ef8a31b29e59df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565aaa9bd28669187cf87868800953312
SHA1ed4b37e8c8c4cb26fb5e97c9b22597bbf283f390
SHA256f29ea6ee0a5abf393c9272b1bc28b21369db3e2b45bebb245fb0a11dfe7020d8
SHA512804811c8fe4e87cee8dbab3749c3ed2bd900f922b011a7de1f144e36f0ac8391d0f04c8e96ab2490fe577a2e574fa129695eb621d5b5bdc2197dc19ff7f594ad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563f63f5db383e496566a8ae74c4971ea
SHA1843d8686571c087f498358f5f2e1561bfe38743d
SHA256ae080d8885770afee8b6f93ae5ac89e7bda09fa13b70dc3e0d9a0431e1cd25ac
SHA5124473c51feb42bb4a9133acd842bf7b940785bc090b7a45b00d6d72862324a2cc6e0c6fd5777e84fba516b69cece2c80ea8970e823f07d3a754fd2229dd96f387
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518c245309731d55d2a1b104133ee9fd5
SHA1c89edc145e3c7f6c09d3c114f1a2c30a49850dd3
SHA2569a7c255c07d3f8e48c7392c64f33aae3addb3468f9eb421bee4fd3dc41748997
SHA512e4d00eb11587aa4b4df0e452b8e88a9385c4c3fbd151bc47e8d5df91c545900ccbbf094334cc877402eac7d89a1470894ac25895e6fcd35b7eb2d5724e79eaf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee50bac961ef6899fed08109e8c79e19
SHA1ea494b01b4a2f4e9165f84425f63d3b04787c58f
SHA2567e72df039825a3170583a92ff869421b1f2733eb57357727bc27231634caa2ce
SHA512e647d4fcc1c1c3ae245bb86119a461b4dbd458c0add64ef452800986e010d617b94d2c130570ad706563298c091babcc48253e78abc688571ea54ee733233ed0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9d77db8ae8ce79dee201e344ffabe67
SHA1cfb06e788a77e0ff6d159ff70ea60128c2f6282c
SHA256306bf171551d3b1c5ba432ca2a852dbf30901d880f2c1213ea64fc1fb80bb518
SHA5125bdad3b8d5d02bb8bd7d620e6b94770ceda0894c11b444c1763d0e3584cf23e98a9091679dffbeaddd1d2d5a64558869f1f26102d238095a5bf926212b659470
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569c4d5b052190237ef19bcf0b69a5bf6
SHA12e08ed36a1d338ac7c8b68b13507ed7d80757d6e
SHA256c602623137ffdae659be7c861d798faef02d9d164ac2793b2476b8b451b7adcb
SHA5126a5d2815a20f4430a7194414f775465fe1f7a176ae1364d177151c8d1cd358fffbd98b9004ffd6782d6b244ad15ca63cfcc4e03436ed3fa8c9dbeb3c9341f922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537959da97e2f77bed0bff5c176b6d52d
SHA14091736c7510271a65596584f41f97cbc19bfe94
SHA2569b694de63db66ba9923adbedd2c9492db2b956a918293ab1cb02a21ca2900093
SHA512bf77d0e55c3eb1b024b270ffe013e6affc83c1a675fc0b114f4905c81da14f3a43e4399511cc6e2977bdcf092581e0af4f7749d65456cd90168e2a4f13e64772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562b87a68f046708952e895c00163c2b9
SHA1942739a7ff66f80f6ff5a64e5e0e6f90d3d23ced
SHA256027e2b6351a80e864411dbc7c0c559bf3983f197c8bdeda3434344df26099746
SHA512ff0e783069ffc4fcb306f383e560a5c14bc20bac6fcb14e0b78df0a51b1141a245a8b45c9098c2fbe239f0442f4dc48dd3335180e5056aba08205d49a3093d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c738d341b0cc9b4e2d6391752d786d78
SHA1a75bb75217e034c70f396e3b069de0bae2fd60aa
SHA256e941dfdf8c550c718d26798fe0d5eeabbbdfc720455fa32a5844319d55b74b46
SHA512fd97a399ef6e2d15abaafcfdbb42a59d420444fe338ca559379db4414ae3e933090f4365d3d22734c5a67e0ac52ae7362cb00d82256e2417a68761498f4cd060
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d46a53f006c014df97c2b0b450abc0e8
SHA1416f47f66ec28f7661df2fd09084957371ae6a05
SHA2562c41aff4fbdc3c31873e40cfdcfc2aa7b8e43cb4fbdb367ca7cb94ba5d70c996
SHA5124a8bbfeef5729ec286db25cc2384634a496d24367a38e2fb4d7c545d5d53a0b22055ea7d5909c37d11c1081c84c268edab84fe6f684e018b9d8abbc53c332a87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc3e927935540c15171aadd339b64df2
SHA1f65abff8de1d0befde5f5573bce834203c1e5531
SHA256526e0e832e9736649932785c470c47206293357ffc11077bf4af6d70bf2d1056
SHA5120a6f57c586b5d066635b6868c19d35e6a7685608246faa4f540592af5d7917ce63b4072b1fa3d569b32110b89e25b5d07317544b6e235f856c8ebbd03ab82d50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54106aba3cf687441d4e9a72d900c35f6
SHA1423ace955dbf96f79de86093d51e8281bde8a2e1
SHA256f080040f3714bbc5138430e865f93d2130cae474aed862a91d78e6881b9bafa8
SHA5120c343dad721c6ab99f68c396b2c7b37dd7058a58b6800555cbb67c020b93c5e3d3467b333f779376bfff669d6257e27b750b3656a6cbbe376006e92bc534fb05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2bf0b516ec09c977c5ea8252c2ab2e5
SHA15d980fe207828537939c055bdacaecd5fa311042
SHA2561849db883e9f8dad61208db0fa963d1477ec7ac3bf02f435a4c3c4d2aba19a8e
SHA512dfae3cbab3dec36331354da6b3939ab9a3a8e5f7d248e500fb11f12677c3bbb762831ce9091e36dcb2276e551838383a04bb8c1cf60a8a9f5a74d0bec6877a31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58de1a02978cc729a9334d3c17e6220ce
SHA12e81b776b2069ddfa38c240195134ee4c70655eb
SHA256d5555da1ec9e81a84bfe27ccd66dc2315664ba1b03505cfe405dbef06f0a9be6
SHA5121d286d281f8e42c27860bd8aa2ea28a2dc8ca8f14fdc5e651c30df19bfd05ef5543cd2f59fbc661f954ed81ebb8e078be72234b6aac4d6e0d91a5288fe152e17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef5a297c200f45bd349f24f909ffaebe
SHA14ba57df627da28624f4fa3a12722ef4268985b41
SHA256b4300e6bae3c35fd0ce8ec4032f40a26c5a7263f090fa5d09f4989fd17ec2936
SHA512901cd973b205df688b76681d7f63d4edbcbb617b23eac6f1364113c91bfefc4b8f6d5ae4ebe584194c78170c0b5c450fb8b16eb4aeb41bc7f41c233c580d0c38
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63