Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 01:34
Static task
static1
Behavioral task
behavioral1
Sample
c4a2ccc93d4f03648abecdb4da114225.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c4a2ccc93d4f03648abecdb4da114225.html
Resource
win10v2004-20240226-en
General
-
Target
c4a2ccc93d4f03648abecdb4da114225.html
-
Size
6KB
-
MD5
c4a2ccc93d4f03648abecdb4da114225
-
SHA1
991d40d14baec05781332e18af124e7d6bf7ca1a
-
SHA256
dcf8b71f4b77cbdab9823792071cdb376ca1df37ec8889a0a6aeb3ca70e9a231
-
SHA512
f60e8d68153e47bbd52835f2cfea4fcfa40be48a9dd6c21692f9f043ddad50107375c49f5ee57694c3a17476c28e430aad854f97874d810e4cb718da4314e059
-
SSDEEP
96:uzVs+ux7GJLLY1k9o84d12ef7CSTUr5CY/6/NcEZ7ru7f:csz7GJAYS/IF4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416455573" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000c917ba90c6d3035b2f4d2115532b3937b5822e4453b247e61f7c76ce8c466e3c000000000e8000000002000020000000508d5f6a706ecfad5e717a9b5b83a4669b93a0a920d9ec9f303088a2b434829a20000000372e6f2487ca35a311830e7dfec695754bcbad4abe4b2ae1f83554765a634fec40000000271aaf1eb0210ebf8dc6d6f214e852bae46b16faaffa95f2094417ce4b30b514f700f8ad35dd6e204b06d9f0020b0949fd8dde30837b4ef2b04bd0c826f4addb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E85C6371-E0D9-11EE-9143-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0031acd6e674da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fffacc0240230f40b575ac5982df49bd00000000020000000000106600000001000020000000abaa0f02b59f38b9aa6da070aad79ab6e646ebadf8bb83a054b8e6747c98df1c000000000e8000000002000020000000c3b206100362cc6bc7085371dcd22568bfceb5a86f6033fb3d1015fbfe0d39b490000000660b6e0aed846b4134e4c4649cb05726b0889e8d212e7909f609db05b74258b361733e782c2892caee1613ef186a7f1783002593f4a490ba40a3d08a044a4938b0128aff6543ffea7450b5aced68b4d7c8168959e63a95524f6521a389712472bdd491ba5c883fc73bd6b63e9452ea87ba3b15b77e4de31e57f159342cfc50ee2ba757485e8b87fe28b4665e3279c69f4000000042de7be9cd949b95fcc89fccf0f542fa35ed4dddd3c56c0dff3aacb67e73c92cd43b5e959ad14bef86f6e592605b2638cc6379b7464376e71a7dfd5739d829f7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1650401615-1019878084-3673944445-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2992 2248 iexplore.exe 28 PID 2248 wrote to memory of 2992 2248 iexplore.exe 28 PID 2248 wrote to memory of 2992 2248 iexplore.exe 28 PID 2248 wrote to memory of 2992 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c4a2ccc93d4f03648abecdb4da114225.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5889a7e5458aaf23cf17170d046596839
SHA11d4577139aff07ae1a94d0aaa0bda6002e2096de
SHA256f02270bc82737c6c592abde748a753d9fe690bbc2dd1fe1d5fed9749a7245bd8
SHA512ad3ef119cb2d450e06f867e4578750833419ac3faa9598fbbd1a109afd5977b3b5bc0d832750c394fd8c14b8c6f28f3f99a245ffb9fcccb260c49c1aa24232df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ede443f81223b418bf5619ff6d3375bb
SHA1a93b5c6d9b6700e29f5c5237d388785010f074ac
SHA256782bf801cf6d7c8765b02e1a6bb9f392d7303bae6fa3f5e953941fc3edd27ef5
SHA512c53e1fca9c5cda9929edebd655a187c70129128f00e2e63b83b5871f65e63e8a90a6e24617b523b7ea88a8f7dd0d3b58cea874c2e79cd081067246cdcab8f264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d4a8d026a6873c0130a06ed1ccf11eb
SHA1c465851f3b969d2f53893b1deb415bc2e963eed5
SHA256d7d8ba9a3aefed8916c03c53696d396ac2edbcc64a6008de0c115fac818516c6
SHA51206679f2c40365f394d09a93f1a0718ee2b0aeff50ed6a825ec654e8141d57ea2633b2cbed9c7329bdb0296ce9492f5a4ca0df6c884ebb67974f719993404994b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533fe7bea5b6108c992fcfcd9e9dd7fea
SHA1192c412fb5a77f0a66421d58d6ac6dcadadd118a
SHA2568526338044bbaba87c2d6d99ea6f2d4f69c3a5697bf3b85554fff1479a860e35
SHA51251770dccd800fa4b7e56b6cf063ecccd268cbd51eef2e355e4c6ed05a8fc2208e07f017eae378a5b230b227adc9b02b74fabc559633110db1190c56efca95a47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544c88c1a3af222b8fd9491e7e1fec4be
SHA14d65320b14e31eaaa9b835da070cf6f1147bbc9c
SHA2566899d52d392e181e3e4bed35883ff52045f0c32434d529d8a6bf7c76ba47b5d7
SHA512b22559d26549a38eecc951c3199db095f14581b96662622c0fcde10ab1e7f9b576a1b6c23a67bd40282785d87ce450041d15d6f65bf9803ba32a21fa777c4ea9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596b5ceefdaba81d77bec13d730e275a8
SHA119e6160f773f882aee63d4b919f01e8969d9055e
SHA256e80e6d180761864f0b0130d9e4f5325fec48023424db8dac64879b9bc7fa96a7
SHA51229e82e9498c2c6bd3719782d03b2ab51c96e5542d4046f15db5e924240b6ce030006ead885c8184f1f6419dc32100af99d7b95b2729796b637e662b5a6a768a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdb6fd69c237a1d3fedb97103612c460
SHA1bc0242e6a33c7e3ef81d570ee589ab4f1aaba7a9
SHA256ad14337e57f14b93af98c0bab938f62c93fcc09ec9953e0793eb7cf71a8db94d
SHA5127d959faedcf9839cb5fdd8eb9992bf74e3096e846ac7275a32d9e8dc855031ed2a50dcb814a7525eee2feac951ac97f81943f0ae36404fb951b080ebd700b161
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f18f962e6674940ce24bff041e7aa097
SHA182f0b37541bb2abfbcd90d81e099e6a749d2a6d0
SHA256bdf73ba411afb79026cd2331cf497e5c42af6d717873d6f4eb0466040d8099ab
SHA51250ec8161aedf9b8588aa79c3c897447e0a2d5f547a07979b801780cef4d155502031558958062e704ece40264bc9e1e64327434c3e9eb5084514794fc1ff764d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5e1cb3b57668c1983df194e4d615af2
SHA13fdc41afe2b931581b805ddb873a713c876d2717
SHA256baedce41e8b440bf5f9645e57dea53f477bae4f1e8929813eb8c5f47b46c5994
SHA5125e9673889ed181ccade17e65a1dad36a24cfeb271b5a740dc65c66083fb5faa4394f10f922e0d2881715b2b84e5a69f5272feafb3a82a0c9ad42eb359cab94c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c7c047aa6853b29c4e2572d05c6282c
SHA17f487e16fcbb13005ca909065872e78876bd016e
SHA25665e9fc08e1ad59882dba062f42a4ea2e789218721f13bc89f8ba1d798449c480
SHA5129f5203f87e501d769133d2b26c3c5cf6444d2cff13a6d20b2b6fa17cfd621d0dc0034a1ef18e347fa4674e597a5db53c726e6e8072c6822a2783609455d40d7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ace8d9a2398253f387ed650c5895a202
SHA1bdfcd9a72e32de190eda6022e40b89414129d567
SHA256e4b08a418151306f3cc8923342c740228be61011b126288efcca65519d43185a
SHA5124b1e0185d40fa7cc3b484e61c566fe5b039b93e952a21244a3cebbc1f0e9f9b8671501e77939fe37c0f8cf866642297b89d5631fc11ec2752a201e2e582ae69b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5379017819464a509cf0ce475791b9ea5
SHA16c01b4597c6c348d8738be25fb31ee8eab8922ac
SHA2562cc6422dde3c8ba7022429930db0b0fe53b20624982d7a17c146a82fe074e337
SHA5127949eb74b235e3379842fb8389336a614d01e05d794ec6ca22ccd4ab3c2ea698e407642a923d03287c4d73174145e0152cd14f08c24cb7e3fb50be2bd703f0e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2c0e584132f3aa546c68ec63eb004d1
SHA10d6515c87106263512c6f4d52916a9cb7824a1d1
SHA25675c00108164dfc795243d6249d92d9186a5dc413288e5db2b1fc9c1057ede4ea
SHA512739e2ab6fe4b7e99b7c4641c5d77af82237bef110bc46b78ac1bbb2154b230c779358e30089e95e3f6b141e73fc3788db0de7977e2a67bbdf627509526467141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b146bc4949af74ec7c506451a5cbf902
SHA1fcc27c22d54b333b5123647426693dd03130703e
SHA2567b769ce10b7719bf390cfdb75fab28b00982d0cc3bb88915b4ab934ef90bdd32
SHA5122c995353072ef8eb9e75949ebd42d529ff6c6cf17ff425017812939f415acbbf29871fc400e5cf040cd7eb568a255aca3341343a79b1effb93aaea0b5ee91abb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5829605ce00422199c935d34623d89add
SHA113acd04d4ae3251c6b7af40d444f57bad7112f96
SHA256305c4377b42cdf0b23ef8c5503c0d13494d0740a29cdde177dc6be04f7fbdc1e
SHA512b6698517998622b3e6a895f534a9df73b288ccc306f006acbb528857774d60426c9f92265d081d4b13974a6f635593150495008e2ebfee767227b2eca0a4c67e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56de770c2c7ae7a5d16b83bc72e4f008e
SHA178219d739daf21b0e5595206f02afa916d5a757b
SHA256628fb4633c6211537db37b79eb81fe73aa2c00f0f37f0bb979e78ee8a2d33faf
SHA512328dcd7f91d682c01954c3c6612b122cc81c97b1792618c8042ac947ead522ebd4f2c719a11788129fee4450221a1126bebfbb2f26141b8fa74791c344400d68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d774e6bcbc8c64aaa9ef9125559f80b3
SHA126dfbfc8797f2b68da606b49567e83b29163ed42
SHA2569efe510838348d2f5f1b9f76c70b7eadf8ad8e03b9634f3819f34598b51506be
SHA512d805426d443e3d7b9d5b4fabfa42e1ddced736e4672da60100bcf5f378a9c316edf8f1aaec50c99887a3610ea410d981b4aa16e6e1aa42fdf7405f7630dfbc1b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63