Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 10:02
Static task
static1
Behavioral task
behavioral1
Sample
c59726b67a171a3b6c605ab2c57b62f4.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c59726b67a171a3b6c605ab2c57b62f4.html
Resource
win10v2004-20240226-en
General
-
Target
c59726b67a171a3b6c605ab2c57b62f4.html
-
Size
147KB
-
MD5
c59726b67a171a3b6c605ab2c57b62f4
-
SHA1
b00f0207da2ef09536a2adb3198ced228cb3d2ce
-
SHA256
87a82758bd4b00a3ee8271ca8a872a9d74a4df39bfd75d78b743871f5b30aa18
-
SHA512
1238f3217f81c587f6e285a7622275b03af08558fadd86f927fa90498a111fd463b54f2db2daa8d69c8e963631e9fd692b66672d8984c2557883264960779ac6
-
SSDEEP
768:wq/P2T6nXr3D+1KzWz8i77wDDvj5AbSCKXg7UxW9yeycUi+LiFJd/cQtU86:jmOXWEL27Jd/cQtUz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C912E5B1-E120-11EE-9CEF-E299A69EE862} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416486011" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000009df35ea0ad90d9f2999fa4ccfe08d9a33e71ac335bff1f4927c81156089f33af000000000e8000000002000020000000d5a8f4a1ca988146a9c482a6ee6f4e01b7ce69dd618703843c99db117170c5d120000000c0d3292df3d9c4371c96a3a7087dbdd3068712393a93a64f60ebc833b65d731b400000003a84a5609e79dd815c60dacb879fcb05768ce511845b7fd2123b55ca96b40c350761fdf02e79ae1d6404009becd50c1a2f217912de65664402af5bd330a002ac iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d0a1a32d75da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e000000000200000000001066000000010000200000006344a691954d241b7d8ed9f9f8448bb8467ebb065a9e1cf71d90393356ef0191000000000e80000000020000200000000b22d8ca04bfa38af89832df228612569ddfccf81b331049e8a96abd63445a6e90000000f774a7a4f7154df10152429239a490a647a7e2a8fa99cb4dd3368274fe1eec19f6f9ebb1f4114a7218d4a19b764b3eadf124156990012e3fdb12c3a14befed3dbd1bf82c5daaed8a2576052993ebe614ce514192fc2abdf2c5afccacaa999d50e3335a01544f13ac080407e432a95919adce5ecea85756430529e8206c1dd97919bacd91061a47ad0e2609d7df81793840000000610d6e601db928c325b0a07a6f62eed5ab1b52eee0f99f57800036c04cffa41804a47f289fa34cc4d88d5a2185aa78cc59fb4f0902ddcbd6912e9feef68b5046 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1096 iexplore.exe 1096 iexplore.exe 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1096 wrote to memory of 2212 1096 iexplore.exe 28 PID 1096 wrote to memory of 2212 1096 iexplore.exe 28 PID 1096 wrote to memory of 2212 1096 iexplore.exe 28 PID 1096 wrote to memory of 2212 1096 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c59726b67a171a3b6c605ab2c57b62f4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547d7821754191d514942cf7cc9cdebbb
SHA1a8cd14f8258c6dddc9de9f0c0277fb54bd117c7c
SHA256440767370fd45388340ef9352bb3266ed14bfbae2e23ee1b47b992024bc63279
SHA512c06c6baba0013d1f195a12bc05eaf397d0e9e0fef041a28839b1d9a8c782aafee9da26bda577254994ff272eccfda846b1aaa6d88c6fa24a1a691c6a80cb7999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf9d5cebedba4eb349ad77d5f0eaf1de
SHA1c65852f4b31df328a82e1d9d3efc1fc7f886d922
SHA256383b002162c2a75d0bbaac0ca606777638532c5dd48c6818ea35fec48e8a939e
SHA512cf786d639d2904d5f7dd0aae9abc062d43f34ecdec35669a820f727d6b922cca8a47b287a17601198ddf6a497de15b075d889ba9ba61babca97d76ba08b76afa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5113bcebe05411e9807afff7e3b789128
SHA1ff4757faf0d168eadabc885b66f3a1b31dafdb8e
SHA256d8e80d9b5f0b94fcd5636ad76e515329221abbf47908f609b261200f7f1f5c24
SHA51277e39e4f5cdfdc58435ed372978a79ee6d81b3117c3d5b14562297a05e676911785b7b25722b677c387b9baa8936626d345edd5dae2afe80826f8a7e35090690
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ebbec93af5f9fbebf3a282aa5dc3dd27
SHA17a82160e8a313586452de926c127b0fab0619d89
SHA2560e2a9c45342e8973350a7961851fcbb9528622a140471ad1fc525828a314abda
SHA51295e6be5fc024f639dbcc06018c9a9c5fb2552f12b67b17f1a93496dfb6cbdafb46dd4895c98bbf1796d23fd4f5aa6b109238f2d9c2ea82b5d7e694cace4b13e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545fd9a4a06280834b90469d9d2d3bcf9
SHA1f5f6bd3b5c524ac3e153c110349a85e4d4b8f255
SHA2569a1236c219c80b65eac1aadc57d1bb596a2e7c16319219c89f486118c6372a65
SHA512985c3d4993ba0c2870ed28540cdcb391715fa8f887e9261c71bc5fdb3f5b13c5c7728b00d4352bc016cb40b7fb026e1fa8a175cf38991e2ee102c9b1a562644e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d264aacb0cdd6a2aa1c7d741c7172229
SHA1930a1820480a8d43b657a81977795c1c19163f4d
SHA2562471f535ea5b7b258f1c74a57dbc4ebbe2c3477d359bc8bc0aafa8b0e8a851d8
SHA51220bc5db5199ae90902a51d549eae1d08a4ac0936e84e71bde39686f3d1077359eb7a09251bbc3ecbc29a666b00bb48de668eba154cdd56d58829d0c8614193a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585e4d2b7c7aea1c0b7d5eb8f785b5a64
SHA193164f3bb11a1beeac7255d4dacc1981e899b9a8
SHA25668c8f1226b733f84214808999eec72f61222d0e597781909e37f1b32e4193a51
SHA51218c97854fc109ee925067ae59bc81b5a70c73b7c7338279a2d1d9d0bc4f291a99ad365554b38b190196d616617cee1feb80d675c04f6b06a4f04e911809a9dc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ca5e6b33ab853da1d7af5a9da9c5ec8
SHA10f6ba31a3b3df3f06010c71697c691fc11963f04
SHA2563cb971f55c47541b4e1a66583da4c7328ffe9bf57f23fc0f369faf3dbb921ef0
SHA512883ff8e6cf6c4b1fa7a8745dc149994361e234983fe5fd0c5902447bd16bb5acfa8c25f750a19272a46a8da9881f73b75742f3e8eb45a63f2691c2e024851d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e2e15845cbba71d8bec6aeac29ac587
SHA13ba7a0a5380cd783cce1606ca861f0824b1c9ba0
SHA256416d3b038da855ca38b54b01c3ee6983dd11f1c4df9fb03ba74663e53cae4b88
SHA512f883cbd447598b9e6e4fe2ff1753fbf12b642afac3f99d8a1686fd175ee255971aa462300115aa7316a71094a6c79001cf9a94764c567863b3bd34db6d8e66b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d3efbd7925e6ae6fd4dd81fe12ce2c0
SHA1cd8a0866cef545ee24eb7a1bfeee34ae08bdfa57
SHA2562f8f041b9dbad5fe94d893dc7c7f78203d8e6cec513819e41d7665c213bcebf9
SHA512a24068d0a7fa14f349549652024301563cc6edcc495a82bb5f7231d2be6c92de11a41dfa6c2b132a4c757fe43834164a2c4d9d552f29f87b75e6d8c7dd5210e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551e07517d0ca2d1204e16b21cee3ec32
SHA1698e8eab54fa53567ce84cabc1ec9cf51b0fccdd
SHA256ba2ad1db1c46c39a80a0ece0bbce41173cdab099f59b7f482fe0c97975719542
SHA5123da4778635b63cbcef4ac921629fc72386b649b4783024a9ecca41cec56687877f56a7fb6b33e07b2d26bd11d870dc4cf704d7493b94b018337829311739dd52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bca79ec13514132fc1058654e2c50a9
SHA13e77fb2e5df3aa75a51eff31a04d26766e0ce182
SHA256adea351d53a7ac5d6fa79c99d2ee628b5c3066e56e22f7bf35d7b796d6f0b1de
SHA51223c0922e989d9a6cb9d0b163eea7c177d88c9aedcb944803bfc1181b5aff10ce1a5efe1dd4b8b4aac3a82c17696f1f29ee1db184e6fcd59e773eaca488e9859b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc6627fca6cbe7e4e10d4c75587e50cf
SHA122e2948607b38d0cf7e1fa33549556e1e8467a3a
SHA2569034ac27eee26901c749145edaf63a132cd8a6b342ef11ea136537b81bf104ab
SHA512146c915c990761161a2e4dbbc54cd6fdd4f15269f12e61b1a7fd91895c8d1c2cbb7bc6ceaf29e855e41f57f6552fd3ff0d289d5acbbf2f358858a82da3b87648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac60caf30fb1378c2052d7176191eb7b
SHA1516dc3ed15dc7f3976d46965f38bf8a18330f0ef
SHA2563e9e7f2bb7acadfe44069a8ca06ff10c7c72f63dadb7c8dc69cb1d91cd6accda
SHA51238a691766923892ade98c73fbb86003aded9bca85cd104c8a607947cd9d7ca2d9dff6bdbd5fe07a5f1fd9fa2b9370bd5a036a785db5af6f96c937f35a5489bd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50db44aa207398b77c4fde1d9469e787c
SHA128da253a0d9761b34f92721e3e1c1f22b95fee45
SHA256ed181ff36a0371b96e40d78c3dbb768002ea02f6407a8b50f9363b93ea03219e
SHA51231aa525b387475748c85589b34bf6d2307402f451b29064ec16cee2699b6783a8f732b2761d0ea003a70156c46d3ab918fd1662a24307d8dfe8f653b0f117bc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5d3adfe7c51e70d683443a044ec239a
SHA1ffe7065bd91f92b4ee282cd72dac1893d8b59b39
SHA256b08773a1b8e8d0bddba2e05a934f7347012a53a0e1df692b658de84c9ee771fd
SHA5125025984773862f5ab43debe182f7b68d0c35edf657ad88bc53cf3c760202a701efb4ef8d97b5cb72d01b3d04faca66c7a82698688a9f687a8090f5fa2dff6864
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63