Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 13:12
Static task
static1
Behavioral task
behavioral1
Sample
c5f512806dfc509d652f1c226902c790.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c5f512806dfc509d652f1c226902c790.html
Resource
win10v2004-20240226-en
General
-
Target
c5f512806dfc509d652f1c226902c790.html
-
Size
2KB
-
MD5
c5f512806dfc509d652f1c226902c790
-
SHA1
d7649d33421ac303d9d95ed26b2bb0c327a99c77
-
SHA256
b53fd42c4eff9fdbd09c8f69001067a3e0eb84935d860778dce88bc26a4fe129
-
SHA512
c116831aa9d53d8241af7bf096008148bce48709b600dc9d4173ae2fe50dbcbe20a333e1d4253b1c4f41818e51cf66bd24b34b656af890dc66772e454a143a81
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000008773640daf00e84b333f59d207a2cf3d8431dbb59bc1bfa9c448d34508ab71b5000000000e8000000002000020000000e79aac5770d3e7b6063c8d81135a84725fa2234ffaf04d216a9bd9a0eb19ccdb900000009d412a861afc421db3874ee20f2c756d4222eec507e9b85d86003276f6dfb5a9c3979e9394af598a22eca99264c489a13f0803d38cbf9c8b19916ed16b33718807a00916ed5dc4a3415bb49ad6c62c8bd47de99973691547c258da1ecf287a1e6d5b0363937dd092a946db5cc1c2f74adfb52fdeea26a8d6e9305dfac3774d2318fc57b335710f4a01345dde3633352d400000000aa79b74b2bd356a12f0888794af3ace30d890a635e1e7f50a3d9c2e1815c0b2e63322e5aef36a83bac89a0a288f558c55a2d586462a2739ef593e5bbe6aa8c0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416497430" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000004f50c4fc74e1310e9e68a326fc4acc19c7fb5c9d1a15647ab349226af9274a41000000000e8000000002000020000000aa997c5b91af7a1a442a335f2c879e3ce25ada9f63a8cb3896eb1c34b6654e3720000000abb938cd974add86f420d14619abbd0939cfe0a223c9858987f869787fc1eecf40000000d1287288eec8f16c60e578984cd6b50ec307d6efdb93575d2fce40475866a24fe9caf6fa5287b10825cafa140731dabb5f32e8ab956d1cd3e9e6efa09f5df143 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5ED1FC21-E13B-11EE-AFF6-E61A8C993A67} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 608b0f344875da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE 1404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 1404 2240 iexplore.exe 28 PID 2240 wrote to memory of 1404 2240 iexplore.exe 28 PID 2240 wrote to memory of 1404 2240 iexplore.exe 28 PID 2240 wrote to memory of 1404 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c5f512806dfc509d652f1c226902c790.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f3afd26aa7ee4001c3cc6652b6cd3bb
SHA1229f4722bfb9f63a5402166b87e9faf010194fd2
SHA256d58de9917c3d639bcb901a4699e8f1c7fa191916c8d0ec6097d4c041ff3a6abd
SHA5121a94eff09ab82b5d2237628549706bcf6ff94204b0f7f13bb1045baabb0cc5a30fb93e7b8ee47b714807cceab8f8f96076a9c4fcdcc5b897bc6c4adf6da14888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1dd7f95ce4046dcc94d6019336a3884
SHA1d94dbf627d293de977e243e863249434acd0aad9
SHA256444a2158ebcf03c2f5da5ccd0c8d253fa26e268a0c85eacde3c34b9c225b1669
SHA512194e643eefa4ff544aa06ef07f555cf7ef7ea93d21d4b1bfaaa5d1124e44630143859e529bbef59624bfea4d7f356d29c8042b82fa72c1fc847963b0fec4697d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519c7f90896c7fe6e80bcdc3eb42aef6f
SHA12441b305b9ad9f0fc9619062d897a87780748f7f
SHA256ab9d7531f4d09be77a049e201ce2e803fade257e3e6a633c8eeb56d26f8beb27
SHA5125b1834ee33f10d90d87cb647015fa01197b8a8d6049e659e7dc0ddf478c309aacd41c249799ab8098eaeecc42ee07b9d103462769715ef6ef87eeb14acbcb4d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502b0034f8955a427de2d2bedb153b7a1
SHA131b006e7fcba9eec6dce8453333d0583907bf741
SHA256691b58d47584b0d543a0cb8d2d9696996eaa50e711dc23ed6435feadeb65017c
SHA512c218635cd533ca3472b0237f6a1cf99d5bc63784c2cfb90c53131db8ea67dd2d4c1263573986601dad95a3e158e8db2df76a5d6e073dfb4e3aa6c01c0d2ac859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dde40478ef9524f43676f3d5292928dd
SHA19efe57149912054608cfb5a162e1f791e3dbdb8d
SHA2564bda929a805563dc36a3b6266d612989bd1146568792994f04e11897b9b4546c
SHA51251b139cf7104bc61c0908abaac762c124c6e6ba7cb8464637ee598526a9079ab7d422eb23bd47c9dd097511120c6b1d9e8338334a96c580006ecfc2b5298269b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5840461f8128091a7c104e6aec10d55f2
SHA19ea928d35788808fa9037a7a0c17d4bba879f0ab
SHA256329038a3074d52aed9dc6ec890f98167fba8739ed2c7746dc4597e05902674cf
SHA5127e2de807455d002600347304aa1a8a4e8497f16cc8b3b49dd84c7bbc614ae89dcf27f9ec7ffd29a0517c645c9ed7fb12ab5a16ff6b0e9d953bc97eb939375929
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c1a097699a0acd6146789732c469fe0
SHA1a4536277cb1e74948f3933145b26b2d49702ccd3
SHA2562d2ac7f305a3b5cdcc5a8f886fab5b7b1d3825fb68a9d7245d8f7affdbb17608
SHA5125474413dcee103be6ca453e065f831bb30dfe45700a2024ad36275a0bba270463c236de532be67a1de31c1aed5e2e0206b0b841dcec572aa9760c6f3b1780e62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0b371920afb53ac72837d51682cdf70
SHA17c4dbb32085b1b3360d567df0bff13dc710b191d
SHA256975e93961ee18337ce42b35b1c1680cecc74568c1c53311c3cc84d67dc4458d4
SHA5128a1bdef39e34c3e64330d040ba7a941896350d141265f97c302803827028c302d7b9117104ee6a7afceec64c4a35b2f0a953181fd344504db7e8f619d7ee1e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521a219bec8c7b7a150fd65e65cf3c28b
SHA12ce06bc5e36398d75df13d30bcd135c35ec980f6
SHA256c9e551683c6045d2e7abb1c5227d42fa8c157fb6fe2a356ccaebf4b8c1b9c069
SHA512081d59372f34c1f743296bc75e74afc4b37bcb47c19a6d16b4bc73564f66b792c91b563bb081a17c68deed7912a4ee8afc264f5ea1e0d1a0e5e47fb8320161ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581696fc7e8d4140dba917d513022b1ae
SHA1d233eb56025dfaf5b6b037499cbd99a0eb6d3216
SHA2569398b977f155b034f4ae9c1803a8345bd552242b8f9cd060d76dc8f940fbe522
SHA5120222213878a481737eba545e8c174f0eb110312d628148643ac6ea6c57e31ba02420b18a8fe3db53f1dee4751e6c1365ef32bc57ef247563d3a4dd647474e8f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec0b4d82aacfc4798072193a55266e8e
SHA154361c10b64141dd2266415707d15f46555de59d
SHA25629673598156d6e7eb6fe2f23aa2f2e27efeabf696de6acebaf676dac5b98ceea
SHA512e663ac783485b32e5561613897f36c52045b56b9408aff88ee66fc99203122fec6a63ef73545de3603969e712dff1689760f1e2aecf32aeab97ad021153c6a68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50caff8767aaf3b29c33b7959f7775150
SHA118d8dcc3bceb4fec3e4b3a286eb13722c04f0e59
SHA2564b581a84ee7f781d59120c67bc820412a491a222340219ea58bf3db2482e44db
SHA5128a25ea72940ec88510a91aec4b1758d00c31dcaf0e464d55c6db03bb72ad00d0d5a319d577b16e1cc46d748eec259f507f5c87fad4b3080f8706c4caf22ed3db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5534fc09ba567daada4b50b391471f1f9
SHA179bd4f922ee01a3d6752caff38ae50bf8c7c619e
SHA25694655b0404222a2d014f657589ef3e4af7ceb7af682a547febf8623073a1e7cf
SHA5125052ec0ec31337345956261696f405a71647fe784e67628bb589425050d71f5633ca59a53b8dbd87d1cdb838c22ef4804623a51ada9c5b10095c3ad95340dbc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9656f9b7a77c94f2d442c271446724e
SHA18857665862b794ad12fd1f19d6b8f3e3fc54d8be
SHA2563359e7562bd0b14f694532c5cdd3a80e3e2534665f0216ccf6641530c7ffe43c
SHA51268bf11afd7fc79c550fadf3525b3e705ed182f823c9654c5212e1ef072525eca3521f1e6ac9c095d40065e884b859f1180cc57f3741ae91d04698632b38ae2f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f1e743dc0c9336f184104ab341afd50
SHA1ea0f42b7d6defeb535fedda97a7fcaa95d2e3858
SHA2560f9f8a77a2c4a343465312127dae0f008c02ea6d3dff764d30107e62e002a978
SHA512e9380ee719413837ede6b3f6c933f048c8f61cc041e4f5efb29c1cbbe4ea5acb0a3061c6eea4f5231001b56e4ade14c6e729f6d92f68bab0a4d42aebddf12ab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565e95b4de6298c98c49f7810eb44f1e5
SHA10cff21e15bb7311781481ec2352f5663866ae179
SHA2561e58b1a5a92c40f1764d5768fb8839293461777e689a25d699cf789204cbe84a
SHA51250beda35bfbc29cbfc335e9f571468419a948bcc55d4fb02bd7a9aabf3ab3ac348e59b1e15181d92933e1f8587c6b35cab55627f438288d186d6d49d2aac7a7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5043a560b9b0977f093d94faa9d5bd6e5
SHA19aafddd520776cc97bedfaf51285fd10f2fc17f5
SHA2567729b9a909c9c14e4878d97f73b4e49837bcdc8f8e62ee8ed1a5478098794264
SHA5128adbb2282b6ed90a5e501e66964c889932df9c90f5cadbeef8daefd5ba7b8db9b1196c5d199819f6fd1406f7ee949396bf3617fca65105ad6fbb47aaf2135d24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD591ce1fa44bb4ec6caacf991c583f6a64
SHA1bedbaa7369da19809ed7c2a54ca0cfa0b572a93c
SHA256740374dd33f167e8e4d4d0f2f5326d5e13a83d9c05fd785cb3361778d218ca03
SHA5120ba20627d616c85e2625d4eaa7a52be2c6d23366d7e80ec9ecfb5bb474f591f11b320b13ecec9565026f374cf10df5df61d30cb18793d7f6afe670baf34c7058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1276561e98883413be5f61688e6ab66
SHA101c3272cc6e4ef2737940bab7a67116add853609
SHA2564c6a46c5650290f1c6329439bc5c6fe5c440b7752a76918f93d0fcd1d438213a
SHA5124148b2550981cbe119354bcbee839c62ba18e5e41f02c72518ece4185eee34a748dc53933c85d0cd0ee3840948d00be2890ba81ca8eb464dff5dbbeeccb0f2b5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63