Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
13/03/2024, 16:53
240313-vd8bpsab6w 113/03/2024, 16:52
240313-vdwmxaab5z 113/03/2024, 16:52
240313-vdmd8sab41 113/03/2024, 16:51
240313-vc87lsab3z 113/03/2024, 16:51
240313-vctf6aca35 113/03/2024, 16:50
240313-vch1esaa9z 413/03/2024, 16:50
240313-vcblcaaa9t 1Analysis
-
max time kernel
840s -
max time network
841s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
13/03/2024, 16:52
Static task
static1
Behavioral task
behavioral1
Sample
mjjjj.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
mjjjj.html
Resource
win10v2004-20240226-en
General
-
Target
mjjjj.html
-
Size
15.8MB
-
MD5
5d82050346045d3c2ff2677436e8182b
-
SHA1
14034ec0db53f3c11cb11dc095398453d6fb95c7
-
SHA256
23421d5681bfd3aa75d1a00bb418d9df40c9a915f7b4e70e3877d5d204e7d537
-
SHA512
c9221f7aab9b1d37c89ed61340f606d219835fc4080a45d5d50b1f3679d981a61e2cb5547060ff4ca88bd9f80d4e9440f49c4b8119b540de8d1eac57777dbbbc
-
SSDEEP
49152:fmDz4cz3oSrcBRlyqYGxGK4xsmgrFsomEArSBU2vIzhd1vGSlz7m+1iIAT9dCHc9:TurinDiUxUYhH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303e16ceae77da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000fb91999126166417304e432515eb7fe52b7096a929dc9b77e3693f8d306d82e8000000000e8000000002000020000000cd63841b0f3a1b0f2190e50e7932fb3a629a5205ba714769d63895055373de4e90000000c34eceb2b238ef8863d93c9957f64f4250480df63188aec52f1336743810c8f149a068aaeecaf74d8ac26c512daf056dd8fd3b92ee22871e69f7569b6ff06774f42b16583620ce7cd8c8ff18486b3d6a24d7f8c97fc89c3fb1161ecf6b347bc6f0304bad057329b52419d5bb4cb28bfbe3a3c3df3aae96a397d3426217bfc734609a20808b83a381229db31668af208840000000aecafafb678691bee7d56bb46f60f9eb6a4cf80c83deabf7b50695b79c197dd9e0774dd2fb26e7aef65bd91a4040b8867a6350c1bdb8bde88fa78a89173f250e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F90B5F81-E3A1-11EE-A5A7-5A32F786089A} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000abb8596cc50c0546bfda6658dcffc23300000000020000000000106600000001000020000000c6a818de270a127732876aa005d6e758b12e73441206c196a2ce2f39066261cb000000000e8000000002000020000000c41a8d85ea16857ebc324fe14e47342734d8c1d3c1fbad5083a539c69b5c3a6520000000eb7e3d414fc9fb7b6c53c180ac03de7cba9d0cbddab96b114f99a988f3ee878d40000000881605345b0f4385babdf36c732d60783ac8861589fd82dc4a3273d0963948aad8e0c8c551f8843c30ca4da3504ebc304fb6739a1c58fe998710806a0c88eaf2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416761399" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2432 2912 iexplore.exe 28 PID 2912 wrote to memory of 2432 2912 iexplore.exe 28 PID 2912 wrote to memory of 2432 2912 iexplore.exe 28 PID 2912 wrote to memory of 2432 2912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\mjjjj.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2432
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa805185a21a181295752ec114906afd
SHA1a2cc493af6f55d6374a01c7d9fc4a937ace6ec59
SHA2563824b12118b75a74c7059b1d1ee29edcfd7bd50de824da08ecd56e501a7a46c8
SHA51206186ef92bd7962762d7f672fb4ebac9cae924b8acdca41775780e04433e08ffe48ff1411cbc3d1b3bd94ce40e52b242e5a88ec6c7112c6454dcef81c45b11f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a515de2d1f5c4c9190f81b42fd12acf6
SHA124e84f685ca61dd79d825c043e867b45f332431f
SHA2568448927bd6a6b176396ea2c5be791a10acb63da2242dcb1a7334c62d8070b443
SHA512ba4aa61bc1e4965386c12539fd1da0368f6bab227f9aa35047e614d858785cdbaaffeada43f78e958abac61a98f995965840716acd6547c89a07b2e5e2626e4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51504c3fd13673607df5eedba50d22eac
SHA12b825c07e83f41644de627f19870ad13781ba51d
SHA25672560016d58451a7906ce8a488236a88f38732dd027077d9ec31c972aaf22f85
SHA512cd40e696857846105f7e0bf3798e05a7ba3be75c03d42f9b516f765ca19e24cfeba75f7055fe6c722f1debbf0a4586fc042e192bf5c01701eaf8bf476690e71d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffb49d0f844f0be97639ceba7704242a
SHA1f1ff2d886ee100b6b55d1ea60e54d26359b9de56
SHA2568c5c018198614c78fe4d61b460517db09be4126e7088da9e941d3b4341723748
SHA512528af568063de421515bce0c2b4ce6c38db583348cb6e477c68173a4a78981825439f175345453cc157c7e479bb0ace50013604724b3e4e44be4b9af64405152
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54790f052b1c6e1018cd5f822576f0e14
SHA19390247454afbc7f9a06b0be353e9757345da1a0
SHA256548851f51a20c4cacb74fffb15dd98eec69f1c4fb9d7967a0cf83775c73f001b
SHA512a74c28770f7d106f258936000b6ce8eeefdafe87c0a64200c63074f7a5242e7e1c153f8a532641156821e34353a68e02b90f4cf579f9244425e0ec2a82360707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccb885038c52241ec757f8c73c31b2e3
SHA17481e844726bc23b663817333389dd4f182448ee
SHA256f21bf391be3f6d89c0d94d53fea72490b3bc935d03c8df8442de2ca9b2e4c031
SHA51219d51159ea6a038e30ab80cf63ec17ee24d372214ccb07ebe0c4449451f84bf407613b947cabbfcf1e556342f0d51e0ecd195e587d9fd15fb40ea3752f7389df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57375fadcfa4ef851aeb4d864a61a58e3
SHA138bff547ca1b85f736647be0b28d8b746044d1a0
SHA256a86648474fd03d06ebf2cac5cdb6bb443e495b7870b3370886fec6cd3606ee05
SHA512a7a7d0f324b35d05c609bfe62f2154539e7ecc7baa83d822d9239c218f8c1e6a425aa9dd05e3ac6270d63865ad3a2877c852968240ad47d44d9a6989ee3a975e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e62b6b78e804837c0b0deeca82e11a7
SHA1ccd4ae1d63b54b80c320da9e8254696b8d37d40d
SHA256cf09e0c4b92726dacf5e20688b4b69ca18fd4ffd9750e5e438baa896a928686e
SHA5129a0cdc468afc8c3fd7588a9fa1135f176557a379f966d772ea6f86a0cbadc0baa47166e24e5120f94ac5a02c95d7c9252a4b13d6f064cbc6da55dd702d4d6773
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b8db68d175edf88c2e91d2559b4b837
SHA105c497f7fec0671844bed8cfc0fffdb191db4372
SHA256733ae4a82de213a6b3c37f07488ac677bdbf29b26274d979e29e41381456db57
SHA51211a037bfe442c4e0d24a7df85a33cd62581a700d5b0555c5885df33003d01d5cbf71f4c81cfd6987f2d4d45bd9c842e915c59a2375eed8a636ec4f8672644565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57320dd33092e1a54956ae99025fb61fb
SHA170f4ca9e549fd9ae85025485692fed7c1d6265ae
SHA2564149ab7a01bc60a64abefed44c70df163e4a9e8f50ececcacd028d2a8f1f1890
SHA5122d2ddcdfab002690b73b985f55fe8c132111f19081eb44951cf4ce19528fef962088ffdad91f64830a7c057a8aed32253422c827926d479149411ad69002385c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5626ff425ac3c45f6e083c83ccc5cf6f4
SHA13273f236d90cb3bd9143d4163131f65c4b12860c
SHA25662550a022925e0f1b55ccdccd16cbd8b64e9761227e352c7d80249898390ec00
SHA512f92f1eab942ed1599f2c8f1e06a2afbff5d4b79fd3f2ec13c8e1c32acb9833a216d558651dafaccc656ad3bac491944cf644648a0bf4fe83f5594178c18504ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575f84676887afc181704ad0050fd4576
SHA18592b1cc9c013f331f06e9ee125f0e6a9c04efb5
SHA25663ee90aaca19f8e4c099cb4c36069d52e26f7e3531ddab3fec8501109341a974
SHA512c31fc8bd0eaceca521452394edad1f43814a98105f63dcb43bd3c81d17aeacfb7520be257e6b559a06ee469fb917d99c90f95f0fa1b4ca149b7b90a47f8cfefb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a11735e89d4de1bcfb2fc5babeefe48
SHA1ef64127168a73cb2c89298475ae1dec36f52a3db
SHA256d08ac17200e7aeed2268bbb6952dd7177cbe289b14a9e532dc73f7d309281f53
SHA512053d29e0cf36bfc404bcc29c778d1bf430df4898f0e1f029ce3d094a229f6f7016b1d848651c79c555b3fc14a974d35399f1f0d03582c5d441ad8198d7676781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5782d3eda07135e23af1b834c0346288c
SHA1fc021f1b8f4f1e7148a6bbd457b659f516c22b9f
SHA2561709bf17216862b4a949d2536d19f1056689260826188e87ea3f5fe00a9bb52d
SHA51265ee7d056c783c021d5572ed675928ed028be6be5adad5c0b7c768e6fa43e47c4d0631f4159561e97417b0b9c033ca189dc1b730e2ebdfd313ac51138f092eea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a575ba4be31a1238486e869ab779d339
SHA1518c6842b07f431ebe804f07d3c6b9ed0e2aa62f
SHA256b78ab58a65a2d8e6e1645a55d1b6488ed1d8498892c41676ec20f4215daab609
SHA51238cc8b91b6dca6ba70720d7da6fb53620184514239937ee84399e8f74830d5412c0b1baa73c3772e01a201025df6e54a51172af5c906d89985be0620c21aee0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cf645bb84936db8f9aa9e9a4fb436ae
SHA13d927e5b2d4877525c2d3a084dac00e6aacdf5e0
SHA256003d9537b6d4125b131f57c9e06aba6525598b55836cc20f450b0a9cd49ba913
SHA512db0396fc93cf6a89a6859d7704c6aa918972e4d97b13bdfba987f73ecd5189d22e65480ec78c4aab34cd1ef42c1297d87cda643129c124d9914ce3ac85acf324
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e16be97b5f171268c53d9e5b07257d0
SHA15c740126146596afb98128880235c7dc4e3637f5
SHA25669fdb50ba7065e500ddb8e70f7ca2394911d4e9b454c8ac9eb014156f43f0a36
SHA512dd7900d27aa44e065971a5144f3922540dd42dcebea55e9d76744e8f5253a7c64c198bda203e2ee1e67df0393a6c5e77b1a05aaa5b939f0eba1f4147627dd17e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63