Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 01:15
Static task
static1
Behavioral task
behavioral1
Sample
c74f3c6fdad05fe5407ea766497477c3.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c74f3c6fdad05fe5407ea766497477c3.html
Resource
win10v2004-20240226-en
General
-
Target
c74f3c6fdad05fe5407ea766497477c3.html
-
Size
13KB
-
MD5
c74f3c6fdad05fe5407ea766497477c3
-
SHA1
55941fc1d383e77a7622a3527e045160f199ce0b
-
SHA256
dd3f9239c8e5247f6c0f614c3e2045ca4b1c3905b2b2cac142a4f89ab59b2c23
-
SHA512
a132ce0a14293cb0642e233d392d59d3083270ac55f6347112308870bb3f7cba945ab9c7554000d878b18b1ca3a47b87b5c01bdf276c42172667fb84200c69c0
-
SSDEEP
384:szlIcyVnjns/guLBkZcnY1DA70amzguLZ:Sgh6t6xLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D131FE1-E1A0-11EE-9FA2-EA483E0BCDAF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416540782" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1612 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1612 iexplore.exe 1612 iexplore.exe 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1612 wrote to memory of 2352 1612 iexplore.exe 28 PID 1612 wrote to memory of 2352 1612 iexplore.exe 28 PID 1612 wrote to memory of 2352 1612 iexplore.exe 28 PID 1612 wrote to memory of 2352 1612 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c74f3c6fdad05fe5407ea766497477c3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1612 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58de7b173fe2390aab7e539ff1b709363
SHA12f98d116fb852f602b216fdd776857a3edddffb9
SHA25619f4610ac1c6ffdb398ce09bd644512864b61bc9d966110eb9bde9b13539bb9d
SHA512465774f6956e85fcee59eb0119a323a944128be47f83758186339efed7a5d97f2fd4dc74c0fa2743d5b3887b5fdfe769333d97d69d068dce99b49d5658ef41ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8ec6b4b2a98f715ccf3f64cab84d09a
SHA199a697c6f6bf298036c9f2451c4df0a861f7913a
SHA2566bcaa37795aeff82a6609a5dae7629753f2740026854f29fc8991e1e590105c4
SHA512ee70bdd585476c18c6c88f5a286dd5db7b340b920afd36cb621d1a419ae659441f3db1d593519f0cff2399ec1d6739c29867e32fcd894e778e8b7094c7cd24bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f262f83e413506f20a451edc4d888816
SHA19855989f4cf30c2c59e5413f1b2f7b58b1989527
SHA25699376929d665b3478274710df5a2d9b2737ceb0e14724c4be9fdf51881f3fb56
SHA512349601ed9e0a91c578b4cc49548103a0fa8e6039d6244764bc453f2b0ce24ec852b70f80ebb2178c803c01c09cfd0a95fe17bb6fec98819dd8d9c8dad6bd3972
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5051e9e53bcaec407b5cb6a2a89eaf70a
SHA1c4d139874e63df979a6bdb6b2420ff292c2bb5d4
SHA2560b49074f4dc5838e9119c3f7126926d9c02ce38fb0924bcbff3c72daa992929a
SHA512915263f42d2d14558fb35a1d6342dd2b5f9d1c820ed29e263128136ca998001554087df6d846d73c80ca86847087c40a9bfe3a1f3db33464f9cde84443123c63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529ed02b708bbf569c913f353761edeb1
SHA15e93495af7699291215c68139c4d365987a6205c
SHA2564881d3a1f5c8b6ad7f5d543a14f58999fb3c3c5929b1a388de09b5e4e558abc2
SHA51243930c628532881e9ecf236f3a91bac69ba8b8921487f05974a3d7d3e18d4d91f015f27ad7b1e8b797fe0549621e74bba8b22893ca25e9589c14d7b1d292f4a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a410387081e1e8fbc3703bee17f6b08
SHA16b9ad8afa3f37ebeb737abb7c361fc4183047be1
SHA256098b57fe564d56b6a5c522b976294caf3dd713c43ff9f5333427aab3bb7408b4
SHA5129748bc079ccfd82f894c8ed0394d4324602ae65014a039a91c11c768bd407e7b25427858d594eadd7ebd623cc69646a8c418634602b83fa9cdea144070e012ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50bcc0ae0f4a5a33d9f5915c0d4785865
SHA158d970c00ada653d50cbd30e2d06df6be75bac88
SHA25666e96eca81be71c5360387b4e54c57fe79882120338377aaa0afe6569b4b28d0
SHA5120f18f940590eec773f184c19450402a82dba3ecf51dcf73f2cc37b1dd8ab8427ac50c323f9ed2bce5c5d9fd5a7aea6e708d73e5cd30a2eed3f67a57a5e98661a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fd3279d3ddd7a5ca1a5141e5a46805b
SHA1adeaed035c56f795b62a3a468529ef693bc208ef
SHA2566af23e8acf88ff1d5761a771d600f42ae408cee761162f8c0a5e1b3ac38c8870
SHA5126dff0fe0a4300661abf719e9304fed3f4eed33352a557d01d20fed24cbb6e72366e546710818429ca4a896a52fb3015dfe91b1c8de448d3292fc0f62eced8610
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b14f4f3b717598e9a031406ac614c3c1
SHA10f08f4760e8ad71d388ceb5c62cccd984236c5b3
SHA2562641486e537b7b5eef252be5dfaa86d72d26f3991d03b98272b5cfdabdafa15c
SHA512c0b788ffce64b16102492fa4b5f6e0962bc46b3179dfd0d2e651e76565a46e811e3d051f4297d0b8293b12e2deb0c39aea4469bdfc17dae02004da9e2e0a4e08
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63