Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/03/2024, 07:21
Static task
static1
Behavioral task
behavioral1
Sample
c808d8fc8072ee1cedd4c84ea0d0c342.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c808d8fc8072ee1cedd4c84ea0d0c342.html
Resource
win10v2004-20231215-en
General
-
Target
c808d8fc8072ee1cedd4c84ea0d0c342.html
-
Size
2KB
-
MD5
c808d8fc8072ee1cedd4c84ea0d0c342
-
SHA1
d050e72b75f36a767608c86a6fedef6657dd2470
-
SHA256
3e9bb49f58795a2c0ffae443dc1ebbe0bd005e8c829bfd3f36627f14b5e23ac6
-
SHA512
13e081c5e11f7eeda9509569b4170f854e22589c57b0727bfdf52a2a01ace78cfc567ff4c725e1ae7fb6d974b3572eef4034cdbb308a756020cfbe6601a7a5a0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10a4f951e075da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73349901-E1D3-11EE-BD61-56D57A935C49} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f7000000000200000000001066000000010000200000007aebd77d833b9de06454e4c7ec277ef2f78f4129f27f8f7a33010c109a8af36c000000000e8000000002000020000000e59e86db9ded30a84d7a36e3ea2d37e4d3678a2c110167ac14394c3fae019a8d20000000c8f520db3bea08ad4659f43bdf7476f1c3b94266e1be4009a0df80595b7b81e740000000b3faae9d0f21b166e6be31b4568a52d5cce795e29aed0733a54208235dc989c6f41754174a21b3cfa7a6c9f8497f24b0a3f449fb2dbcbb305aa242d74db16a2b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000ccbfaadf6d7838ac85254d27de72871b99c1cf1978616066e097ca0253b925e9000000000e8000000002000020000000d36a8623253a032eddfb17c87682b2ec20a6a968482fdfd0a3d3802f320872a590000000571e0326d77fabafa320b223390f4f4a19f9fb2e70874ad5d51f0f64358a1d88a523108d34199403e22fc619ec93b43c964757f2071c57dcb6177abbdd4b910e5344d8f29060727343b25a196891b11f54ba9f791f6a97a2806107362a29fd859ccb8bc68dc4acc2a902c29991e8020eb2ad836a0f44b5d4f6ef7b395e60380e08f1e3b984ece5a94b1cf6a1528d4d5940000000947c16f4da93a2beea6eccb507e26ffd51f6ffef86af225920f79a9321731d3c6eb7ce4ddd6ead60a0a101aee232db30190d7dfa256fded27c743d371f799f14 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416562752" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2880 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2880 iexplore.exe 2880 iexplore.exe 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2880 wrote to memory of 2444 2880 iexplore.exe 28 PID 2880 wrote to memory of 2444 2880 iexplore.exe 28 PID 2880 wrote to memory of 2444 2880 iexplore.exe 28 PID 2880 wrote to memory of 2444 2880 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c808d8fc8072ee1cedd4c84ea0d0c342.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2880 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fd8876d1c2565f21829d4d1ca3c7d54
SHA196bca868e412deca3c728f3f75b5ce26bcf0e7a3
SHA256bc2313d0a959e5128c01f65acde25d310f1ac1910edcae8112fa1948827fab7e
SHA512c42aff6f17470570f1018bf3a798b5cfbd535007d579ddfbab8bb9f564f7ed25d7087c24356eec8a1385f522e19635544c251fb8f5962c711bc46b26e261214e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bca5d6becf5909adb8de029c431f36d5
SHA16c22c46719664e27d07e579074215db214513d8d
SHA256104253ecd0c6727d38097972c1bfbd3a4333f1050c4fa339cb0feb437747b17a
SHA51247f280766283729a66abd008cbb72b4185abe79efc347feb3a075a242c6f922889ec670c93e554c668c9f0f04c7b1c19718da142f0d851baa80dbf1ae8ae7510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b16c457056d2aebd52397156c3f89d7f
SHA1a71c83ca9b40f496197e9cc0dc105d170c799c43
SHA25618267c47d31be1bace03a2e97b0c1916a23ced240dd884c4e15be5f95ca0d1e5
SHA5121e263642ed24b87e9a551ee474e01a6b2dbd822fb11b44df0c9771644e4db9e07534b54e07d7d66b3b4782d92f45f58ea5e4207c5e5e3cab5f266130a4a2574b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f075c942ea8ad8110c27efe033d8aca3
SHA122f31826dd7f10ddffca4f15325ada048189e10f
SHA2564509a932fb7bf529b96a6e2b8f7a016e85a3d34a2dabdd641e4608df7f3fdbce
SHA5128d428e779555dfe3e7693a28f7f3adad343262f2a3fbaaf9cc6142b5ae6db18edb0691d719dd2ca3f8852f13c11346623cb03e94862da5bbec2ed5b9af7fab31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae3a77f6b06e3b90349cba949be6c4c9
SHA19cc8841b6f3430da0f37511dad1028e1ccc86b91
SHA2561c89f2cbb4542db2887e50d6d6aa00f31895b18af667eec6783ac8d044620e84
SHA5124bb60bec724e6c9893c79b274d9fd58469601afaa2f88d47dbe6ecfb7e2dc64e837c76ee4fbcd5298e3c29fc10aad2b64cd0f666f5906a63279e06e99b8994f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e88315cc4b2f368c1aa2f10d58c33433
SHA125ed568cc84caae374f20fefca85f15407c1029d
SHA2561bf3a288b44be0f8d2af11c62959d47ff1c59cd50a9d92594515f1ef44fa262f
SHA51221380192c2f4a76cfdb3530da556bd2ddd7ff83091f89e35992ac5fd60c90ac08264540c8069c3c5e9063cc181f31222a6f237c76c6f734be4a529e66d8ab939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a25ca003d2034610492d33be2bd9a6d
SHA185d05b9aa343d1e00de5eef2753a39e9fde86bdd
SHA2565a87cf8370f3aa6a4de98c173a2ddc0ab8f8f988da6e3cc940b1563476ad7ffb
SHA512d397e7b1d4d61948a19dc7353f1a4d653fd782120daa1cf1371a82bb0e576faafd16f02be84767f21d0c4bcbc2a9f76053f15e729b3f17c728f7b36aa83cb360
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c23d79094e88053bd50b96b872bb52f
SHA1505da0e0e2afa4e1919cf460a565605fbb0ec255
SHA256d8ef8f3e936e5968e5cd627b7b8fa07893a182685f34d309a34e1c7980aed91f
SHA5121f30707eff0ab6c0005589d1deb7ce2d0c2e1dbce83cb533ba9b4b1965efbecc14d7af6bab3bb200ca39a38f6e6ad0d9165bf38b6d0804b871916e194698c5c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edd638421884a1990c2bf4ef08b1c1d6
SHA13c3c81be6e699543e37ec49f0edfda66382fe060
SHA256485e1469df2503b1d379fe2f5f094eab6b622361fb275ee1337adff0980d8374
SHA512da9f828ca7aa23dd42b6ee32c8ab653d0d2679774ef9bd39e99304bcb01b45bce25ee338dcbae7e2b57c404115964efc50ef0a2e17cef12e8c9e8ab5903e8fe8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57af4d495fada09eb87570a464535f996
SHA1cf0f3bd848a86b3443c0753226ea500cc5b6e3ff
SHA2565c59a176c90925518af140ea4056dbebd341be26a81c1e247378deb8b1144f81
SHA5120e3ad16b130919abcafc60543d9bc0af04424338b6ef1bd0d954ed77610a8a64692b3b3401a245987417c65f1d0885bd8e3e4655bc826844339824209c61e43a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54774de06e195bd9795ae07f709aa1201
SHA169c93887d9319da3038092e85933d1f600a16873
SHA256387fabe056d481733ddd01b8657754ad7bc763a7e2c2b78ec409bc33a20c5795
SHA512e9dc3ede0a322982eaf3972bf2f7d44bb8bcc0fbd52ca67c6576cd112ac8c2007b710bac3e12d9af5b1bf4a7dcb3d60eb4fffd7992bb6fb18ee4e69f3be0cee0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55daba054cdcae721c17595b54206d5b4
SHA16c0fb4c241eea158de61ae4ca39a041c1d354a64
SHA2562699a985bb24868ac1d0377605a23f54b9e8893d6bc16a0de4441b203a041eaf
SHA512e980b2d26a25b98556affce2b49e7c9062d1cab19feaefbfc8154b4ace5d90068ac60a78ed40d3bc2993e981f13ef57247206d45b29cb2318219c0eff5875474
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4499736df5bf35b118e74a51dfd71fe
SHA1606b34d3588790bcf39fe29c850e7585c25b7852
SHA256edf27cad77024087d492f0897c9e7f06f6cce21b50a52169377086ef7cdee6bf
SHA512b4a58f474146413d9fabfeb1e4c03aead2491d217962bebc4c454fe3f7711e963e88b6ee5260f0c34dc4c2329de56777ce7bbb0db9a5c5f80c629d43cfd5ee41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5086fc3b4f700f4576cce9c717f807e6a
SHA18d8fb9d644a717526b06908fc0e99ca552caf5c3
SHA256e42b4159037cf70b40c1f766c278ee4c381c91c0fa84cbc2903e302b1d8ebc19
SHA5128900ac912ff9b78e656e477e71fecf268bb6f9949424c93b676c0bafff772eb82429c0426d0ff55865e920880e69f3e46ee7f6fc4648c11160afcf5252e2ea14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5e93b3d21ad2496a4e0393031b0bbf1
SHA1ed868e52bd61f829f4ef7316ff69d8936708bb8e
SHA256e71328cd725b2f64f08513d0c49ff599de2cf359c49795ee367a4b46b0e522cb
SHA512bfa29a213239e98a6b329abb0881bd8ab177c5c0d3925f2f90e486fae0af7a1bbe36144d1b4a37cc9397810cd764c5d709a77032e680eb405f7baa53f40b4e19
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63