Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
253s -
max time network
254s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 01:09
Static task
static1
Behavioral task
behavioral1
Sample
881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36.html
Resource
win10-20240221-en
General
-
Target
881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36.html
-
Size
84KB
-
MD5
3d118265fd47d5dda48a76f47cb7b474
-
SHA1
1b61de1f384c8cf4e4acb1f8de6a490933e05cc4
-
SHA256
881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36
-
SHA512
46849ae0692bcd1524b6a2f7b1d115a9a0bf29f74f3b682346ff3cadb43332b0edac453c0a73eee39cd9427ff640c89f378e43686d8ca8fd65fee288b05be79c
-
SSDEEP
768:Z/lZmDlYp0dBzJLVcUDII4FUr9DmOOdxeoT63KBsrudDDO30WQmIr2EIQYTq7dDy:gd/DI+3Y/dD6EWfAiO9DwC09MmWJ+12S
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 21 drive.google.com 27 drive.google.com 28 drive.google.com -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30dd08867576da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a70000000000200000000001066000000010000200000003f181f7c17043846aa47452901a939ff8cdc65e4378d3fddd23a132c6f68ada4000000000e8000000002000020000000fb041b319daec30220a8ab53b93103d7fd172a6b17a19b22bbf09da087c6a76a200000009d0c93acbe6f4adeb7a44f5cd6a5dddba81fa68073136113cdd71b2e9da81fbc400000009be4f700db8788a7a9b2e72fee9114c34c94c3634aed4713256a9d6f5b77e4f6d226fdb78fc6227d5c8a60e1139dd1fc3841963f6445eba7b290d3c980a53070 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AED62CE1-E268-11EE-B804-569FD5A164C1} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000a968e0ff5ee39fe7a5a7002240733bb3d9809408e26b0437d20c61ff40912705000000000e8000000002000020000000d4d2f0db610c4b7b98adb60c07361a4b530081a3e1d085f8f8460a700827396190000000b8b3194f85c9d4b5fc825c75e591587d3499e64570eac7dc3112738b3c9af5931a60582bebd14a282f1d8fbd60e6e18f7c1651f10c2069b5696202e8e7f21f3e0c920d80c747cfd972c12f741488660f400a7582b19526fdb19e12b9699b6aef07555f6b06e2e6aa42ecc9c8d6db289d970a8002929e91ad8706f8414f188e3e6ade275eebcc2fe14112454c048d1202400000005843ed680c7bf5f4300b68657abd7aa51a68cd5ca59bc657a5070c119cb7a64498f83099091884039db032580a749a98293aa0f88265a275f0f1033172fe1b9e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416626844" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2844 iexplore.exe 2844 iexplore.exe 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 1728 2844 iexplore.exe 28 PID 2844 wrote to memory of 1728 2844 iexplore.exe 28 PID 2844 wrote to memory of 1728 2844 iexplore.exe 28 PID 2844 wrote to memory of 1728 2844 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\881a1ba4b108562a3fa1fd6ce74b0829dcda4bc9194942df28ae454b0bfe1d36.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554565ed669e28d6117ca5b0611a603e1
SHA1270ad5daa8c2a381b06365f495e6eae5d51f4c12
SHA256d84b56f082a9069cfbf1d20ab697e0ab86f1ca79e3809bf6ea017515d5eb68c3
SHA5124df8e0ec39e6298297ec696a8c17fcdc90e65455c2091bd4725453b0bb3871cdcce51303bacf706cb1efa7f09eedde5341b1a663d4809ee9cc1dd9acdba09269
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516ec4076faf06b9fb155701e31e3457d
SHA1b47b07659baed3b40879ab99ca8ee439e08fbdf6
SHA256faf3526f1436d47d076a905df4e8e9b4d47b79fbf9411af836fbb11014d49125
SHA5122f8516a0fc2ddff845073814400b28ed728546560f3f36b6e14cf319b40c6ca104311d898e9970dba7787e81b25864c90fba975edd190ed2ac02704e4b7a11ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f32645c7f5846f90165d0e5a4a156b19
SHA1a5c6a0abae46edc14905e0a747316434afb5b4f9
SHA256148d9d6e5ae3312680cafcde16f4e4370d4546ad040fd4bc0610c5ccdac0ddd5
SHA512666e8cbad51337d2d8d45d886d56703fe8a3a2fd98bd3f2d1cddb5d8bf8096519f42697be3f849d6cd731584247736c06c548e504b7e8d653d6bbc8cc6de2ec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5406800e77673a6a0892028aa215509a2
SHA13e7b04bbd0833ad93d31ac68df4be155870f2eff
SHA25688d9255b49723a39f819ccb82e765744b530c4d2c9a5045194e52a0698a0dc65
SHA512ac8533467b54a4c7b55a505e86c44902429c35613a6851a912b8c1b9b576ef09f9907adeae03b3c4642d23187eed1900f714632fc69a33a0a68249d1f1780af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cbc02a0bf9039396c34eda8d8b1d154
SHA1468e379cb29fdd9a7750a0162808a7b1d615830d
SHA25679061205292eb6a18748eef50bb92d8fbd6a5b5879b6278eeeb102a8afc4262a
SHA512c9483cd5dee6bf15a00d8faa87a83be4a909f4ad203caaee336107ac0141244c5c0f924177c702f140ef3936b233a27b7b13e9d47f4bcbb95597baa59a3f74f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501f4c699992f2e658f17ea1dd7cec570
SHA1253d284d03bde2f269a555c9dbc26e2874049b50
SHA256249dfd7ddd75fd9268ac130f05e0fb2ba674e1d86b409be34a0eb99f6963502a
SHA512260bb5f160c18e268b1e8157a23069bf88d1174e613b1b8848a0738ceeb2ab2a10e8daa5006f92d4c38e5393de55f1642f3c96fb5422c0c253b94775cdace3a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe32398e967ae9d73c0b8491a73fcc40
SHA10fb898a925b1a844247192cc488b63bdbe70f3e9
SHA256b5e014a5b7a1f8ec89325939751f883d4693356448f29de44172393a12100951
SHA512b581353cf9662a89225318bfb3eb741927147c8f726890e6b57334657b02647df9dab7b1844cebfef1792f84ea4cac83d6b0ce6d979cb0d5861a94140425b92b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e6f5a0ecff8c985f69b3df68d9f08ea
SHA1665cb7ba43761f42e39c52d7ca4d36c32cdcde32
SHA2562cf4481955311b4d54d17a19a1ec5af2c15f4d25522836cd7875c4d0ad0be20a
SHA512f3fb756593fbba95a1207b3351c118f4ed654bf39424af6fe1a2ade8e094ee1eef7245b019b390c3a672ebf5352873b0eecfdbe42760990bda44087639d04755
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db97794f77ca5209d7f90820a7ba88a8
SHA18c3193d0bb304a29892f7a920029dfdaab60b544
SHA2566df3b5aa6edff64bfd51e157680bd98aff420699f4fa3b83548970d9c761f411
SHA512fa94baa5a12ece20eda5aa5efdb97b871f4bb8b0cf6d8dcb0938fe7d076583fbfd27076361ffdd4f52a60082af9d39a632aafe9290ef341085eed168d9402e23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582ac59fba885bfca883d1e351817d7e8
SHA1c6a672dc5a4db3c3cbe494c9faf35da2660f827c
SHA256ef3ab4b37613857732f99cf65ca860045ac5a5f921e1f912f2323829647145ee
SHA512e9b92407a544cfcf0b3a0e6805cb4b6399c384a498a64885c67841f64ba50497253e70879c39d1679620bf6ac83cdfd7e498af026fe8a8798408062622d7f16f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e05a583837adb0e43de1496e6d8265d8
SHA1adcfccd4e372b60ce5ee6aa13ee031e7a9c80b06
SHA256d8af02f165a5bb3c0fb94a3bae7ac2510299b5ad6738bec84517cb47650c772b
SHA512240a9b50f29daf72912619a982bc49bb30b5c302a004d273b89df19098471947759b98b272456050e79effa77c54de5aea41b8ea9e11519aa0d938ab8ea0f316
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e12e4b07637f3661f96310c6bb51856
SHA1b09d29f8e5b40a248b2b69e5b2b61bafda66f396
SHA2568b8f8f394c6a67ef477d3c1f8575c2252d647f2eeabb7d89185f45dcc8923d99
SHA5127fa1cb4ddc4f3c5cd0e128ba28ca4a9923c94bd3665abe73b684d280fa6a76934602c702eddf7e6e42085cbce8fdd179e2de2fdbf66c4e5988385eee10137b5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562d6441e9f24a9b54e4a6242f308b4f3
SHA18b499f182773ea88952a6e22addf2279ad5eb920
SHA25668389433f7c1c6889fd4590ac2049aebad0507796fa09c4005fb4cfc788e3d17
SHA512b9586da31cc0742c08ca47240bc1aea72060b0eb74e15c08f578190839ffb6d13de880f99c009b6c943a1adb4528a4174c458baf06510305f89c46d32005c07f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5836181c1b097ccbaf6f260f7ff0e2fdd
SHA11b0b46addb7d4f9e1ae8e3b27a741d4b62fc3a01
SHA2561cd749abd435978b18166ebcc592a08b6ffc893da01453ff01c9a92ff4c34338
SHA5123c947e425c7e771473d9bc5fdde2a1202b7a6a85077a8b70b54032df4f52d8080afb82acb2f4525fdeb5ef9c17f36593f6dcbb3ec8e5b31cffe671f578798552
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba0a097d115caad6b5a39ce345f1279d
SHA109ce5a0e9dea7778791e0d4b73ac9ced8e82bc96
SHA256b8c42bda39fa3e1fbc2ec9f21f98319b2427df40b90bf304ca64730363400715
SHA5127cc29bc2141fd868b2823d86ceed198d1477356ec1592c2ab1e1f427e20aca125f7908d61f3d84a077e4fadf612a1eede18cc4aba7a2a3b6b9d0fe3db9c9e129
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MPR7YYBV\cb=gapi[1].js
Filesize77KB
MD5f4ac8ebcddf99f97b1f255e008368d12
SHA1f49430105d72515c98afe87a26e66a5249a9a83b
SHA256326a0170c1d2759827150de6606cf8a5a4423c9b01748de34e01cee23e523f5d
SHA512564b6762d839946687e118a36289328deaf966261e744ed4c08001ca3601b26688ba0d1ef4b260c055e00d3f33df1653d2b51d565d367ee4a384ce9fba45aac5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63