Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/03/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
ca4a122b549328a2620e786f2cd66b06.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ca4a122b549328a2620e786f2cd66b06.html
Resource
win10v2004-20240226-en
General
-
Target
ca4a122b549328a2620e786f2cd66b06.html
-
Size
115KB
-
MD5
ca4a122b549328a2620e786f2cd66b06
-
SHA1
fc97bad350f3bc5490d2deff408902e76032d8e6
-
SHA256
791e67e8611f935e5e1a3e94f78817c563f36d8290d77c3b957445796e404daa
-
SHA512
fd485dd3f43b5be98ba2d81fc4761e2f624abd5b24e003bafb26e3a82a4c7d6d15a823e3b032e0979982f7796ee9640e0512784390c3a93df8fccc4237ea1f86
-
SSDEEP
1536:S1cyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsn:SKyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{993E95D1-E276-11EE-ADE0-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000463e7fe6cc289deaf1335aecacf580ce846f32eac736ac1550d7bd64596b3d5a000000000e80000000020000200000003630cc1da869470887ce716daac7364e96082e92a31e4a22b9bdc50bc3a3b38d9000000045c83a271f1daabc57b991fbcc2c2c8428c68124fef03337f268cbf4697c461bfce4f2fa4fca91145ffa97463e26491f5a375dceab686a0bf7da5b3e53c2af135398061b4be072a37fae9f4a989e188615d89a7c0a76d584198dbd484ebffaa6257d6d58731d2a9a8993db8961a4513d6efd12eafbaa471fa09c2ff268d3173d8dbc994f1d6a8900c33e73f82b60a82740000000722c5463affde0930b975f448515c18a00d1f37575a8db41895ff750202ff136ca8bf8f7c49eb6c5faba765497cfad4772bbe96262170bc816b22363b6e0b770 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416632820" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0022766e8376da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ffebb09deeb747419e902f1accea58f700000000020000000000106600000001000020000000e42fb259286ab0a1816494aa43f8427c89f7c2d012586a956ecea267518d605a000000000e80000000020000200000001111ebc94db62e9ff5453e39a242f345872b965de632d25db7649308f0c92d1d20000000368c886403a74ddad7ceb8744ad7aa110ef8f1fe0ad827f0d6f0253c1dd713b74000000076bde5c266813b52b3661b64bdce6c33242b885eead478b24ed2bd701abbddccb37b25c3e54a535af56ba37a4b358d93196cf7df659979c01b389f9ad53fb1ab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2272 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2992 2272 iexplore.exe 28 PID 2272 wrote to memory of 2992 2272 iexplore.exe 28 PID 2272 wrote to memory of 2992 2272 iexplore.exe 28 PID 2272 wrote to memory of 2992 2272 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ca4a122b549328a2620e786f2cd66b06.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540fa517a0300d68ef04dabbab9f8af22
SHA129153e51fd2a1c98d8287ef78a69ec4bf1e9b8fb
SHA25627c4b8dfee3581d8266e0e677d63dc366b287e7e6f1a1b396efe381471a43852
SHA5125ca10b583fdc7449d634361775566dd3b925edeccb885363511263fb996313fc89632fb408536660a2eda7a55f8cb389b6b912c0f1c59931c8d92efcd6f50357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5809b16b23a494e0e0b1a780c05add602
SHA133e3a7f428cfe4b59e4d90d052577a84a41e7c68
SHA256033237019d5636c6683c92d87ae7c9834f91e61c543f4e2b86fd2b240f246492
SHA512e6ef76776eae5954ba4a7daff444a97d0a6221b97235a0ae1512c3911372f115bf55adffe8be02c8984dce97a62fa4261bb8d003e747d563e446352b37a58da4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a9744d9b8c45380ce0f6951fa064cad
SHA173d7d2219a1de4dec2a432c63ad6bd3732e3dc9c
SHA256549fb4bb4056009dccdb788d11108dfba5035208bce31b8df841980fcde015c5
SHA512df504171222c1d254ee47d289b6f3381f22d8835d79fa0aaf6c63a8a888768cafcac551e28f38667a360e28b7adad8d88e13c93830a319fb47600ccc1d0231fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf179bf53a4e1b3057fa5eff42d5c184
SHA1fc44ba626a25a745cb9240b203f2be2f29b207c9
SHA256be17a04c207674799a1c4ead4ad4c9357141c2334fe34be1f138709e66b9db0b
SHA5121d742746d93031febe3ad89e45165ca1760d4a6febf6a39f4ef6e9fcdcd705ba3cec590e74463cd57fc44cd07ef94976d606800db780df187fd732ba87c04d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b37a67bf67ac36ae1105883d92b86b47
SHA1a7750e1f4513c53e20b2dcce6f6418e5617bd001
SHA25693532d4131fea2034b5a7aca2e64a89a412a3807e18644e8aa7f235bf0fe4171
SHA512815baa455d376333c5182a0817919e802225758aa8b9032864357137c9a697525f499b8757338181558f7aea0393044d58d34538023736c111f4fc44e335a401
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f484e0747caffedb4e3214d1ed7655d
SHA1ca79bbc19bd60e644fa5a207c65ce85903ec1bf4
SHA256821a9e8297c811efa6260e24c563b528e037ca6170ab915c3acfcefb68fc2f91
SHA512d33d011f297b8b856a92dab9eb2a6898ce8f3162ddb9a4eb6d8dbe4f2fd872a1be08e96648151e62957fb3e1125873bffaabab3cc055fc4e80e861394bd284db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a65f0e987e3b3662402bcd5357f2aee7
SHA1c51e7dc4713ae91e91b701ea50325e4221227141
SHA256d7d905b48393ab9164f94d757892b9a022f21d4004677952b0bccd96f9c905dc
SHA5125f9eabd3ff42280f4fcc4b5d288716cf84ccdcfd1111653bfde37271804b4549855eb18e1a3d3fdbe751c41da18cade57c869a69fc2cc16f7c6ea02cd1faf1d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c738fa32ffaf03308868b966176cc3c
SHA12c0a3aacd724c7292a5a32a52a731dae19285483
SHA2569494fc240c3a0c8f5300a336122290539f4af384df0205dcb31b283ee5437987
SHA512eff13e3e7d49b1a98027dc7100342146a9025d38c2297c747bf81d56818b062d5b393e1753b3319fb6eabc9a61e54e3102e347d18e1e42a6bc61b70224409fe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5221b91581d3cae8adcf28c1792c85bc8
SHA16e45c1660609b30e541000a33f568ab99a7092f2
SHA25650603f7111d79c8f14be89a2f022971d8c41b78c67a98676dfbc26271e7dee82
SHA51257a7e2d31d006279a4d990b51fc8bfcdaee0e4e164e5533136b6ba1e7984fa6a099b75c3deb15fc057bd687a0363b78c53a9b3cc840f2475c46deb8f400a2bc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da7afa80c3bb6088a1f21270b414d200
SHA1015c5acc34110aa70abb98e4b707f5e25f3e1131
SHA256617e9736b6886680f103b3c7b9e4e96d705fa3a100a3d15d98adbcc910657948
SHA51299ba564569ecec6221e3c6f978a269367d5c51ec800aeb0f1010c985c61fde69e3c8279e918797446f3605a15f099bb4511cdb0a83cd436ba9ad8cc9e1467bf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5510af68399680dfb4a7ba7bc4caa9d3d
SHA1c82430f1c9eb65ec78457b745fb518dafe724d6b
SHA256369f5f8e838490743330020f997fb4720ee1d7ca665b833d8cc6288daefaa1c5
SHA512cac2d275dcb85abe3128c12701499915bf3dfeda4e38d9e512ada71feddc6b90313be26dbf24368e9ca8edd6cc9c97088ef7c83baa6e122a6e90851560fe2221
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3dc3b79246b9d1e876de0631cc0fa86
SHA1ff0ff66cd9cca013f1e130aa07478feac5dd1105
SHA25632cfd9fe9d12de283ff90b1a43e9d858efd52a3a429f0c53521abef62eb279af
SHA5125e27ac3ea1ac49deeb9979e5eaa41dcae54d123a83671f951434478bd76cc190bda4b171d16b96308aee016d61c2324b5d426807194151661f065ee2f32e1240
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2feb74f2fb62908fede27e4dce9b072
SHA1ec16d54ca6901b6d686f8ef62c27868af69e5d55
SHA2567ede01293863d3c9437b26fd4011aaefc9cdcbd2a4ed264fd736fa446f6e284e
SHA5129334df79fa289eee812fa221115bded67e29a2b1bd9c97ecb2cbca48112bb4a4f8136d5d91f4e839e330223c67d76062d6e5992afce281466b1a782a847bd482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518688b75b44298d18f38ddb6b5fee687
SHA1fe2a5d96d2f246d652ebb889c20ffdd31faef66e
SHA2561fe58a2a4117950dfe8a63bc7ed90ad7e082c242be1854838124c89906bb50f1
SHA512158ae849403648ced93aad83fc2440df3918ad2bab95abad3f3437dea4fd7a5e6963b3a95a4c38e8a6afc2c0a4dbb1a4da940091c0a3d2ee405e4eeb6478c57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9dd346fac57bff63a15ec9ba28adb35
SHA1caf9410d77870e3e4301161b2bc2d5b77e7088c5
SHA256495c7ef72542f492d79a01930f5f1f208d3ed8a9171dac11f6f4b22256c8cb5f
SHA512dd31faeefd73babfdbfa7ee3e12e15d2ac9a77277e91b47909f20749927e6e0128b4eb850c45a96e87127745367a0377a4581948d05fc69ccb4176c84e17b2cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c49b234d8636ec2f9467a04c18084e69
SHA14990c267a85674c46dd09f40f23a1195be0421bf
SHA2566c3c5ff099b2f65661f3b1f7b983d103526bf1def5cf9961994cded643ace1a6
SHA512f140531cc6d9dc12572268f0c9d73db8e9a22fb99de4b26d5158d3fc83acdeb4b10b26d244bd01a6dbdfd8ca9d7f1a781b92fed4923d16f5b015460db8a9f5e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb763787ddd7e183ad7a6ff21719a4a5
SHA179b4218c5f2f29a437ad991b92de4f46c0f31416
SHA256333121088aec13edc7efcedeca0d861b5da5786172f625e22c09cb1507bdbc48
SHA512c5865136507570bc1fcc736caeaf18b0b1b5c2cdcf7d1386b141a07d2ca89e51095e867d496b07e0864313b68a05e309b7cbf83853c647719208dff2fdb8cef7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566c1538d3ab894bec9010f71f49d954b
SHA144123e0fb41be6b4331c8c2e1ee1f71fccc5252b
SHA2561d9032f2f82abb0714119e3e9fe97fc61948fc6d27c980c4086a51f4a3869dfa
SHA512eac1772b7f7f0cb353c77538585fbb4a590f42816780a7a91e72f45a5d7a016cec143240754c9a830879665d72e416ab92e87967ee1650bf962d7e2f9ad68cc7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63