Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
ccc76974ef4554cfc2ca279762eb01b1.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ccc76974ef4554cfc2ca279762eb01b1.html
Resource
win10v2004-20240226-en
General
-
Target
ccc76974ef4554cfc2ca279762eb01b1.html
-
Size
13KB
-
MD5
ccc76974ef4554cfc2ca279762eb01b1
-
SHA1
d69a4b213cbeb0233d6780200e8a7e894d127bd0
-
SHA256
45a74c11543c3881932aefda482e961cad1e4d20897f57f84c522c4d43d375e9
-
SHA512
1ef2acdd35dd86f35abe8ccfcb6dc007a4829224eff18c10a5d9d9132fc17f8433e726598abe5a2dfc34bf5ed295f39a938b59767565c62b6250bfa4eb030331
-
SSDEEP
192:WqAy9RdIQwSa6z9i65RW0q9kckv4laUFPgYAcfTEn1omFEznAjukkZOMHndRj:4yfd7wSa6z9ioQ0qeDQlaE7Ac1YqbX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{95A64611-E335-11EE-B671-4AE872E97954} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000ca7f59f7fe3bfc9fa03f057bb531c1bf725594b1c519e0faa4a4a9bb2c430c9000000000e800000000200002000000079d288add322d7dc5b3b75ba7a3661abd80fc2881c227128367273eb58b1ad4290000000d935b84dd49c8065669d447878b5aa1a822763dd1660761a9a6474703dcf5bae6f60ed9ac84caaa17e81ee6dbe8567debf31ddc846cb48131c2f1bd81101d6f45f6917889dbff561cb4d8794f6872419ccb90ec8fecd744a9495404338a04eb332885961556f8b492d0b8d1c9cb9dc2bb0afc0d357198ae3bf13eb55008d811992e86dc8092f894f89b38b127738eedc40000000ee46aca20f8001c644fc3a0201eeb8f349a5c48b5dc03f5eee1108de9a4bd6c4ffc1b497ce72be8010164254dfac1ec728e7d009e9994138e1a8041730343b12 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000ff3bb8900e8592758990627d99f7f71c2a7038de8f6ae9b1c584411ade45919a000000000e8000000002000020000000dce1911b5bb34adfc762591425bb852c3d0c3c0f7bf8b9135c6038815e0a31f820000000bcc22042d1f364c21e265c54d7be5161388b659c6f172ac818c719bb29dca09c400000005127754b947d3eae4e8e29036f5c0b15fc5e5dd19378b967591079d0746642329a21c2dc3d4b54612c1c4b37874a029daaa40c3afba7b5b2f460c254b9d8680b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c7a76d4277da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416714849" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE 2116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28 PID 2460 wrote to memory of 2116 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ccc76974ef4554cfc2ca279762eb01b1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a94ddc51eae86c9a91e7e9dd69180c3a
SHA1d2db4113668ab0dca51440d4d2b2effe3f811448
SHA25624f110086505ae46f7cf449d45975b8eff0658ed16dbbe627fdf1cf9b10c5229
SHA512f66ed8a875f7f34eda7e0d600876c559ece05ed1c2d196f3eec7e31c3d69db122cc811e47809baaa18195cda3ef88b3bb0e4d7331a879b2a7c7c4ec415a7e1d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af5a841d9aebd403b2e0d2d141448320
SHA1ffe3488bbdab9d96ddf58e243ef950d9389d35fe
SHA256ecedd79544515442057e8cb253e8ee2b7648e7bada50a17b5e81e9fb028438c4
SHA5127f09d21b1c9717ebf17859be2eaa6fc588cda770092c51618cedb367ff9cab571a4d5332e547712bd742a464c480fa86296420a88dca8b4fac997894f0971f1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546e090be93367cb2f47723db9800d337
SHA17a4d8519520ea283b6934404c2e527b2ec52e085
SHA25662b57b55ead43bd4664afbb659c55a45a11a138a87b5fed1234155009485bdbf
SHA512896f8be4e20d28c861ae9c178f1d82256a3e6b5ac73d797a72f94813ba62f812a0badbce9e1e82d4ddc706574dec3f47ea9a54966a743af1f1f578040e69d1e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f31888fcfc4f8215e1054c1fa07fa021
SHA1025346e0153ffdf47a3945047c4b790abe15d4d8
SHA256fe783897ea807360a4c4d1ae27632aad2ff7135c413ef6805020c0c05382cb59
SHA512fd2053e1fb09c42d3e23d2682c34be49dbb28c32ce0909346743718b1ed47eec2b0f84e379a1398de2410562029a0f5ef0537d6a7f7e24de2c86a0cd28c61984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5764f6df4e02ef602dc2b4bd5def3117f
SHA1ad689cb0910708c3244efce908293a3ed669f280
SHA2566b7c413ba8163157b662876d9354ec3f492cf324b500798848f787bd41743529
SHA5126c0b0cd785ae2c6bc01226f5e70a295da150d76f96238e7456ecf11697b7fb5d4d9005451d61b4812dc0983027c072d9d35a11b4040466ffe085e8305096ac1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5454f0a2c5f0638854842fe6590d884c9
SHA1eb7bc34a4dac233d3d36059bb9c47542bdd6f26c
SHA256753a1f7cff2fe583fd12d1bbad650f59357eb1b6fcf3e571034d9a01d1122b00
SHA51292a3e4a9e95f3d94062afabe98b329c425503f264574db5b1ebdc5d45a663df101ae3940394d5e649259fd201610c490dafcd622a4991eb098d280f71da5c595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5219b5c7964fc00dfaf51dbc08a84e997
SHA1a4c2f815708bcd429c3a97a431a82baab2ff9083
SHA256953c0e860fe104d52bd4726928143eb9c66be5cdaeb9f1c1d9f6ea9745990724
SHA512cf34581fdf589533978ee25df3e0457b0128b26d22dd2d0fe0164e38cb936422d67699fc2938d7212a07e255fee38e1bcaab2d42dcd5de958e3b60654f165847
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54033ed1f94e71e39f6c7e91b2c9dc19b
SHA1e34209e564dcba9bd8114b6ad738097574fd2984
SHA256b3b7eb668bd4ca3203d0dd5370e2aec3148df1dd5612266df431b0289320355a
SHA5126e5d74e6c63a6a12b99e785e299781b5df89d81c3b823a289970c848ac420a4e1432b6500a2566ce9a11d1cb4ae601a6b9029ac9cca6593204acab0bdd0aa759
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df1cd83ba56c33aa5bb7885e5f3fc573
SHA1930a86f566917b538fdd18e26ed97bf19db80d34
SHA256fbdfd4fd66104e42ddddf46ab5abffc29fe58e085634dc77b90301be90455db3
SHA51266c0425dafc3f711c7482f78003667d449b5a6d6ec46104f26a0b766394367d46f49d408cf485800a245655d0acd353bec108b2816949639a6c663e10d698998
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582a28a542d92eb96b56c506f2c5aca97
SHA104f9e7f1ad61c8bdf3baf1c0d1bc687d557a3869
SHA2569fc49f7e9246c92e5e4b3269dbdf04708fb32a2bd7864f0d8fb48c6ad9012687
SHA512ae3f4e673a2d42c861adc385c1dcb0144d43a0fbe4b571ec74d51b25c52d87b8c2e39728fb26c3d7c0c7b04e0d8f089eff3ba0a070868ed8a013c162aca9acd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5754b83b5a63998ea4b4f5941959b463e
SHA13c0b1b10680e7e00c2fbe9b9d1dbbe46721c20f8
SHA256e6100402b6273bd1154b7d157f4a8ab3479c9ad0ccbea1f9402f739aeefdbb71
SHA512575b004e467b05afa07897f518171d2e76632128cdd62b81df181c9f53685492ff65f0b2fab4e84f85da82d342a1fb6497c62cd793cfb2cd670e140a6d826602
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b33507cd070496a3c44dd487ca80144
SHA104293a73b7ac42c718d868f2ddf58e626728a3a6
SHA256c7cac1f40edc0a5920706fdcc6f7a030aa2aaaa8a01bea3fa322538e21859237
SHA5124cc062a624c50e96d665ed7980a5f3518121fba5351950b530b95bc6c027e407e02c490baeb6ddd463613bcd8b0d570000a23dc693787399aa6a3dd8400b70fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5969007f36b64fd68dc5c14dc33d079c6
SHA1769600e64a1a37326f049e9cde87638b35ea8f5b
SHA2564461c9202487b3033e1dc6a53838b50f20995bee01ec2eec34fe1b93ad8c1c90
SHA51287640863ca5ac8b252e95632a19cd10b9cf730b045a3a5b56459c8fce1b3d92103894818d5575b1aad7d1087649421afd2f73e9ba83712a912ddea41911172f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580809b171d1ceccfbd12ce838b9a9f1c
SHA16697c49ed3c64c42e0bd05cedfa5495d61788b1c
SHA256a9deaacb15abc59ef686fd1a795ecd5f3b51429533b8e5332f0a25901f72e135
SHA51250e25f1c0521d3f0527d9135a31ac72a429243782d6e3d7d1ac9f8c751c9f22af772ab56fab40337c219580be89728c7da2a8eb82eb9c4b57a9387b36114d732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b40efdf9606bbc77b38e6a5cf4896f6d
SHA168e76277ab47a42684e3983216036a61688a723f
SHA256e2e5f74434dc4c8b12aa2bc4ffc1d8ba7f64d07e6ae692d9c1049029494eef37
SHA5124c12863bd732109293ee2659156aefc688f31fedb399cabb19e43787abf52b21fe1b38a42f981b387e8de3318af039c4a5a6e706839b0693281d682b94911de6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d47c9a0207f57b9ab710ccf243daeae4
SHA1e8430af3a281ce23d1f96671fa65a2ccbfafb523
SHA256411932c58bb82a1f8b085eea814278e32659232ba98cad5a965706f84c1194f3
SHA51251d93889891c84fcb89cac8b325a674774b84b8062e25dc5af032aa772f414a9203d50a980d92865b19f87ab68345f786094c8b7b86fbfaf16efa1c735835c7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b971572ae613c7f3d5dd1b6c61b8a61
SHA1b75c2c3b9e862903e8e559cc6e33ce6477f50348
SHA256e12e12749ed3066e6986e8f4e65ce4ebcaf7ed79ed74fd512d7117a094b40b53
SHA512c84c48ac547af02b9122933bb986971a12252a318163ac16ecdbe83739d103b3cc8ca203956bbd7c612cfb739fc7ed200cae9214b09f07eb60685b4b97e04f3e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558d3098db498a614ed0f6ffbbe6d78cf
SHA1db89873aea4b66f0f4ebd197a442264f1c8d6c29
SHA25674384e9bdb8eca2a9b35d56b0dc467ba4ef5f4ac4aa9d0479b26c50dd0ecd4e6
SHA51297db7e0aa97dd2648541d759325ebf4fd051c0a265d342598d0250c470befec8be4242f992dfaf1e6eea6252f436df30093d7f7d1e1d1d6245b16522dc5c4bf1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63