Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
d49ac36494b246ebc6e52a5f8a6fd9a1.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
d49ac36494b246ebc6e52a5f8a6fd9a1.html
Resource
win10v2004-20240226-en
General
-
Target
d49ac36494b246ebc6e52a5f8a6fd9a1.html
-
Size
118KB
-
MD5
d49ac36494b246ebc6e52a5f8a6fd9a1
-
SHA1
8bcada2dee4fc4c857e1bd14e62080d12ba9e27d
-
SHA256
9d61dd0b8f153cbcaaef3cf89c8b7b431a351f8f6a62d731f4bee067d881e7ab
-
SHA512
ae65a7e9b792599c7d293d4965577968c01c6097ea3bdf0839ef323fd97d2b47d135160068ed590087d193091926d759a4b28f15f6a3c733c502a22288885c96
-
SSDEEP
1536:SUww/KyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dK:Sfw/KyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26620801-E571-11EE-A68A-46FC6C3D459E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ae112b29f5cddd40b2bbb7c47f26c5ae000000000200000000001066000000010000200000009086af825e41aed77eacbc2801ddb98b22243a6ee317d48196966126aef3712c000000000e800000000200002000000031e961aca1394ec3f8153a8f6f51668b0a674aad81b973120fa68a53ed2eb77e20000000185b52e78d1a4603f1e0862aceac00a0de37b034fa71f81ea69a75edaf9f86e740000000589802e78104f2f566019bbbac48cde1c49ccd5c160e02fba92633a28f7cd59fc96dfd41d3ea0899341674e6a142cebe55c055a281e2b8e155f406eaa776b1e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b32dfb7d79da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000ae112b29f5cddd40b2bbb7c47f26c5ae00000000020000000000106600000001000020000000401ce4d6523a2a0c3c29b6badd032381015b7bcbb308389ce40c023ff29d44f0000000000e8000000002000020000000ad36e280f91484aa7be897c5eb0add7bca4f2a4155d9f17a0310cea9e187e941900000004e414b20a8a332c497ff40ec09ee808f9caf700b454837bbb6619478bafff9da6b112f8458b2fed2fb7a8bb0b6d6b64ab0cbed995e3f75d711ac8166138c5efcbe9f7225b39083ee93dae7933ad0d62a3050af742b1c3919e67ff9862b99a78524f821f9068bf6a4d58a01e54664ee18109ed7db54e7ff0f6e9f2cd4730ccb5ab027fc20c3af1ef80159b8e740af02fe400000007fc4140c724872370e82c17139b615a46585afc38ff9cf7895d6e46c1be4f0a2d364008e9baedab0a12a45ed0712d6575335c6a49cae449a4fbb7be1189cf8e5 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416960333" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2216 iexplore.exe 2216 iexplore.exe 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2216 wrote to memory of 1748 2216 iexplore.exe 28 PID 2216 wrote to memory of 1748 2216 iexplore.exe 28 PID 2216 wrote to memory of 1748 2216 iexplore.exe 28 PID 2216 wrote to memory of 1748 2216 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d49ac36494b246ebc6e52a5f8a6fd9a1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5fbc6f57a573665bf1b53cf04d764b87b
SHA19efaa02c3ec855e557894f2de86c2b8a26aa6172
SHA256a9b9030de88b2bc5be9aaa4b278580418d0d2ac34c85ba0c28fa594c70454070
SHA5126b228a1b39a082ac00a0e59baefe0eaca35c8691303531dc2e4a97c5d5717d7e77671baeafde33c160379ac88f68956a70fccea3ac695de41224139d6939687d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558423baf784cb595123493820735c61c
SHA130f0c0db5fd58d6c1b7a368214f55228ffea1853
SHA2568e0eef8601ecbb41a97695f0446e5c1bedce5083bb78843c34a046800a8ce18c
SHA512ce167de1b63d58c714d34a4814e68f50edc9c677986b9194d1ef9311265b15175c56390fea6ae4888c33f324a45c3e2089e0c2d24866cca8668a47c00adbe937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd8817800be91366f68b1ac66d63e1bd
SHA1e74299fc9c1b505efdf9c76eea186871bdc6dd0a
SHA256578b48ff073765ca61c5688af33a80054f651110cfe9f49d76fccb8b79acd1c6
SHA5124de3092114a0e20b5ec03a6cc9797ebfc5812954090ac0af1a45f6c7b24c6f08aadd80e9fbd41ceb396dcc86d259aca92bb3a0c9ce3c09d9b39a22f8a7a1ba9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db8480437e11b7d3e28987a55794a4a2
SHA1f3bc7665f358b92e36f947067dd16d0a98d7729f
SHA256cd56b1d745742a1b83816f47ce3459b26fc5a8af84d7d7d6c437f6e4191c51e3
SHA51211c667d84d87ad1ba8c0fa9d8e9242f256d2c572013eeb86d411ab66a0861c5ff2786af982e1efe25c1eedad66aa39285126d13e5177749655a6e1c594c1f269
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d4ab13728ac444a7906bef98daea068
SHA116451b5136d302fa6c7af198fcd6f9164f8c22a6
SHA2560bcbb968808d14f0a7a93c9ffe079a7b231f6bd8c523dd802ea1d182bef2fcee
SHA5127caf51200cbdeb9c138a729a22a1519b95da80a13219081b435dd49f08f9df9f2af09eaf93523494d46e04c83bcbbbb08a60c336e035049c484e7a83dcbd19aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523cd963c04e5c8e4238c1b79e98e5eef
SHA127ee0498903a44d9ba4140d5a62babec9aedff47
SHA25654cf9240fa1300b2983b658ff6b4f08cdb0f1849b7107ba0ea59e32484be7997
SHA512b27043f6aa19f3f6c0bb49014b5da866a78c3c0bb2c5db8b9f59dab8623ca621f5038cd81d46f95cc16837f1ba09653836ad4391a3689f476bf8b5734f91987f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3eee00f5d834071107d72bd1070c6dd
SHA1527c87465761790d1c7bee7b9ad30450e49d5154
SHA25698fd7fc7ed3f2833dec28ae3d5ba4215925914e76ab706d14fdce97593302543
SHA5125ea001b97c9c68dd66564c52235f71b09f99ab463b7b200888bb25497ca3173e2619442630a35d6378e70fa86513c79e2ab728d213683083c73580b20fe0f227
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7bbfd67ad236e7bde8fe1d3ebf10361
SHA1a22a0c46779f2d51eedc878bd209ad2786e9f724
SHA256d6e658ebed658a8ce95ba85140999c3b0667cc9dd1870f3bb19dc106c745bc27
SHA5129a149809d58421813cb9f5a2d09a439ef626e4da77f24171fbadae424374a8b97b33088442666c6e13794c5b450299198eb6a672dfaf34a34e54a41518f8a39c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a9551c84316ac4a99e4f570a5a5f3d0
SHA187e54581f405e3c353a603662ae8fc6c3644c8f6
SHA2566eaab85a7ea8335c562fb89e528c8224959305333499a4487abc314770451eda
SHA51280a77a5594a7caec59358eb04f1c3482b2a7ed64302cb982ede737b12e0b03a4575f311209c0c6c625e4cac19acb1f6a4b887e3459d693c52611dfd6838c2125
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e660ff5251a733bbbeec24c873961aad
SHA1a04544f1883bd64b86d0f01a9b2b4d49fb3ad966
SHA2563d2791cf213d4e047c3056a1c9d2d05b382a84b1d8de5a5f0dc414f8b25a72f9
SHA512cc2763f1e5d6a8673f6ac5a14b0f6eaf52e5962081904676e1040da6f38f17ef61071cdf52b178f61e48405e49a37d5040daf02a5d7ab01f136cd8bcbd8ac239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55707bb9bebdeec1863e24aa9d19d1a60
SHA1380ebab158c9fca36599b485eb6d8b0d1fffe06c
SHA256e055bc77c9a995acf70f7bb5aa0c32ce845d92c025b4e36bbc1cb8baf5c2a0ef
SHA512e4e1997ae67fb9a6df6a3d22e959f13f6b884bf02838ae0340b2a72cda6da32aa3a474a81886b8ea9ebca4543dce8f90d0b5cc233dd9a861b11f74f1ae39ed0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5e493d00e50e7d9e32846cba70e3e78dc
SHA180ba62de967334cad426b7fe94a3726394aa9a16
SHA2562db3fa00b92fed3d4b42db518690a8b99ae390e4135ed320389e2333f5009899
SHA51243597e5907c5d2c6a9a13ca2b440e60076d61d2fbf8b208ef2f13e5cfd031499b543ff6cd348c1bd27ac8927e763b6d51efe4e6840be39857ff8f7f3a9194168
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63