Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 16:58
Static task
static1
Behavioral task
behavioral1
Sample
d409f1fc262cdf08059e881f387965d4.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d409f1fc262cdf08059e881f387965d4.html
Resource
win10v2004-20240226-en
General
-
Target
d409f1fc262cdf08059e881f387965d4.html
-
Size
61KB
-
MD5
d409f1fc262cdf08059e881f387965d4
-
SHA1
cc2fbef4d4a9b4eac0fca4afac1fdefc73999c6b
-
SHA256
8d2966b719685039bae7d585b935f00f49bfabd06fb5a096dc220a6f0ddeb2ca
-
SHA512
59dc01fc75925f5337c073ae129c38e8c2f3b30d796cfaf517d0461b5057cb310f462712a387b5b157ecb2a9ca35333c7305947c00cec212b512d4af95ca3c54
-
SSDEEP
1536:A0tbJ2NLHXHX4m0QocAM1D5ez+ov05tGkAUX/hsef:B2RHX4cocAcD5ezlv05tGkTsef
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000dd22539bcd8ebe096b2c47e6e7477083bb48a6dfa7ebde17518c69f4bc226db2000000000e8000000002000020000000538038a733afbff546ce6e1a4df3667299e953d594b892fa77fb1be3b70a108490000000d7a56d30c4f5c128450890fab3e65352a07ac0926f985cac3421b650a6fc83163db2f15ef23f78b418a9a6dd1f944095e30f81ff70416b7e76d47b31b280196c167f0cf2587754154555062040296a7c30cec860e1f95905ad3dc8627bb5f3023656e47f7e04e0be899cf0ab2753a7ddca2ee600860667e2acc1602b25f050fab83116eb8980a05434792e7401aa8165400000001de2a1ddd4be1c922fe6ae8deda5627c9dc0b24aae1112544a14689020d1b8a27b8fb09192fbfded05c754d12312226a006b35ae1bea37adc7e2dfeff129ba84 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CFC0FF11-E548-11EE-9201-6EAD7206CC74} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000b89cc755829ab804b020eec3a347d37b8ed40a00e3535be0b8ebe9875e28b12000000000e800000000200002000000066e1df1216aff781ca71cf583b56ee7b0f937b15cd14580085119cefa7d13cee2000000093f9aef0596f69ab6e83453426074ba376c18f924fcb341fdf246ebc1f3249264000000063cb674cc6827cdc0124d30d7eef0d2ab88e52e7425b6c8a5be5bfc03e17194b3c7644368bba1d9bd0799b1592e929f87952812674e1683e206615c4c551d6a7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07301af5579da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416943010" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3012 iexplore.exe 3012 iexplore.exe 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE 2516 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2516 3012 iexplore.exe 28 PID 3012 wrote to memory of 2516 3012 iexplore.exe 28 PID 3012 wrote to memory of 2516 3012 iexplore.exe 28 PID 3012 wrote to memory of 2516 3012 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d409f1fc262cdf08059e881f387965d4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d134557facfeb58cb81083d03b452e5
SHA14d5fe415cac47cb69b7c3f4a17ae06158cf59d59
SHA2564fbddf11692acaa9ba4ce4c8bafab81cfac85768a05391b8eebad7a921139626
SHA5121d3b7f21858b708a42606ccd1ca925a79a4766a88647560caaf8c7b1530e5ad023bf8362763577370edf133239da8cbcf964601b66895e6a6f863050b04b5f6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e4d4c6b315e31e7e098f4338fcd4a6f
SHA1f6f491b4bdb73dcb802910c509c6faba16177cea
SHA2566fe5881cb4dd12e79765bb5becc14537d3739e7701c441c2174ca81940a729e3
SHA512ad5ec9a9bfe640fa25494301b573a3134252a7329521221ab336ba6740aec03cefc4cd33079ea6b130376bd48b78bf52851c0baceae7fd3198b34bfa2077108b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb75b2ea2a5095a1e6cd0b44d425048f
SHA1f2fd707147cbadeb3eb76e56e5927e62c46c93da
SHA256d591c7fe2ccffde5bd381257f896de3dd492efb589fd7fadd1db6410317f611c
SHA5120353053fb3f26687baa47783048464d5043486be29a771f143479e3eb1e9c3d587fa8a8d7f77a86bec60e00dcc582cab7fda057614be48906c2a54c5be82ab05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58484c23532eb67e9d692928dbda34da1
SHA1a82e6de2fd2eeeea69005ddc94e5107a8dd9432a
SHA256118ffe9166ab438b3e6847061d58dcf078ba6c7ec2d3a94438b0ba192632f3ec
SHA51216e9660c3ac06e573624f92a62894bb6ec3e17190a375e1af3ae9f07d30f6361c436fc6223922676c2d37f1bbab0ed57024079973f371cfd2390cbbe4f691e44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5372cf7af91cbf3b1455ac94965f036c6
SHA11ee99703887319f16efdbab3e944b44e23a9ca5e
SHA256239edf6d108fceba76272e3ecec8b891644ef1f1d74e78d0a06a0135102c7000
SHA512f9e40b74fa829858eb0f0615dec64a29b2374186f877fb54d023f0b28add269cc24b8403eb2d28bec1904035ea024360488851f0e2631c30e55dccad3720d4c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e926f3481d4fa239d25f318662683a7
SHA1d10e47a86b0046861f72c5ffc937948347a5e6da
SHA2566b14eee990791cf5ff98d846bee73aeab4a6a36cd182aeb7dbc3d07c24a695a5
SHA512a50750b3c9a18de401ae16b6219f0710ea011aae5636edb36a57fe96cd285d9a9cc30fb8dbfc187794333c0edb8ddd79621a66aacd2fcace2901e5f5b03275dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fba1c69e9daf96f63cb31e61546053eb
SHA17dc7fc2e25366b61cb51990f0ab15e62369206c3
SHA2562b5d9ab60bd961b767af67fbd00e111f7993efbf45ea08d06246068bd5f4e71d
SHA512a89076f584cd3e4a5b2cb4098936f384c897638d2c2659d1696bd89ccda78abc66d7807765b091bbfcad2c550d4317dcddd6dacfe6116764823b7c50ab85de02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fd64d98873f0ba364cfba2d19b20825
SHA113eb368ebcdcde4d7b6126e3fc136aa240f8af7d
SHA25684409864bf90a93cccaabcb4ba8cc7ed408bf13370816aa0a8de89f99d50cc0a
SHA51250d4691b6fb74e880a7cda40fb6f6592150285c3860d7dea45aa04b860956e4016cacd68cb129618c74346943865443ed18f62b3b2891d0e2f40200f186860c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb3fb9a53dd25637ecb10e89bd1535fd
SHA1cb1428d98198c02971a0899c427dab34cd475c07
SHA256e45c178f4a39425c985b1d92d81c0ca26a944133dd83c4c3b4c721f73cc2cd87
SHA512e13839d838b81fea9c4c3b7b64de59fae002d6bfc74f7807f243248889e8feebda9bc5223dbc3f71958784ed4bf7585dc6d47f376711eb214ef7136291767a69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d009bcd208b44fa0c0259d53bb6730d0
SHA1c171b37f7e9c075444ad1f3be8b032ac598394ef
SHA256f296786bcfa587c37f9722a7d531d1d71914a0d6b97cc30093f54d048f571551
SHA5121951c7a1f3847cc8bd4b51d71682aebf74d99f879c8e96e1f5041db37eb643313b7025c0ad2be18d41e0a99f8613aa6dafdd5b57b442ac302b8e42fc98bf18b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d90718176e38a449306e49bb8e1dcf2c
SHA1481464304c513b07a76489e4e3125de74cdb3e68
SHA256102f5670f0260a485189aa77a3f6794b80511f20a3b890134620ffcc48868872
SHA512ef06c423eeb71ca0b9f3a8f19bc91b1dcf1a5e826a63dfceefbe978fbff4585f24c5250c3adfabf5aeff0d2a6c009875afebb8fa588734d5f531ba1f449f6346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd3fae9ae6e0dc3882a4a1bb6519f3d3
SHA10ed489ef29e98bf54aa9f87ba014b340d1a67b19
SHA256189bfaee15eb05a0825860552a9be5186f017d4739663edc94c725919994fa4b
SHA512df12f752a8865c382be38c3b4095811d90bd71a747ef552539af5b45eef8daf9bae3c96e077928ba97f2a07dab92b8f3cf749e5ec1770bcc0398e34136aaa46e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5DKX8QD5\platform[1].js
Filesize54KB
MD5747d3cd691e352f56f8e44adaba0cbc6
SHA1f2a659470ea72c344db7410ff5920fd5275fadf8
SHA256a8a7ac9ad00d3e22712047fb5640d31120bd47b00538582b18a0d223cf9e90d5
SHA5123766adee9eebb07843efa12a437197eb454fd37a161d427729beddb3bba4378345695c870076948bb76733e788cc4c07c4ece5183d2a70181c8de60e423b67b0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9M0HR0P6\cb=gapi[1].js
Filesize132KB
MD5c23494121f5468488a8e79a6268f4648
SHA11fc2646c75df1b8528667487997ab1f5b308133b
SHA256100700c4795780ff97f999795e8477954da09fcb92a1131cd17216203914c425
SHA512956f396bef9df5a542ae410256686e2259e1ae67402615f937c2f2c004ff2f3de5f5767200661c0ce204fed9b32b1a8707c26a566da1d3aa120d428901c39769
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63