Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
18/03/2024, 18:25
Static task
static1
Behavioral task
behavioral1
Sample
d43425c77de43dfeed4b81ceec0be3bd.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d43425c77de43dfeed4b81ceec0be3bd.html
Resource
win10v2004-20240226-en
General
-
Target
d43425c77de43dfeed4b81ceec0be3bd.html
-
Size
19KB
-
MD5
d43425c77de43dfeed4b81ceec0be3bd
-
SHA1
007a435a6f87fcc083fbcfbffb372c5f0448520f
-
SHA256
e08674ca12daf3bc86ede4313864b263c3b5c01fee5de89303d448a8f81b9b1b
-
SHA512
f83c4cbf0054f5ff3d70c902c70cc24d0e5421f5ee3cc17a870e9be16d9f8717dac054e569a78679ab10a88b1da0a9f2902c8a75109759fdda042fc6c723ddea
-
SSDEEP
384:R0iu19Pqb9zhHvrChzG+yeFJ3T5Dv9ri36V5vqSvHhEvdzz:R0icib9zhP6zG+yaJ31Vi36V5iaqzz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D7A461C1-E554-11EE-995F-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416948173" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE 1376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28 PID 2292 wrote to memory of 1376 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d43425c77de43dfeed4b81ceec0be3bd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2a1b999339ed68664df99ad53abf8bd
SHA1cfd68152eed71d2e0825c47f574045a188d8c50b
SHA2568b44a480564f2ebf89d4097446f5cd476701f7afd87e49597f2cdd3aa58c472e
SHA5124b59fdc2a37349677b0a61bbee038e4daf0551286e7327c1f80bd99bd02a5d7cf1223c454d2bae4445b318022f49fd6643c3e3dac9269ccc4d246a7542e9a14f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f408bbb205f5a8e8d19d1993db4c3a28
SHA1c3498f58789b34de4c07d616c762c49e42559785
SHA2565969f5670934c77f587e8b5770a30e61593901c25863cac00b7a8783ea9f7c1e
SHA51291f46cb800f1fec0fbb7286d039d3d14ccf77c1559bdbabbbdbab976c8cda904c69e847b25cd67407571d7b8b465ae4e741b1ab008775229dcbbf131a0f22b2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59641a1ae795d4e1d4cac52d68dd135a6
SHA19827a69107ac94ca1ab71c3294016917c8281f5a
SHA256fc8f6d3b06b92b1bdc617e8db58905a47cc69fa0267d9e77b30f9538404df463
SHA5125be7a3199301e28a3e1dd1a0e2c3bdc052270eb0e369de73d7d8dc22d227164f79c7b20df883e640f2f7c8a8f3db9bed67bef010af31acc0fbe00c489dc704d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb56ea355a9983d3d12bdde7fb7b7c29
SHA178318fe9c6121e74a8c1d43257eedca38931b10a
SHA256879585e98ace027d68310f6c5e3846f494291814878fd15bc18dab3d0b5df6b5
SHA51249b7cab733577388810f031452cdb9039e7aee0f08d7ca5d668e8e22d4228cfc74fc2a91c3889c2c4e74349c987395ebaafb31a9da35dc7f1daf798e1161e827
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5854269ee94d8a8b73419e9c5700a6f7e
SHA1468d804e3176e546764e6edc2ea8a529b0ecd1b6
SHA256f13eb4bcaf6e3c8a9b89719fc6b0b254398fbcaecbbdf2f49ed4c4d0c82261a9
SHA5124922d37c82c42d7eced43d4d9daec9993a5b9866180c4dd0aedb99eb343cd709aff1917a97d641fbd16825009294799bd97d39546b9656d9e0da826838d7a53e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c6b96ff49092ecabe3e09517c5c8e5a
SHA1bce29093000e9819495efb06d8bc76679f887c13
SHA256c7f1178b297c94f05736866fbe749fa7020fd9afd028353d8c277627f4fd4a8d
SHA512fa8c2fc52782c632d4a7df3944fbaa91365be2e1af43718f29aac91d099771054fb493fdf07d23b41fbed6cda8c3739a4f0c4577f9b175b7eb11a6959df7b162
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccbb10ef3969424387b47f5bfd25564c
SHA1adccd99d5faef35b5ed18282e6a6bec6038d75d1
SHA256af75673596dce7bd51096b21a11497a46424cea777df2354d51db5704145e943
SHA5123c7b6288f3bfd2c5cd22513104279e4784abedfe4cc36d9a878b6b775ec1f6ac8c78b8313b8713adb895d22d35feb5e891f61aaa6eb3f83aa7f28ecc85a84014
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5657732129c10edbf21369fe152891e88
SHA1e5958b57633774ba95d774bb4706284cb631665f
SHA256d1303889c02c6f3e27e8b551b0e35e1b4022b122ea2da081f31d6c94ea9320dd
SHA5128032412e668e4156088abe0b15aba34ca22b88dee55cd42c396f1a13b55de8bc04a00bd79a6d26da871917f8d174343c0da9f3d49067e8372ad026eedd2a0fd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580110db1a6395b945edce7c1e99df5bf
SHA132c4eed086b5b14523b8ba25704a0ae9781cf1c0
SHA256e462b62c842a7664405401d23d554e93b7f35b1ede2fe1eff5e20ae58b9f50a0
SHA512d48a74a2697d2eb11bbf55bcb667492759364519594fe1b5ef4d04c59bcec1e7929f62f6aa34bae6c7c108d4b6c3cfa20cef0bceaa1516c8f7c58907d2ad185e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a7be763bfa22fae3f5dd707d9328c06
SHA18b525aad55ae55871ed0e5e9dc9ffc223598a587
SHA25686e9bf96cdd819d7b6fb0f394cac4709d04039696abdeccc374eea183a66099c
SHA5122bc21e7a1ccf5c0673ad03916e5531ddc14a1440ec6f5205573d0d541693fa076b2003a04af9b55035d3a597a5ec8d5d29274244a22f7bb731ab7ed7716ebeab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8b041925d076bd44a25702cdacc71a8
SHA16338b7f0152e888068dfbe10f6d153a455812203
SHA2569f2067d5f3d98c92b7b94dac47db8a586fe6f933cf8012d9ee1a548bf628d280
SHA512ca28be5b95414b8fe2fa568d11ff01fde3e9dfa2dad402ba85477f39749c08a8edc1e21d69e53a20ed78d0140bb837cb4359c5be93f3cd0f9b0740abd281bfe7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63