Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 19:04
Static task
static1
Behavioral task
behavioral1
Sample
d6e2ea9404adc143657c7edfa78968d7.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d6e2ea9404adc143657c7edfa78968d7.html
Resource
win10v2004-20240226-en
General
-
Target
d6e2ea9404adc143657c7edfa78968d7.html
-
Size
6KB
-
MD5
d6e2ea9404adc143657c7edfa78968d7
-
SHA1
0ff0091ce21e5e7f5a23fbc3c5c5713c42fbd795
-
SHA256
dc5cbfc838aa07e3913577771c94ec87848418e42a9a10e41a8101fb60875938
-
SHA512
613c4a2cf857e4067fd1d9da1d9659c2fe1e0c266a0934a2c8f0c6b5ddeba0fd78649fa89b56661037d7a2076a0e3a915dc16fcede0015e5cf4f39e97d3f295b
-
SSDEEP
96:uzVs+ux7LZLLY1k9o84d12ef7CSTUJ6o6M6dcEZ7ru7f:csz7LZAYS/Lor0b76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{135CB531-E624-11EE-922B-6E6327E9C5D7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000209c2d03541cecec907453824b7a0af4a4fb692d4bfa6830d94ecfb126c05797000000000e8000000002000020000000ea92c002491d87721ee3bd8f16d232b131547fbaf2051fbad28676d43dd30b6120000000f1a9e86e1d887f8d4787f7aa3a9e569f52f8929a8726cf732b486db627d12f64400000004e8aed891f12ecb31e0ada5e96246ff151f3058449edaf20d67123b18cc48a98d5eabe604f18346800c50e38758a9e34505c45f63ebdf051b6da627aac5b66c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f629ed307ada01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a700000000002000000000010660000000100002000000008c5e52927b401b4180640166a4db72d5f7af78a9c20a8f896716cae6fe76a83000000000e80000000020000200000007cf930a938c7ca5fc357bb9cb9e3b67a1bfe004c60cbd7fd33a85c0396b8156c90000000c31811a29093909fa9f770f4be4983a08470a0f8c5c0ac615f4bde5690379d69f99945eb14abfb554e071e3f17bb7f364063887608cae4f7aa0151de239a317587bc1b96d81f050b6c4d09e52fedd39d642acd28981af7e23c4dcb627f121c1ee0c989e365aa26d24c13481309c29692bf7f8fa439f7fbd3ab21a6b6ba90339db361439fa2b8c8d14a2180f871ab501440000000c8e9567dc037c7428b7fee84c0b574dde62b5c784f2c7e9f7142ea7e6040c9a598be6f02c87e1d1273e631cf039d1126c2a324b92471d049d88034c5dd04b225 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417037184" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE 3032 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3032 2248 iexplore.exe 28 PID 2248 wrote to memory of 3032 2248 iexplore.exe 28 PID 2248 wrote to memory of 3032 2248 iexplore.exe 28 PID 2248 wrote to memory of 3032 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6e2ea9404adc143657c7edfa78968d7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3032
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d63a1cabb38782a3fde6cc30a14ed393
SHA160a2f27cde2c36ec7f9d3154b8bc546ed4f4d606
SHA2561e8cd5a485f409cb99037cb5abafe295427705aabc4560e8cf7b5199a77806a2
SHA51275d08d6aa028d28bda22865eab462bc92cb22d3e44fccbd7ca45cd82fac18c2f944838f5d1af6edd2502d71191d76d4e76ef110880b2e05186773433b26d97f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f6d45555f132e07572c72415b68b31f
SHA1b15ca2174ed6ff0de86c9a2d8af4de0f47a3dc77
SHA2568f760b4bad42b9846f2304a8d2bf0d868ad6c0fac429669c326d30f30235988e
SHA51219fc4debe35289324e345630355fca641076ae464785de8a48b858cf3dba8f0b0f8a450a0f5a931d5eb49fabe1adf9dd38f1f348d126ac99740524bb9fc2da5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d80ad2f15d59b4a853e94f555f39696
SHA108702aa3966af0f423f0f38d5c1fcacc7a834a4d
SHA256b7d0ba8c4c21087aedfa6b1476026ec77452e03322477de13876fe2dfc246e82
SHA51253cf306933002cda595bcedcb3c6e647728ee22ef4b4c3ce7e29620be0f62e68d8b4962bdd10f94f4c121390061ced58c5e6522e3ca481a1bc883ec1fcab3514
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53188cd84581245468cb9be9cf57fc1db
SHA146f3feebb114df8c6e20cfb7bdf82b7d88409197
SHA2565aed2c2bd948456b7055c44a2eda8113d8d28b18611fafd09cca4a6d743ccc0b
SHA512bf1078ae8374a1f53f06c45fa445dcb2aa7fefa649bfd8859e4850e210e0ee5ada013b66c4cac08c4c6ed593152b1e9430edbe6e811e22b591eb2a419e2d27f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524e349381b7374aa5e630589470f31ec
SHA13c70bbf5ba82cf21e69ff96d3a00feb645e5d687
SHA25643b0bb7bb11f0203d677526fe73101126124db89a10d19c144a16db896a3ebcf
SHA512843c8eb8ce98b727015e7d5d144cd38432cb57ed4193dda747557567a15e81316c8760fea4ba83888a279b595683f20db977f65b8b3613f8fe7346f1838946c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5168a0ae08b3a9ed7a0c21acb9e8069e4
SHA1725f642c9354b07ebe1f36e108d5d920efdb02d0
SHA256fb5ff3b2cc2e508c0173f1fcf517865745372cd81dafe0a165780e341be2982f
SHA5122d97637bba54b5b2701faab4394a8471aa3aead0c9e69d966fb6ce298e4595838ec8d1a52f87c8c4edf14a784d7ce3dd6ee8142a24b98473a84eff94c68828af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5052dda963ea11a043962da88ffc9e731
SHA10c47e29ab863d80e0d313d2afcdeec0a4c82cf91
SHA256c386dabc16d8cfb8912563b3f2edf608661d73e236d2b35de8f0d9cf43358d14
SHA512df90d1a6be3273a0fd17a3c9287a8f3336d8c7df918002fff4e13409bb84b4fe9aa966d7b7368882abc23776b66e0dae670a9d66156864ac7253a2c3d428428d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505a7c4eb0609a91d7362d8bf4f6caeaf
SHA1f7e09dbe056a6111ba8c8c5ee9859e5fdec8b716
SHA2564e39eada8a308b98ce168b17b44bd602a33ae9d029b4cf88563c7859f17a8a68
SHA512ac0f11a729d0fc32dcfdfe982b96c2ad7cfffb8d11e4aa363d36395988e1078609bc82768fd4acc301ec906393d610c5283696f34f1866a764b1ea6b1360629a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e9fb484b65a3f45356d528c7285386e
SHA1f57aa75d8f6368434510a0af63d49a4061c8fbbc
SHA2565a0f8fed5405568676ad51c5fdee77fca4504c513735a727c806d52731d4d8ac
SHA51263dad5811ec991a4a721bb4e4493017a7e2f711a13c915946ebf9a1fecbfd7ace139bbc53b9ed3a98d66348a141019524c07a1fcd451b2f3f2db599b41ffa46f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9cfe33e2fb9564fe6dc66bfec32f795
SHA14cba6c312c3c65e65fdec3d962f9fd5d81505bc4
SHA25661a1fd89660961bf82d7d017d45c1cb604c12737dcb7e6835f067f07f719595f
SHA512cc93caa4cf7224af6d901c187fd7539e3868ddb47f0251ec78c7ad7e9e96abaa5eaf6fa15f58651555e679c0f6f62b84a4575b26d250ae5caa166bb34e2d9ebb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a819d6809faf6ffb7a6ae6b06b0037f
SHA198f29a282e9ff1ab7b87c4ebcc49a0b5712c39fa
SHA25623fe54d2d34fd899b008233ccad1fd27faf3ee30f568f9d77feb2e69f9055a35
SHA5123fc65a4043de94c96055469a5aa253edf1c7444ccbdba8287e4c5f3158c71c34ac4de464dba3ce3943075e9c93ac35ffe5d83d03917f633eda000605df767c16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f934817a2af95399eb8cc71a9f66a207
SHA14370ab92089762c2214c3f7d5ab1961cc33a938a
SHA25669201f554119a2ed9ae065c5472c6b2934faccb79f3f97965ab9445bc1b1c179
SHA512d2acc7be0f6308519d714b8a6f51ef46204ba6f002f83439f174d50ad6fd54401e9b524d72516603d582095989a1fc185bc00e959267c595bfec7cda13310891
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543509afda63257520bfb8937274cf256
SHA18af44c1306e5d1ca9ed443f4d62fed8c05f09b60
SHA2562051452b18d9726ad47c3fe256d22ea54c80324e9db9d0f9413a6b2e82ce410b
SHA5129bc792b523890b7e9e8857b8f669e85e70b221f9847bedec4d30545006afe66a8d2df4f9d11c38a6e3ccb1ca9da90cf5236bc9edbb75c6d07de149e48c87ecac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4556eb3901d9477ba0a28dfee39d395
SHA1c0dce6b53047b275179b861713c09781e50550cf
SHA25661ab7c71a3ee056d73f89fc098d0d87f467dc055a21b3563d7dea4bd071f4eb9
SHA512568b8ed6a8534db8cefc190a5a10e49072190651b8bbeb5961fa7ad60bbd34d30ed254097ae406a60260083737e002a26c07a45d49722c5ad8ad7b9c271aa234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afb95d4ff250050240d723bbe058b464
SHA12b99f0bcf177351b4c2806a620ce3f8d261e8ffe
SHA256809ee7df5a17ff393dd66cfbc07308a23c3baec4fd3508da6d9953469326e43b
SHA51244d0461676f9678202ef281fee9e348f5e0226ce6f398458bcfa5721a953e2e700e9aa49c634a44c292199f20974de5acd8d7ce5e9da776fb7ea0137f0e3bed8
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63