Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/03/2024, 02:51
Static task
static1
Behavioral task
behavioral1
Sample
e0970717b09a94c839797c93d6b9683e.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e0970717b09a94c839797c93d6b9683e.html
Resource
win10v2004-20240226-en
General
-
Target
e0970717b09a94c839797c93d6b9683e.html
-
Size
87KB
-
MD5
e0970717b09a94c839797c93d6b9683e
-
SHA1
53753674d4de260adeaef5a0c351c5e23094242d
-
SHA256
ed1b9074eb4f20eeaa4ea88e54d6bb8b62ba13e547c98f6b3008baf90a18e35a
-
SHA512
beae84d37af0a8df1aea751b44596bf224f2f6b8e0df542f04262c900837058dc38ad04b69fa995cd6faa3591cfe9e9b54cea1fc8c7c17bdc0d8edddafbf62b1
-
SSDEEP
1536:SkaaL8RiR1QtZi4FlybOzjEbPrnCLsw0C/r1:SkaS1QtZi4LybOzjEbPrcsw0C/r1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000001ea30f95240e105077fb4731825592e1fd9935c1e06884d992a8d9e6cc6cec33000000000e80000000020000200000005093139e8b0f3cac3cb5283bb60401b052d73863d10d4ee567b0faf311394116900000006959e7e994165b9d211dab56b22ac16e1589d6f92d8d53d170db12bc3b375f907642d3814d33f18d4ab6f2d64fce2b9e08681841ad8fecf65412eb1544f77b5bc5f47b82fa394b2ab3ddc817e6f9dfe008a2d97b469ee02d4b6328b8d93c6433a2cfc77cfc0bb58a815c068a1bc856ee68c69da16dd2bdae9d3cb761fa0134aa6623bc37a0c85b9061cb09fd83a3110d40000000242cceadc5dd11113a3f63c9ef2f9e46e7ff1c8aa9eec99091595d9ccd9b9bbe7ad87389945db734fd856b3c9cb5295e8d23dfbfaf95d8a406b16376293e283e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 004552c5f17fda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417669772" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F06788E1-EBE4-11EE-BBF2-E299A69EE862} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af6000000000200000000001066000000010000200000002e289349a160921aa8d92a616bcb5bce0c0b79c7bce5020818f2063e5c1e697f000000000e8000000002000020000000d13411292a8de2738c234549f173b686b63d00d8dfe06aa285e817a9f96e20bc20000000a6f6d5258e95ee70bdc7c603be977a4105ab18a8b2da98ec831b1ba339e1b980400000001c0707ae26b1d7868f80e9720e889d21725ab18e97009fa10878c251f6d67b0ef8f5ad58de5d276640d539dd5585ed91fe4dd7592a8bc7cfd098b73146fd6a18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2056 iexplore.exe 2056 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3016 2056 iexplore.exe 28 PID 2056 wrote to memory of 3016 2056 iexplore.exe 28 PID 2056 wrote to memory of 3016 2056 iexplore.exe 28 PID 2056 wrote to memory of 3016 2056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e0970717b09a94c839797c93d6b9683e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5201fa770f375d700147739bc7fafc715
SHA1a79276086ae555ccb1f76b18ff895fbf300761d3
SHA2561db1db25afba725080c2f6608639baff519e211fc8e60a2f20141bc131605db4
SHA51244d67c8ff6a45ef6cf0e92799b337acb511ad836f6f117f3e0bdc2630610e38b95831921f4ae164edb2c59ac00dcdd4288cf5014a401bc7f9388d1438b6951e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecd5dcd421848211e451621bdfef4c7e
SHA1d8a3c4e86bf798032d1776ec2968abd7136f8700
SHA256d75f66457bbf753da9ed7cc6f237c18b297b9797194fdcfe42a04ab07c20b7d0
SHA5121c24fd57b788095527377800da7c52241fb1dd89ef5cd29f0377c415975bc8ff5b94673628a97bbb2af6b2915df4938a147133a483ebd411eb60e8bb443349e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542670da9db2f7366e994e5747f8b2511
SHA1a330121a78283a4632817ab122905703d3dddf15
SHA256a214d8e6fd7ff5af41ef047d3420b4f8344f73f58ba6298519b03a792ebed606
SHA5122e6d9387083a41a25d66fab53b37cd129c17b9ddaad75c4d2e5fb2d5c550477590a8b9d4362ebd76cf8b8fe1dfa0d4431e4fc3ec4cbbd67a8bbb70d1f68e45fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0eabb1b3284ecde5d788f3bb41048f0
SHA162d961e8d2ca6786fc47ef18f343597c98d91581
SHA2567fa9d4c118ea84347e22b3b8f5d725fea5f26dffc719e7602a5ca617cef8b90c
SHA51241f8dc33e4f0159fb9ade860fe83c15dcc9f318fbd64d83f402c72bbd7d82c85106412d73a2645b05835f943bd7afb986e72064416b8b8101a3825c08a0f9475
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e03c508aaf84c08909ef125c21934681
SHA1644e5be54edd75b7e5ef6d83d98ec73a7de7b258
SHA256c89432d75dc6223921e71a13902b033d7e7277450f738b65ab82292014c2b98a
SHA512a90e03c0f9265fd5fdec582b0a39ac3f2e0de4105fb4961ccdd8760dd405f13c89a6fc136724080ea8f1c51c8ae4faf08f4001d9f27a67889f10ce29f81b5d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dda1dc1b143d85a3637a849a7949eb2
SHA12cd9780511b23e706557d8190588fe9aa81186e3
SHA2562116e8ee1ed9d6019cff53a9ea14e465f0e7905d9fa0815a49030c8303ca075f
SHA512200478dd5915038c2a182efe8351bb8acb7f68763475504879a8281e5870a548cd478b2463f7e20156f7bdde25ca4e22c1a989197d811797d30604d1925e6218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582b30997453437e6346f9449408f0d41
SHA17a07c309349bb90862b72a04e5af48a8163ac8f4
SHA25633328f5ad496369e9d12e415e290de8d432745cb07189fb6b03b91181cdc61d4
SHA51298ee491770857b79bc9adcfa6fb7c3502c3f19ba790d06ae454c9e571e868f3894e32f5a6f3436d16833ca0eee702f5c7b56b4fe6e2e3ce24dd4e6f715f5c160
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4fb2035c7981dd423f274daf4a2f5d5
SHA18d8b173d2f6a007737ce4de58a3a1ab0339ca0d3
SHA2569f55f34167752033d896a8a21da507282c42a465d8efa8d0935d513b3b041193
SHA5124dc4a36a799a95246b9617d61cc7d613adb80b7836deab19bba0aee505fe5aba517ea0f417dd5d3efeb17cf8dbaa80c8d926e388a19e2b3c1894a2aa9b78c69c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bcca399403d1647b0d4d88cc0fcdd1a
SHA1cbb2de9799ba5536b78f6fe3cbf14dc8a2b62a44
SHA25619b0494707f83bdb710227c9aa33cd0788335f0099cde55d33cbec8b552e0d9c
SHA512d92cb4a401cd582f405fea54648eb45f4b91b722ae3354ee7ee2c8c7c3318a3ac100c20716c63d1429a2288ee532d6852581ddd752e062cb9d6a282a4bc7021f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507d8c1e8d9034a51aee1a5cb1f873713
SHA11246fbdf0dcf10cc876de90fd272157f0d595f6d
SHA2562b13ef123e30100659b0d67f579b71bdb5e8150e6f8e992b22e9ce751d2cf85b
SHA512b0a8d76291a84b6df768d54017e944541614a91c8c06166218bd3f6b1f200bfeda3db8240cd2e7891fbfa8e4ac9f9c1f676de12e2753e168468f6d0836f95ec7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50565d61931646e880706827c1c3d3e0b
SHA1eb4a51b7531066f80f632afede6409acc3ea8f35
SHA256bdb0b7fe564072e4d46c1e4d1f26de3b81d4f6e408ea6ca2c8f13b49354d952c
SHA5127dc00ebcddda62a746a147689339b5ba9608b64ea3158c5889dc2fa4ca075356db35a94439c26f90297629d117eeb54a490ff77326a974482a33a2f247e10b40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559ef2cda266025aac9b7d89fd1b0f9bd
SHA1f81c6b164c5554ca7618f060a4f319086764f9c0
SHA2568f7e58320900ccf8b8741b820aa67367358cece0bb333b9b340867a940b93e2a
SHA5124cd5aaf3c4fe174caee5160d64222ea00da93320ac018585773b155624b3053b33ad06c12b3d74236d7e107d8f0119e2d6c81444ee8e06e55053335ac3919ffa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537a7c751aa47499b6a574811eb1558ab
SHA1a2a0d41da8517f64189af77d2d262a171d7a7b48
SHA256e53c91e3c167310c4fae89016639fb5755558c810817b23644f256e1ad8bf7be
SHA5123c47797509f24d189e0cf5df571987b073755f0add32812afbe5a86b2bc935df2b46a2d65f066133829f779466da90a619d5e9c1723766c0f5716259648b1d21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9c165b775c47088bc596c088852c530
SHA1f8e730548f68e855ea019822f3f0763ed33c8cde
SHA2569c07f77efd05f93a9a5d1dcf353e21f0dd0ccc4650d4831383427f6cbf774e83
SHA512ca263adc09e3da7d8ef9031f2cae8e4fb3260999f83fc3bc373ea3a9ba8c155adfe7cf1dfbec1f67c2db7fc37e227b9c6328e975f5b026854f419f9406a14844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fcdc0a8c44ee6fb7194677316b8e871
SHA187d5cb8acd06a2fe5fa50dc65c4e0d57a7464cbf
SHA256ded8154063ad1d2a07e5ac750bcb0fa2a2760fab36055cb5a7ea5ff89aa975b9
SHA512439c9437276a32cac756eaa9860f1eabe74604f4431ad3fbb37278724fd741f619f641ab602ca2bbb4a14273615b2238a70a50b05d36eebc9a3ba41780c65732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad648a9ff4cf828ec4e060932d32022f
SHA11f52210d88e9e01755bfae32581437b7f280a8c9
SHA256e91138f39c969a120ff9cec4c690acb1a8b0ccb30cc4c39f7c5e6cdfe013ae1b
SHA51207ada2f3b895f8a6e09a1121672854dd5aea1cfb19881d98f79cb5cfb24830e53b84a8fa10706e199a2b962ca5ead62e213a3356561494a90cd9a579e238e25c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD566f77b26e39358f2591a7e71a96558c8
SHA13b37dd01963fabdb13bdd28a0dc272dfd71ac944
SHA256c9550d0f60f08eaabcc66f612333ed5b427447f67036e03a734c548fc5bd64cb
SHA5125afb2fcf9bd4f920ed2901e239d349a1b97424327b2e689fb51a51f354e279e3f2139358e65352370c177ca6c11c80f6b499cf47aa9e0960797ab8e5bbb3763c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3c336fa6f5a413319b6a5e3b2bc6e43
SHA1b57d3dc010e66e4ca7634e683dd7b8b6257c81ec
SHA256e0af672db33c9d1b5ddcd18cc34d565cc88956494148816e990e869242fd376d
SHA512962ae5eaff1a75160df6688215df5dfbb2f5f468359cd3126179fa54cbe84b60685eef6d82c2a6fbf6c9779686c22eeca459e55fa06a402713fdbb4ce5ab5b7e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a