Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
04/04/2024, 19:32
Static task
static1
Behavioral task
behavioral1
Sample
AudioTranscript_765.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
AudioTranscript_765.html
Resource
win10v2004-20231215-en
General
-
Target
AudioTranscript_765.html
-
Size
207B
-
MD5
4b3a554fda49b1fa8243bf313cec88ee
-
SHA1
e06deed6672b5d9bc2e74bf532648fcbedb0fa64
-
SHA256
df280b814491b1e43aa452e70682b24f8ac22db51d543e23eb3ff653f445a226
-
SHA512
0aec13dd7d8b60829286426f12b2996d97d1da3cfd0535ebb5bc4f74b93afdce79be9c4803a9ac74b2e54f6c35ec370525870dbe480621b2ce6e0e3ae40fd2f1
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000f01538bc1f6a88f885d03d9abaeef4cf2ba7c1863ba23a435b818a224f1d39a2000000000e8000000002000020000000ac199367d4cdadf4f25bb08dc1fdb0e1cf6d66d8dd73e6ad4bfd88832dc7ef4690000000a2394b8a80c1f9ab20e6f52f0cc2d082ffd811da86190202ec1e825dff3f2478a2bc098255227735c0fcefbed2fa71cfc4dbfdd7aebfddbd7d11e4bbb96f4f61d0c2583b0075f618f7b3ccdf5fcc98cca6b46437156a01b525c27b673294a88161f506bbbd3cd7cc15975258717514e8aad5ee2a586c792e0665e99d4a009eb1d6068e97e5057dc65173b2686fd66bc040000000571e37d40491587467d8d51831d72bcd9615d94a97cd1559334e6c870128dfea7f28b63b174946aea412c8ea09597dd2427d48defb0136c7dfd80f427b9a3436 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20C924E1-F2BA-11EE-8745-52ADCDCA366E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80e16af5c686da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "418421039" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000071c834f68b8ed044a0afda50fbc58a7000000000020000000000106600000001000020000000da149ede0d8d6f61d693177721b90c06790c842e5fe2b4af271c638c03a47f04000000000e8000000002000020000000bdbd00fee59ee2f6ed25049cc2139c42e7abe2d46f84583d584ceae5bbc81fdb200000008da2d7570f051c11dc71dfd046339ec206798f54e49059c166abf974af22765a40000000e8ab59e26605dd19b4a0110d60395d7a69ca0566cc5a98f357a330e0ad6a583b8f82be4bbf3cb8384861f73b3fae46eba7ff4cbf067beb43c71aa30cb826acdf iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE 2036 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2036 2240 iexplore.exe 28 PID 2240 wrote to memory of 2036 2240 iexplore.exe 28 PID 2240 wrote to memory of 2036 2240 iexplore.exe 28 PID 2240 wrote to memory of 2036 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\AudioTranscript_765.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2036
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599ce4cf3bacd0480c5eeae1c829d20cd
SHA157d83f5b47bfc03d56435133ac0b096a27e9b25b
SHA25617899d2659e8f58414ed0235185037e1633fd07bb86834d25cab3f8c8e077a84
SHA5127fb32bce2171b41f7d078dc7834e453dadf9140d502c3fc9bd4b196f9a3d60e3ac37ab29bf9cbd0947f8eac3319a4e0f8daae0f881b6ea8728c5ced07c6506ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599428ec2bf8e440f0a49594beb8c840d
SHA115a4f1f90d558a8f6ed123a0dcf53827776f24b4
SHA2560e882b21531db395b302d96d4719280af433d4297060bc30b3cb7526b4306577
SHA512cf69a7f557123d543d6775f6073963ba2dbdd6a48c65faa568513e9367d87f25b6f22a038b3b0a9efc57bf25bba192059205aff6e7e7e7cc918b5c66d9631e63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9b9bdf930dcdb4c18ba284f83a928b9
SHA193525d8d468f00553ee7db7cecadac85b034651a
SHA2566d77886fa9e00ba7168bc1d3f51a56fb8dab4c0f955766185623a0c4e1a3c00b
SHA5122f027f784010cb5a514bd398f69bf41b99bb6f185503f6dcb53571f9947e10bb3105c261e35f3ebdaa85379afe946f363d0a552ecb3e49f661dc1b19ca27c0a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5945e5e82b26abe116e7a7afba2843697
SHA1f790238981448ab27e3f63e03caed774bc308bf0
SHA25691cb4a1f8b9b7a2b70b6c822840b54e1ce06d743afea7cc1d781d950cede51da
SHA512d6f33d19b8d6216bd3fb43f92def619805dd91a25eabce2cd3a35c8111495f0d62dc8a40221292fe7710d91522aa787ec91f80151772c0e89e099faee70794d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a05338a6b3240b253efc693228e424f1
SHA12e75d493a34aef66defa6a141e528e118000730b
SHA256d8314eb2cd680228aa30ca69334209d315886146566d39a0465adce93eed0c51
SHA5122a6f03767785c41a63c1a69c83aa2ca9a9a3cf33932737b2aad954e47788f652a9e33f514b72635d2973f2b4652e4fc8d44311aef340bce9b5fed6f02723b945
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ecead7eea87516b7132fead0dcdd9e2
SHA194d9f67165f48f9574673263c9af23cbc9522bcd
SHA256139042fe5d458fe978c116a7debdf3465a8ff495b182779d6358fca448247fae
SHA512f1d4a154413e69fdcb5f34e21acf0b3325f41d30b0012bc984b4b8c6e1e95e5bc03b1803cf5d7989fa08bdc9fd8c556688a399891230791539212bb2d2a20eae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52aeca0f4cdbf2cc0038ac57b04590b7e
SHA1bcea832e34a876c0b910bc66206e6efc3e9b77b6
SHA2560f9690d3893d992806aa97c6760f714ac8d99034ded49f534f1392d2d48be27d
SHA51282c195da68e7208d16b64d614153f9c964f33465f0f46e8cc79d70677f7c7fcb53b3e7ced950462768502f01f213ae2404f3803c59a2d42e0bae59ed97200b59
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bca48676d4c02cdb18c1ea4ac354e57
SHA12e6f592f88426d30c73584539f8a8a447f19836b
SHA2563012f019e78fa0aeba125c69c4ff9e834aaa6c69d4e374caf1fb935e9e79726f
SHA512ffd896492e5ef148c03a7cf342aef0ea95f1aad1f743b5fe9e3a7628b0a95f35edc7197e091485e45d1fa804f29461f11ad311f62b624fe84c64b1a3494f0daf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddf9bc3ac54383fcc3474f110d1ebaaa
SHA1df92e95c2c449ccda9a6d562253123fa7d08ab8d
SHA256ca7a84a782ce7736916b4a50f9067180e68ce36668b10379e18aa706169904f3
SHA512676086d32823586c34993eccbeb30526bf433c699148891cc3fd4b863db8188bb45b83079d8ddc8a356466dbc3c8dc129c404d87bb225dd4e967a1eb202ea780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8beb6e0bf380b632d7473487398f237
SHA1056fdec1b67a9e37e2ca337a52078df9b21c1760
SHA256790a8ba7c53929d358dd1aa5dcc8ce136a5409d576e4b85e2e356684ad6a94c7
SHA512a72312a25c7d233575d0b5cf4f9c3452bb35cdf44dc1673b1b8e5b42c95fb61946ffbdbb558002c64139a38df0fd613d86d1e31fba6ca78689b2a76a20b20888
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548886bde0c98699dea655baae56d88ae
SHA18ba2eb7f992b867fce3b9b9e6aa3cdeca95814d7
SHA256d5857cff056f235c8306596c923b2ef73dceaa3cf0bcd69db980588a67ba57eb
SHA51275766f6ffcc54093a9a842b0b08669c9cca63d53920cb4fb5a0714097b0f84ecda8d08b13652f58cb5504392889c7c7610337ffe8b638d3f24e8ef5c7cfc0652
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a78d362ab5756044a0760857498431b
SHA129546bbfce769f801e7da8d1ae5d862947ef4ef2
SHA256dab162d4dd5dd5204d1c963e57144265583e5d806e0b580adb855762735a8821
SHA512919a592f3b49edcc792c60a09ca7f1f17331616e1e00d78fb78af70eba41c329a42ea13b31ccfe972e1219c502e898538b7dd7f28adb1bde5ab3f95c71b35182
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543f850002929beecb5fd9de5fe81d8bf
SHA1f208f906828a5ac3b2014184b9eaac42b87315f7
SHA256b58ebf2738b7db36703f18fc4f4f4001014f1f5f2cdf3b54aa8d53b9b6267132
SHA5126bb5fa9e21f3a585421ffa19298e5b6f4a16de784c5e329e9a3243771e3392f3ee95909bdc9e800d325db91f7255436956f37bb531cd4612774a3ac2db9e774f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e3020c535738b6b82a5769c2c52bfc6
SHA11ae0c760e146f67ae5da8ecd7f4917dedd227047
SHA256b0e4c514225953501cc009b1f7f39824f5a11837ee11068547741883c24f5169
SHA5125be5d623d788eec71a6e6d45e8c8eb74b794921afe57c0f70b1d10fc12eefbb990d73728c360902fa9373f8b3083dc4283e1a37c6ed68af7b5d4a33ddc539788
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5987e887ef0d67edb45027f0d9b48e22e
SHA19d4e1129f10484fd14bc2665d2af89096277f464
SHA25606ca079d0ee56602f032ad6cb8f9074061d12f3ab6c7fba92bbd199f0137a048
SHA5127acef003a631ae58ac679d13fec46d66c35db69b6bee14204eb47ad6a303ce907c87364712d0f80b93db9929cc5a75bf42eb5f65b72fd5c4cad89ff5baa55962
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58709dc74d54362295bef5cc664174020
SHA198c40fabca50d31279f343214604b34004648a3b
SHA256e565d342064c73e61b09c1756eaaf5aea44c2386cf7acc2ec0646e6de7a61ac1
SHA5122a67991b7b2ab4a7dd1c38048dfd87d7c40ee6aaa21e992adee9881b1cd261f891bbd65b6bbe339dddb3a517e8004d3f3a6ed87089b3b0b9b2dfd7b8bebf401d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53904a05904781733321c88697b1ab730
SHA1557efa7d7a214d9e7c9f959e6a0f41301dbb51bc
SHA2560ab7bf25ae8971a5b8c5a52bdd0fbc3c644328618b3b0f72f2af3e11bcfd6bf3
SHA5128c583ce6157617799a930f6a2eb42394ae2f68d26c979bb413fa898ad0b7a70fcfada24131a25e51672380fea6ff54ef7990d628fa0fe60419c4e596d62b1afa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a4324a50898f0f9a85c43aeed693996
SHA1792efad6f3740f6668618567ce1085d54207d1a0
SHA256472ee3b7b60a53e3a4f04b8a47fb6ca330cea7211bbe9c20995979408e8aecce
SHA5126f6f703a1a3edf113fae616d18ecec2755c91a7f79f2c361f1e1ad5385759b149bb48e3a2ba7b9f82c2ea0080ac456344a0fd1f117b8e49b33250847d5b56873
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0108d70acecec5f4e4bccf6cabc50f3
SHA179fed2dde37c772ba6c68200a14816b56cc7775f
SHA25633309a5d7a96e2bc7f217ceffab0d7df8f5a8346af271b8ac716c8272ad81682
SHA512c86df05691b66ca6dba9388a672a93017c4f921f749c9581bcb235ee8c74653fadccf7d08745ab5d53be2a5a615dcc49643633873d36ac6a150a4df592968c59
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a