Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/04/2024, 01:27
Static task
static1
Behavioral task
behavioral1
Sample
75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe
Resource
win10v2004-20240412-en
General
-
Target
75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe
-
Size
4.4MB
-
MD5
3eea13d1e67073bfcb4921357a8d35b6
-
SHA1
8590d071e20859be185e2fe6d6f25031faa0c34f
-
SHA256
75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008
-
SHA512
4fedcd5dbcb3de5e01b1350c1d0a9ba84887e932da7bfeb08fda61bda15a1658bc2357e7e4d708388d57649d1c62af92c5ff34641be3647c750a30dd75c0e92a
-
SSDEEP
98304:y4b2z4rbzKrdSZI6Iwp9GuOgC/Y1Vb7+f1vNXuiDID:vqyqrd/gpxDC/YbbsxN+iED
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000045a25eccef0b283589baf5db934dda2c00e8e04c1e1021b2f419e8767f2ed7ac000000000e80000000020000200000003d944d71c4c0e19a548a5407492654adf317c7d4a6c7a0aa8b749ff4ef287c9e2000000047ccb590a4d5212c99ed326b4122121c04f906a6742ca647592fb301a5caef83400000009d12738110f8e37e36f67af5e4a7b20bd55aa9628757e5f77e34f429e6ef8fdad8fa9bdf6c43d18510bbd6fcf7ebc97391b1de111585725c6ff20c8407840f7f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b000000000200000000001066000000010000200000000ca08aef858a21f7d4b8af22c1d71298bf284e42add8e70e71680eed03da0159000000000e80000000020000200000003b2dd91aca01290827644e8792494f5175d1e4a5c5d87fc9a66ff8dde602315b90000000dae36b9b73d89bb2b52bcea40854831553a4f4e4758cfbfc726ad078bbb43a70da6d83936242781d7e2bc02c1eca623156d3b5ff0d028e1b695060d5ed0fd112020a6823b0ddf649ad4575e77a2a409a90b8941cea05c9f1519808044938122185caebbdd4501fc4b170ad1f5dfb69ccd2f33c3e91289254ac4c68376ddd0ed4678b6930f3853a6eed2ee5ba4e7304cc4000000061ce003489ed56740dfc5ce6f386964f30c53769d50eef629b96287ede144036c6d6d336b2741771b256b39ce2b09e6d7a39ef7b004f2ff0ddb08d6930ac0b1c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "419997524" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ec30841d95da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A934D091-0110-11EF-A6D5-5A791E92BC44} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1628 iexplore.exe 1628 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1640 wrote to memory of 1628 1640 75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe 28 PID 1640 wrote to memory of 1628 1640 75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe 28 PID 1640 wrote to memory of 1628 1640 75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe 28 PID 1640 wrote to memory of 1628 1640 75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe 28 PID 1628 wrote to memory of 2776 1628 iexplore.exe 30 PID 1628 wrote to memory of 2776 1628 iexplore.exe 30 PID 1628 wrote to memory of 2776 1628 iexplore.exe 30 PID 1628 wrote to memory of 2776 1628 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe"C:\Users\Admin\AppData\Local\Temp\75279d0dd3780020e38b9222cb4cfbdb9ed4e60a8084de10a5358374cc70a008.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.ni.com/rteFinder?dest=lvrte&version=23.3&platform=Win7_32&lang=en2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52170ed7962760a3d9025f6e22b50826a
SHA132535b7546cf0aaa40fce2b8485e9ee04e49c44a
SHA2567de749ed73f50a7b528d182fc3baecab835d663731e8b4ea7b0322db5d68f6ec
SHA51291ddeffe5ff43d1ae0a282cd336f64e95dafcba05ea5361536043c285db8097aeb01519dd1018a2f1a2ee984e07111d75e537c47ca78bb60b4bc444f058497d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5096436f1cebe4f58512210ea327cdcb5
SHA1dd990c7e4a01a4f27988aedf8052973466f01219
SHA2565767df36e84300b7867dc8181b43cfb5dd60d5fedc81e7626fefbcb97ea00f15
SHA5123702562626e8fa925b782fa4a935826a04012cbb7683bf6c5b7b142b1b776dd37d37d73db5f6cbd0f5b117fb231d8d3a716b8c880af942ac92aaab9ca39751bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c4b1abae04a5778ae7d8dfe734e556b
SHA1e1854a847be31177985184412bad1029cc51935c
SHA2568490a1a36647ef8751861d1d4bde1a55034d0e65142553cb90c7019b7cb3c52a
SHA5124b5c80637c49d570af18fcdef369620e936d0c8bf5f68a72b31cd2a150987e9e1da998f5bfd6721c4dce6babc4251532cb498f22d8bb1743052241b77061ab5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52821404a286686b546e2aebeb3e6fe8b
SHA15d6509674871f637f0858516701e48371940a102
SHA2560391bf093412e7825222e770a28e255d549cf23d68c037bbacb920a9e5792354
SHA51265a7713fe5af81b17142d51eeb988b205cbc03e3cbed8c9c765411f6022089486f66b70a30e6af8b72790e679af57dcb9a8d80b824fb7f86470b1cf3e704a23d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ce2d1aa6537ff3b597810bf3ba10fb2
SHA1cede3884a13b72d93a9e9b480c96de4e4e94f62e
SHA25692223995e492185c3833964400e2d75ba88413eb97b3f806d869d58094952a01
SHA51269fd2cc5bdeb35661074aed3db5d26298ccf0893736abe3dab2c5db74c66c94b6a5dd9e0b344cd4585dc0598db641cb6ed8e9e15f567170fea9398b8ca14fa3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580b1be255b6aac8955ed709750d47834
SHA11bb94f70b2e25b465706b9eb5295d02dc3f3c53f
SHA2567b0cfa756064944372811e881db7f3b6001a591c54422fdea70ca9bff5a6815c
SHA5122a08518877e20c6feebbc1350b0f7c17c6bb2ec017fbf591121d5fe0cef2c54cc5fd493480bf070422c502ebdb34046e2dad4e555cd522ce67ad72a0b6e09480
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567962944fd1c344fa657727a16de28f6
SHA17c0a59a0b84570d470e24554a3019f460e5cdd6f
SHA2565703100d3514b45663c5095ce3f02a1e7331b443e8aa8be28edc9d2644bd105f
SHA512df7b0b6fbf78c025e86e05febda7b652ce60e5bafef476a334f508b3891a9b116446dd862a9f0932447a22bddeca664cb685e8e55e771367b8023e05d95cd930
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5005373882bd8d6ec7f4563e3b436818c
SHA1c24f94c9c93e914824c1e6cc5b15c397e247275d
SHA25680c676fbe26d023fa98513b3f2d5e454125fbe908056799bd643ffea66c7a768
SHA5127a7966b26c6526b6909d8f61b23322e86ce9d61a454688c516719cd966c2071a3762cb66b8fb77d43987035f34cfec2d3ce3a131a476a56195ddd506c4093ee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a581ec5836fa2dc694eb291dd3a808a
SHA162db179857975856ca5068baaa426d3543eb45ec
SHA25654a969b9b55ed1c72ce5b1e0b8b1841eb420ea737785624020539ef8d184b497
SHA5123e47b94d8e7816ce750b3400e1d2402b64d0a05ab13c247ce3b519816598a757978e0462e2a4b1d8702c21a380da9569f391e4573286ea46c7aa35e69c164e54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53284f26aaba4fd5e5d281abdb928cc6c
SHA1cf083a6d7756fa2eb49f54b740bdfd8a4ca16743
SHA256f4f80bffb6d7e6308122099f60f521608c9b38dde2108dbadb6012192d233d7c
SHA512d76039058e0841e90e52d06a40cf2dc6bf078bb9aae37c7aae3033ba5cdf50a3d7a38610ce1f8843fa357a0a97e39a806734a338040d66e833505ea06590808b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb07f546953597867b0e499d2db9738e
SHA197b443012e0bfc4747d0ebb8e418862f00942307
SHA256cc640e158fe04116d981aeb0ff8dd343d5450c78df8cccb59e5d888d9fe3e5b1
SHA512744aa7c33013af033765c29731e32fc13214c9eba886035c31e356c19736de338b30c4810d4219f2260577d785c0eb3733874f24ba152855e3b23f30ab7c9fa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59429a21980d224960e7f957eea4282b2
SHA1f540aea600994383e1130b8d90dffc51af5cc08c
SHA256d6e82db4b218cb92f526fac47aab1b1c1d137f52e23d8910d1223ee5760a1833
SHA512d1df5ec0ff9cb24b9034b3549f6a9fdff7ca482163b2eb7fd9083434f5262ab181a7c7893a052a6a4479c59f52cb2b9598c262b3e299286af175a2535d9a72f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561d79882d4d27a50630148bd0eb67a0e
SHA1e4fc84f1d52913e42652a99f8d9656d8e141f3bc
SHA2563cad52493c606f19d7ec2e7525df48e521045acec98fba5dff1ccfed82fc5416
SHA5123602602f0447708c7d3f06cc2710e311a0dd8073aeee336200fc6aac8ae3956ca13ff3fdb733f6cc089febff543ed3a372415f44199463a46390383f123ed9c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57322ec73f835b5605e429e3409866e8d
SHA1db28b2e370de016398cf3df3378fd551c55ba7f1
SHA256a94e5c7ab18d7f0091a4163e7094b5167e3768d70f2344603ea22b1936aab0fd
SHA51217d3ee4031237f1131f9be63859187687ea4ec2ab79d3a5deca2bbbdd3207afe891b82b2e4d1277bb3ddb6a17c108485f8f296389942aa772b8f7ac2247b680f
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a