Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
1OEBPS/00_M...A.html
windows7-x64
1OEBPS/00_M...A.html
windows10-2004-x64
1OEBPS/01_A...S.html
windows7-x64
1OEBPS/01_A...S.html
windows10-2004-x64
1OEBPS/03_M...A.html
windows7-x64
1OEBPS/03_M...A.html
windows10-2004-x64
1OEBPS/04_M...A.html
windows7-x64
1OEBPS/04_M...A.html
windows10-2004-x64
1OEBPS/05_f...1.html
windows7-x64
1OEBPS/05_f...1.html
windows10-2004-x64
1OEBPS/05_f...0.html
windows7-x64
1OEBPS/05_f...0.html
windows10-2004-x64
1OEBPS/05_f...1.html
windows7-x64
1OEBPS/05_f...1.html
windows10-2004-x64
1OEBPS/05_f...3.html
windows7-x64
1OEBPS/05_f...3.html
windows10-2004-x64
1OEBPS/05_f...4.html
windows7-x64
1OEBPS/05_f...4.html
windows10-2004-x64
1OEBPS/05_f...5.html
windows7-x64
1OEBPS/05_f...5.html
windows10-2004-x64
1OEBPS/05_f...6.html
windows7-x64
1OEBPS/05_f...6.html
windows10-2004-x64
1OEBPS/05_f...8.html
windows7-x64
1OEBPS/05_f...8.html
windows10-2004-x64
1OEBPS/05_f...9.html
windows7-x64
1OEBPS/05_f...9.html
windows10-2004-x64
1OEBPS/05_f...0.html
windows7-x64
1OEBPS/05_f...0.html
windows10-2004-x64
1OEBPS/05_f...1.html
windows7-x64
1OEBPS/05_f...1.html
windows10-2004-x64
1OEBPS/05_f...2.html
windows7-x64
1OEBPS/05_f...2.html
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26/04/2024, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
OEBPS/00_MAQ_CUBIERTA.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
OEBPS/00_MAQ_CUBIERTA.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
OEBPS/01_A_PORT_XERAIS.html
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
OEBPS/01_A_PORT_XERAIS.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
OEBPS/03_MAQ_DEDICATORIA.html
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
OEBPS/03_MAQ_DEDICATORIA.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
OEBPS/04_MAQ_LEMA.html
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
OEBPS/04_MAQ_LEMA.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
OEBPS/05_furia00-1.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
OEBPS/05_furia00-1.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
OEBPS/05_furia00-10.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
OEBPS/05_furia00-10.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
OEBPS/05_furia00-11.html
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
OEBPS/05_furia00-11.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral15
Sample
OEBPS/05_furia00-13.html
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
OEBPS/05_furia00-13.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
OEBPS/05_furia00-14.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
OEBPS/05_furia00-14.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
OEBPS/05_furia00-15.html
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
OEBPS/05_furia00-15.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
OEBPS/05_furia00-16.html
Resource
win7-20240221-en
Behavioral task
behavioral22
Sample
OEBPS/05_furia00-16.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
OEBPS/05_furia00-18.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
OEBPS/05_furia00-18.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
OEBPS/05_furia00-19.html
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
OEBPS/05_furia00-19.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
OEBPS/05_furia00-20.html
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
OEBPS/05_furia00-20.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral29
Sample
OEBPS/05_furia00-21.html
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
OEBPS/05_furia00-21.html
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
OEBPS/05_furia00-22.html
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
OEBPS/05_furia00-22.html
Resource
win10v2004-20240412-en
General
-
Target
OEBPS/05_furia00-11.html
-
Size
9KB
-
MD5
760d63cbe38ea582aab6db2185bde0db
-
SHA1
56e19c198441ffef0fd3d57d282cf1e05a7697b8
-
SHA256
387c0ca321935733cfaa69d79bf7544d3a45b2ff106ad72ea466102816d17e88
-
SHA512
2b5ae2339ea67563896de2f9cd9b7230566eefc1a4897454f850bb66323d85845ba819b7e02452fa3d9ef076fff2b2747a4494a140c31616618101a4d4abc667
-
SSDEEP
192:sexJ+vioF7erFZ39ed0QYWKjfhF8kwl2Ic/5NS18:soJ+vHpgrNeyrsAIqx
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a9606900000000020000000000106600000001000020000000dd2150e580b51c46cf5c7734eff3d7a9812f6018bca42eb9f56b391f00b6811b000000000e80000000020000200000004c9e89c90beaada997fe01408f03a316fc0602d8c2589a2bcdafa9a2b9a67e2420000000f3f5fdf68ad45321ee44c8b8bb6c19f7e4580f2845c0c2ec10dd246f9847235d400000001b7420f628999d9a2304f5bd7e0ff3b9fa6e4344b183b54ac1881a10c2c2a7e0cc333c139962864cdd0a47f44192200f3b1170011a9b02c9123b90272aa6d9c0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3B3F061-03B3-11EF-B991-7EEA931DE775} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "420287561" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0ec2fc8c097da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e861098c19b4244d8627ee4664a960690000000002000000000010660000000100002000000047e975ce2456f5c767c69f7a4f651f7e9f743c34e4cad41fe4622d2f941c3f56000000000e800000000200002000000010944c93ef53abef5d05c8c19761aab56a56a0ebe2b58411ddb3a8c83ba05149900000007a1fdcd415c62c8687ce22b8b64459c35baa989e5f16c88e2f6a3ff1a88aee647bb384fe842a2728536560263eab99c0ffefe56d8872ed8c072419ebb676a37acf3e7bd171c91ac141d2920ae9c7d0dede6fc268719ebbfe092699e0fd74efa72b34cdc0ca231406a8dc82a293d38b17125a78b740c5f005e86c0c3898c897234adb265e48563d094a3d45b25fe38d874000000027073ba7e0120b6175955704985b163aa906be4ff3ae7d9dec5cd33ef55a3ffa79c8e71b4e011853465cf5367f1513277b4d830d1dc94b1838b3b7ece20d1e28 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2160 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2160 iexplore.exe 2160 iexplore.exe 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE 2920 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2160 wrote to memory of 2920 2160 iexplore.exe 28 PID 2160 wrote to memory of 2920 2160 iexplore.exe 28 PID 2160 wrote to memory of 2920 2160 iexplore.exe 28 PID 2160 wrote to memory of 2920 2160 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\OEBPS\05_furia00-11.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5790b2d530e3e6d622b0169a13c2a2111
SHA182a782f8bbc66698c5476d4ae6e18a5e7398d6d4
SHA256c072cf0996ff53abbd960fbdaadf7a3820e38c3d20861fdd8170b8f604f13547
SHA5125859f7f33e79ffa1a7cbda3f7fb8d8ff21b1e115307d00ed5ec02bc3ead05b2450dfdcfe9ce388d3c2249f483c4f391aea0651a5d75b6ed029cb7b189f64916d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574dce6d084f4c238f26bb58209c2400e
SHA1435560f7a4f61ceddd0ab14784a14d565e560157
SHA2569bf1afb235e7d8a1ad8b1fce97ee8b796d2108a18768fbd0a557777fd7a485e1
SHA51272b7ab53c0c39c9f831d53364bb82afed95715830943d9dab516386b4c7cb6937524fec2c3dd05ea78cb69327f4b9606a0dc9101192f3034016d25dd18788451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec54768f0ffa1c749393e087689fe791
SHA141e5f7a15be4d55614bb9147bde3875c36156a77
SHA256a3d11853fa2e92f2d6d44ddd5dde2cac4fccedea1e77edef0b8d90afeb2c5fb3
SHA51264316a52e63bd7947b8d826a6adf521802671e9ecad42c0a685f392ea26522319f45e40fab43662b504e7f6cabfc756b9724fa12f0e55dfcc2568c49113ea26d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5292c5bea8a634dc2be01539e04bc98
SHA1738d2248b94cb073bca81ac4292eb52050adb8fc
SHA2562fecc64b4df67bedb5790cb623d0735e00a670ebd2e1265372b4ca8b8f51d714
SHA5127f8c5814dd8e92b3bc27788bd576d16a5e3c051a7b843e234fb2488fc4fc2648ecc00250d11fdf68d7f10c125bd819346e003049754f90477a42aa47b643a840
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a