Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
2fdb2c13cd8e29ee9506d3194ce3867402943749e347579374d7339d8ab5712e.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2fdb2c13cd8e29ee9506d3194ce3867402943749e347579374d7339d8ab5712e.html
Resource
win10v2004-20240508-en
General
-
Target
2fdb2c13cd8e29ee9506d3194ce3867402943749e347579374d7339d8ab5712e.html
-
Size
1KB
-
MD5
1cdf9d3c3c0042bd4d12e0d60d0dda54
-
SHA1
240c91acc59f87cbdecda2348fae8b930982dd95
-
SHA256
2fdb2c13cd8e29ee9506d3194ce3867402943749e347579374d7339d8ab5712e
-
SHA512
59ec45188638d6d3c052619393fe3176fcf984a207933f964491fbbed3d4a3365de2ff9a26d472b4f586c2d3be2efeada14523dcba968e7b374f226bc7819afb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003a2ffc39a2da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000090391c2d320ddb125076d163ad7aaf81ad0b2758d85224c37226c99e448bed29000000000e8000000002000020000000e034cf0e5f22c8ff04b103d3bbb3937cd8044663590afe5f8d4ed4ac94e1362590000000a7e662f0099d391aa5199373d2f54c7b05462644b549f6c3dfa3e6723e96c4f36e518310fdc1a27f47163ef719dbd6b6a7b71a7d2bcc40901f186fd942d5a694b9227f3948ec902745ae3009d79a5ce759b439fd90a0a04222c18bfabea777d100a744adbc193c9ac82e61f67fb382f3de5b60e597bee2c9b5cd6bed193261020d5fc3a5dc76e523cdcd92a37dd8cae040000000911507fe8c5b11fffdfa9db3fd62acd161bbc71f87bf222e520c983c46f7e9b71cd59f5a681a77bb746ccdc7269fe50c82b9e7b4b691f0ff59a711dcce0c0365 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421439125" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000808282761dcbff2fb0ee49f9c811c63893189b45111a525647fc7f5e72d84c00000000000e8000000002000020000000b94a1b03660c17a47572c4c82d5cc3a16c40b97c87279c54869e22423545dfee2000000095021e4414c58380f40cd2ea3345139b0aab4ba291ae4aae10aa9973a55c5c5940000000cbed11e895004d4b322b8d7d1380dd3bd67d721a0e416a25abcc798df83f6605d78a552fab13afbb0c626298d8020edac93e40737e9a5d678ab7fabb6aa013d7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{26DB5401-0E2D-11EF-BF06-56D57A935C49} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2068 iexplore.exe 2068 iexplore.exe 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE 1056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2068 wrote to memory of 1056 2068 iexplore.exe 28 PID 2068 wrote to memory of 1056 2068 iexplore.exe 28 PID 2068 wrote to memory of 1056 2068 iexplore.exe 28 PID 2068 wrote to memory of 1056 2068 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2fdb2c13cd8e29ee9506d3194ce3867402943749e347579374d7339d8ab5712e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55125d81a3706964a1b3e34dc8cc7bbc7
SHA1f55ad6db503b300e732be92785532d879074bea9
SHA25602d533b8ba2f8536b087aa0e961ff51adadf58dd4f6d0e1b90c0981c16eabfb0
SHA51286bc132d8c424c064f83b5beca9d06756bccc2f86dd083f5f213cbe0c235bc0bf56de70c1b9475ed6ad15429d91e5a2053d45c51aa7e0f72b9ecc6cdaf650434
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529ec925c5f6431fcf8410a3108fe276e
SHA17bf6869929f6ab52a2ac99bd56623dcae73831bf
SHA25683c02822f780b965b15f11be2cb3da05151dc442af1caf2d5d89ff8fa9049f79
SHA512da7305face98d198d1102f3fc1598313bd20ef6d8f967ceae00543905255f8dc83dd2aeb7705f771d640c48cc95dad069ab923784fd4763768066b0a86e0f63d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eac28078f28a6e266c8424304eab67ad
SHA1f9a611391a52109ab9bdfcc0e9f35290b7cef4b8
SHA256cfd369b39c72bd8c36f1391b5bb7f248db485ab32e504411f9a4210bddc66c3c
SHA5122bc8acf8f82b2c79d469313cf7572fb0a9f9c127b5a05c513019095426b9a05589deb1a7e09b326d4cbdd2a475b5f7208692df2ba1a671344906b894caf2bb93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bb8fcaa6df219011b4d1f6875b5f818
SHA13edb396657d6569b8fe05bb65cb0a13a7ceefc2b
SHA256ecc663f4e3e459b03182e90b4c9f1849f1a5b4cfc909396df15bbb97a252e08c
SHA512d47d0e863013c99a0d5b601dedd7886f4acac60af8998268251cb58b2f8e6166c86809b30680789d00703b7d9f18468f4649f89e587b38fe693df14f217e6bf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5308a803297d37e7dbbb8549e1cab569c
SHA191c9cceeca35e2a0f6a2155edb7a6d7762c3d4d0
SHA25605fccc7557508e5c7c616128f29acc1f87104f7ab561d73f44a775391576baa8
SHA5122dd4ce01220b48cdcc6531833cf5cf3c33a98745889a06c0aae4ba67d96bfd8611dc949a6dcaf05fdb92b317a2e0b02daccbe6cd0dacf742b87bff4d7d66c7c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d68438cb0366c88dbe5478da55daa68
SHA1601520593c60040d614bb1e0736449e0cf657ae6
SHA25675ed5b5f8e2c4cc0ae9101d6330699000f0fefc5e15063db71d0b34e79ac89c4
SHA512926b54010b063476b0832e46db648c02df49ce2106244237dbb92aff5b2d2ffa32b7d6dfb5847e8c15e187e4303773d090cef7f8603b423233a7a784211b9e61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588d00828ee0e4b4c76de71a39488e0e6
SHA147950807e94da8a98e22e7a8625cc84d9e80eba3
SHA256750e7c788efbbb65ce6928e838e03d737ea9535dffa636e43cb7a19e4f48578c
SHA512ed34646e4ac85030c36b41097324f2a432cb700219c5ca45d3ab2a490c004a5a71041ae1db85ae0ad77af368f06422c3da4cedc7efe063719c66ba09b132429a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568b6cb929ad1c119b11b8a462ec409dc
SHA14e10eec9c54595322a00bb1b2d7b0e6fff54e4f1
SHA25687477cdc000466461c640d462295f9c7686d1068ab8abd34fce5c983d694de00
SHA512990fabcf8af6e310c4072bc3fe2b365dd5918ee1dd2e327392f6343525a164520bf9bdf66f477b9d5c2b3f962d6806160a8fb81792eb8ed32b3d0fede402383e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5599f0d9c72edc534c1e6165a3ece517e
SHA19f0d932d01c6704f6454a18bba5cd0e5724b2af7
SHA256f1d80b6c7a84f6c13fba72bfa73123a7185cbc593699c741820fc39534ce7c4b
SHA512ccb7675c5a80d9c365eaebb22190398f6a784f57dbba2e10625c73bc682651c39e9e00cd60d738f4b172db5c280f72fb1667ccf3c0e32f91a0291b05c70c694d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d348d374f1d3cf298ba736e76abfd5b9
SHA1f982f5a6433f5bfafca0a3f617485a49846fd6e8
SHA2565d0f1a8388e2b281ec4a4ae38c740934e3be31a4ba71d16739bfc72aec46f642
SHA5123440fd6765becf650c280924f248418c3bf224c46ee12c3339fe4f9d53fea3750d17817673267811f7ff8eb4861de09b1cb98f142ce122dc53b7500115950970
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5198135b638851190c5d59ed1999503
SHA194fa7d1d9a3a718c66ade4063088c1eb52cbc4e1
SHA256f7ff000bf88a0525be2371352c60941d2a70d118edc3f7f5e9908793b8e85d0f
SHA512c4d53a969a2c37afd7a511eb5db31b05cc848c28bbcf5ee9ef08d9f5de4d6bea518e2689c5cb4a3ae89c201f1adf96aea86cd1f4bec3f2477ba503a4eaee93c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d04eecef3725c2ea3bc67b6efcfb3c88
SHA15f8e4303bd00f4f22c01cdf46238e03cbb5ae4b4
SHA256db72d7b9791e0581ec1348c377186b1158a62c8f92cb0686ebba372a499dbc28
SHA51228ef70fadd5d25bab2b6a65e94505c8f48a659a505316722055c1b1681fcf9fef3e5da2a4732b6024562d1ec16718c9407e6f1c0ecc25460434886a95b44c9a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555af678ce8217e1099cf07482f035d83
SHA13a3f9f81331fb5a62488f2c869161026c78214d0
SHA2567edba64de012d02e1e8644cf46fe1eccfcb1c67745d0f41dbfd846a44240983f
SHA51271bb65f05d944a51d12674bca5a8351f3a35c92d311ac828159048ed8efdacb22b5c46a12ca36808d1a6e1f2b8d70aa18924aac7d6654146f4e88e2200eec05a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57655a59b14cbb635fae3e8041be9f8d0
SHA1b1fb6ed755846900df14924d22512192e37f793a
SHA256f9bb44db57fc7b84d3cd84e9092ffe1fc5cb5dc17d9741158e375aab2277ff80
SHA51233be6166dce4e9663e7d262bdd6bfcd2266d3ed50b4ed92f0e7894cadb82b7abd78c0df8dff57e0fa899b97a004a64fe92fed31cb032f221ba5913a343379473
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5992b75c803c39bc6030c5177adc8e132
SHA118f6fec8781ab7b9e3770adcde2c4937d14269d5
SHA256dae9952243b23a6fd636f7fdcc82193cd7b8429c0eda42d730e818c104516302
SHA512a5abfa77652e96cdd7e1faaa86679aaad2f014f7833fc18857214348eb595cdbbb1a54cb11860e6bca2670c3f88d3a92ae90f4e34aade0718cc72c5e7bd3304c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578e86fa0f2afa28a98efa9e9bb692e0f
SHA1d2652a723d4c979f74695674d4dcc6aad558c513
SHA256eae9319567b9f5106e9f1ad8062f9bdcdd49051ba1334fc7559b85bc454cf45b
SHA5123ca6dcef449d1d5bb435fd3fe1e93c9c159655ab1ac04066f7fee16182304c1f0f06a5875cae7b04e1f64273bc213d43ed3aabff893fd631840ef11d57a1aa08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582abc6701fec5ece671b98ba444b375b
SHA15cc40f60493716674657ec363dd44b305bc85206
SHA256c0cfcb6bc073319c859bad8d829e80c97c03705a4986e877b709af5072e0e7d6
SHA512e25ed28268eafaa1592d2694233f70a6da3274f615f61f0f28273426fae2595b7d7607bb1b24e52ffc3ad2386765a617e763fb53588c6eac5e8b33f6fb2faf0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541f0f39bf1c40b49a12fac3a1592dd44
SHA134147145c6e0997b167ad7ae69d93732b1d23fe0
SHA256dd8375340d2da926a98c0b37b60688c70827eceab1414028fa06d4d6166f63c1
SHA512fad6be20607f65515f60164f48bebf260277439d0afac912bdadf0776c0d825a40e345c8cd5e20a881a95783eb6d03700ea6bd8d298c2441466480ed81c6c078
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a