Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21/05/2024, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
.html
Resource
win10v2004-20240508-en
General
-
Target
.html
-
Size
8KB
-
MD5
1eb970ce5a18bec7165f016df8238566
-
SHA1
9efd1514af80fe14db4ed28e9bc53975b9ee089c
-
SHA256
70d613e3acfba24fd2876fcbacaf639e1e111ef4d54baf70761c47673f37d6a3
-
SHA512
21b4d800cc282ca452f7394e95d5382340ac3481a002c21da681005a44f18ea6cf43959990cd715b4657f180e0e96d6087fe724f3200e909f9fd70ebcd5511bd
-
SSDEEP
192:Ywnb1iC9OA9XXMa9kukrALQDUnulGVopLAGCALQD6vnglET31iCLL3d:7B8H3DUulGmmv3D6vglETliCfN
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E83CF941-173E-11EF-93E2-EEF45767FDFF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e00000000020000000000106600000001000020000000882adb8d84f146073860333b6b639392edf24e6c12a61dd4f7daf63ec400e1dd000000000e8000000002000020000000a42705a88bae3dad9f7ce668e0392b5e7b37a4337e819845ae55a8fb7badc0de90000000eb5f49490441c19432b4489da0665500f4f5955692e54602efef2ee31b1a98e41b09a02feb23c2cc75b37e2ab3a38fb3fd0be2b118fb9a4885115eb2dfdc7f623427cd48fc5fe7f4d75d4f584efb183f72454a5585baa34d3a37d37f96d326f0d692813bfc75649d2ec1d1f745dfcecc0b33ca8afbcf7a944b38c3e22a60dabe0f86750c1500b11c6cb347a139e444ec40000000b2c0dbdd65e0a7a6f39c9d18ffa379d82b47f18277555bf5582f5aa43c83427ac082fc07329c8ce6859bab48a85329c31915f482d85b6d3021cc4f7f06ca7cfa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422436310" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10dfc1bc4babda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002dcc56832ee45b40af0f973e997a3e3e0000000002000000000010660000000100002000000003df707bc01d420df7a86b07f141eb015981a658ae54112b3034ed0271f86cbf000000000e800000000200002000000080b770528bfc5eb294b1f3e45af508f36f5c0f2b2b707d05d13ffb31eae8a33520000000ce90f0ef4edd66e9385ad0dad9fd33261a67d85432434aaf6908ea333d89bdbf40000000180ffc39d9b4ee45fe402134a32fde8ee22cc805de226be8cbc107afa7ead62dc3927398eed47e111fe55430fccdfb7f52c821856935fec39c4ca9d5e124f880 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1580 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1580 iexplore.exe 1580 iexplore.exe 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE 2444 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2444 1580 iexplore.exe 28 PID 1580 wrote to memory of 2444 1580 iexplore.exe 28 PID 1580 wrote to memory of 2444 1580 iexplore.exe 28 PID 1580 wrote to memory of 2444 1580 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1580 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ee8d3922da65393965da73859b26c9c
SHA11b221246a81bf81f2db6818562f9cabdb81fd801
SHA256d5b690ab06d398cb54af83d855cca0de80ac4ca7dd79bef7d0e259036f2dcadb
SHA512cd98560453c1b86af2c38a07efa592607707d9fcc1a7717194587caef264c171eca93eff253712300d9f5b25187b0b2a44732ea88643f621150ea1ed8a461679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8e14cc7ad95a43356ed00e150e3c0b5
SHA15b93c033531a3c6a887db92f0fa3a3d785fce0af
SHA256b869d7f5012968152b352ebe3afd8a3d55e13e345812250018607ec7fcc196c5
SHA5121ebb6fd3594c5b7d9e8540a9c1e9488fafea0200c7c6c0f2463cf9fda0fcbc876dea21b508b95d615a8f70982a8b0c99359875c854d1fabfbaf1917e0dd89c88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3a1f5e1b1e839b6d68e9678dd501aaa
SHA1b6cd3ed3aabb1ddbd77e960388a71390460fa2e0
SHA25637547235b38b785c2bb7133a17c151d1bcb66b69eb511a54491c52b4cfd04f8b
SHA512c4bde1b177eae6860f85d4c7c9fabde8092a50f421fba415c158011fe6e64d71fada52a33bac7df54cdd6e15b9aef378a33ec38fa9990dbeee03f1ce8d21f384
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582a3b4cfeaba6e92fb9189553167d706
SHA17a91a93dc7b9cf09a886df8f9566ccec5d32c929
SHA2561e1aea3622dd6c9accb37161cfef982555ae65ec0415806556b1562f7ba3e476
SHA5129368ec82b8fd8a432886b103e6655a32ac770f40d5689e6098f77aa3a7134ec443e4e48a234c4f2597d0a1c2775102a32526f696acb8acd4f0f3797df50b3b51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4ee2564c346bf93eef0133763013aa8
SHA14205c3177d32b7b00b729ca874e19cda004af4b9
SHA256c2ac9c4b963d2c7b4550f47c346245d8acb1f5a09777a85d0f069d85d7bb2d80
SHA512c44525cb4613a44cc7896d82ad56aaced070af6b1c68b2af5b42f75915671c5487b0749bfe2b5ce6b8fa5d0a66275fd5cc562ef93acdd77cf2bb811e9df4c8ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51573bc326bd8859f61d33a60acbc4d61
SHA1adbfed2c34428c86deec39a82ee4c9a2b3ba9ef2
SHA256de76d352c43346c3076ea7096999b050014e0420c789be49bbe8a6c02e7ccf03
SHA512744028fd5f78272cde871d3b73afae4c28942d2ea8df2c2827c7febe347d7cf20922428a78cafd55020af5175d671986efa62e379ea6dab6e2f0bafa4530e816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5924e2da6b23207ca5b61cb5a50e7e92f
SHA1865992c798d12d61ef354a26c535f2cb096d8987
SHA256833ca0e30fab2403866dd3721f10a6e0791aabd7996f008266eb6a0a519f4271
SHA5125852dafe4804e2d7f4e7d82b8322d6a22f51f749cfaeaee71c14c24d21b85888f04ce932c8283b8f695dfe1c2da4b4bea7ca81c3254753847df816719209d9e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f8821b20211dbb676a99bba0a5ab367
SHA1da0677e3c60681c9558e3d83a4a5d3342f88151f
SHA256533fb18673ab4c0fd2488431c5fc53fd449b585815ef33fc23efc1857dc6fbca
SHA512aaea12b90f4fe2331b84803d0e0fb3825673cfd171f6f6bb9954a409f1ce1cf062426d310d681a3f93069b2569cb7e95607a7781ef215aba9717264c493441b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e680cb11136e2bd62f38d82de8a3a085
SHA1706ea91aaf4d2ada211aa6f3bf045129b15be3f5
SHA25641eef17666170c3afe762a23bf42ba657d69350ee18e5faa931452afc24fe73e
SHA512043d8b9a22637807aad88166b0adfc12f853b7e232758162c310457df483b86293ab110618aa1116c55279318f02617aca34567d2e115852cdbb3607089d24ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54611d2e34783aad9b7c68737c07462ba
SHA1d24c7dfded6111339306894cfab36e684407c7c1
SHA256a1738ae31525a9c5a98f75e1f9b06064b560bbe399b4b0d2cedb7b37796eed9e
SHA5123d8e6973a8e59469dc2e9fd1762b81a49791a566d02da8fd2ddd9e03d07997030b9ee0d99c6afedd4363e4792016831f4c83c977e3b63d2d26df273c4ac0a6fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52274611d4eba2981bcf867a62dc4dea9
SHA1acd8ffb31c355eb6fbe8beef4bc91f30be9cbde2
SHA2563bf55716d9028d2e57c9075ed56ad6469ddbfa8f31f579dfb6544b6b7976079a
SHA51278bdd13a418ddda23891645de3075aa568d116100f38fe4d25e5a43145db94ed847d46f8adc9cd4b09dd3af8a181a1cb8b573bed806b24eefb2372a845b8c30e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4e8c81c7d42e3fd12f78c0ed235c161
SHA112c5f0c341e064b4016c0d385b26b096012f475d
SHA2561ac26f2f91aadebc164dd5c459e0c7e784cd1e00423dc8f627bf652c9f579a6e
SHA5121648272d701ab222a3146ee0b10dbc35f7e048a8d067c963da7b8f78d2e3389eb0fe47f99c1cd6b97695d36ea6d6d3ad5ae6af3ddf14f4ebc4247d5e037a4a61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f9031c64cbe2a9a36d1d44ab8aff483
SHA1ac21e199de5d2c50044dda0d7fe3824a37a0c879
SHA25696f4323efb088ae9a4061a02590fd5d83a9a0b233156fb4b6df5f2151c53b235
SHA512b01e1a4f8703c1565c18d32a8908f555366193629e99bae48ac2ba8a14ea366b11a30b21f9ed25c34b132f6ecdfc2f361a8a495f11cb7e5f382172cfa24e7e24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519f430a7e41fcd9b778193b5adfdf05a
SHA105249f3ef7a009fde12c345855eaea4ab417bbc1
SHA2565135f682a4f04099a0339756d93613ad3adfe945a52d7178522571ce688ca50c
SHA5123d837bd411f03b8d29f8cde711cd419a6db1edc6a7cd55fe03970abfbdd6670bb0b12f32187af1bb80a612b999ca6a89b82cb65dba3838310219eb6e8a0169f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e92ad0da7a7ad8d9e72b873dd34884a
SHA1461988ec27bff8d71f0c532784870efb41637d6c
SHA25697d4731361b99e2effd147505c7de6f3263ea69f550642b169dd4e8c34e688fe
SHA512aeabe13711d01b2c5dfdcc8ee999b0c451d7ef05fe8215f336969a0970143745968c94fb5944a0dc189adc532a9f026e8f330acd878e0f90e99c1e3cf16a9461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534736a61d56f971f60760ad1fce963d0
SHA1a6488fdb63258745a5662ef20dc78173941bc9e0
SHA256a5eb98c6f50e403f373d909e440188315f723c021a4a5b177897fab4c750bb11
SHA51253744a61e3b3983f4f274b79549cea6bfa67cb0fafa8421c93451e0d08c86e5dd11888380a3efc68d22e035ff2cdc62e199e4799dfe08164d532326334ee9852
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4fb4a37bb5ecf02678918f15fa6f161
SHA129a892088c1653e70512386880c86dac234f15b4
SHA256dd21b3cc652f6c28563271d181e502338d52ff74ca1d14f8fa8ae3252ee65eed
SHA5127e3b752aadb227a2800c295335088b6a14158f7c6c5bef0da90f70a6c5986c5360ed43f8900c91ea07dc9b3e722ac9c590f4adab92b026cff3eb6e933151f909
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a