Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 12:35
Static task
static1
Behavioral task
behavioral1
Sample
CallCenterApi.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
CallCenterApi.html
Resource
win10v2004-20240426-en
General
-
Target
CallCenterApi.html
-
Size
82B
-
MD5
c112e24ac692f947fe6e9df8af1d722a
-
SHA1
5183defb754833bfa60514cb96a4532d323c5ffd
-
SHA256
e13589b92f2c6a484ff9f61a5c0eae71af9dc91473baba2051fdc12eb4687948
-
SHA512
810db12a725d9e11c77eb11b00d4480ab0422efd071215bdf7f6ee777d23ead0dc72a017a5310bcf14b9da3c05ed93fb4ce6151c801294b1fed5dca5722e2cbb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000ba050e40fcafc739fe04f8089dded5f5183e071da9c21b2f430304816457ee6e000000000e80000000020000200000004d2660205081f05ec07d1a082febbe0d15541d32d11ce4d30e0a6a2acf33f452200000000acf1dd8109b15da1b7c5d16ffd18fd9686e75ef57e724769458286a343b4caf40000000756917f3d8244261a8b5989144796530c19bb9e7f9d2477446dc130375bf4b8faa90d85f37f92b6ee4cd9e238d957339c503d329f8938afcd504695feafa5a21 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422975192" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40c57f6b32b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000587104b0d2f7da409208cf3ae9e77a2300000000020000000000106600000001000020000000d2ae9b43121807887630acceb2db0cdc30d0041ac5d4c8a1b68a5122a724f04c000000000e800000000200002000000084dc50f4b9e2e999709891bc01be7f60c37d20f18cdb309ff374ea3355fe86dd9000000054d43ccb3737a96b58c78fb5f814036fcfc1feef3bdc9eb068d9254b06ed4fbebe86634335f8c400470f227a9cee0715635bbeb8246f88f8925b9b8bf528b816ac3430ddf045148276fb226df927252220feeba0e3a9d163aa066861a20b26e57f07d88b3f6112c086084c2b7102d13b6d5b3f0f14d841074b6e892c72cb7ef0e36f0a700e0f6ab96f0aa85e6f02ab3f400000009ad37840b60d5e82084d919906af1cb85f498ac78728b289d669bc3a05256340d79e6a8060eb668954363e19d2c60601399738641f2e2d1ab8973c9f2f846620 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{96F9D5D1-1C25-11EF-B023-6200E4292AD7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1920 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1920 iexplore.exe 1920 iexplore.exe 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE 2612 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2612 1920 iexplore.exe 28 PID 1920 wrote to memory of 2612 1920 iexplore.exe 28 PID 1920 wrote to memory of 2612 1920 iexplore.exe 28 PID 1920 wrote to memory of 2612 1920 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\CallCenterApi.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1920 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa5f558058a91138d48fdee35ad49c17
SHA1b3ba6e4fb1628016f54aeb6d73f9140cdd242143
SHA256cc9ae472f616dc6e40f647af4dd39252780055fcba50f052f233e03b4b526673
SHA512e158e6246e895d80f2cb8aaac2f85baf21078191358615e45ec04aea762126cb83a0e2f859a085262454f15dc5f2a2394240a49f06aa40ac36c1bac7c58be964
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0b592e84b0269f489a3f45e8d9f9a21
SHA1fb51619945a91ec395e324f48c8a4c707f892eac
SHA2562f012b3fcf8a19c0be4b3a4a7c680db21c69cdaa685730841bb52dd5ef3f46a8
SHA5125b840f627c247b37ba7c0d301b95064d21f38902f22e52cf0240c599fde76768a54479f5ea3b5c02c95d03d2b5148ff48d02fcce8ff2009cbc7ff79d4638a4e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5465fbd8c61a2b50a3356550ea3f46a86
SHA1e249d930fcf2924fb245a3e305e4ee365bb5131b
SHA2567c93bc7a41f4fcbf0f69fbcbef8877fad88e4e8593d63b38cdb8565efd33e8c5
SHA512a4a747fa57c3f776283a180a8e0b27af4f844b68be668fe40514f7ba166a447adc86915786b053c611809a133784ed7822b267309ab89fcc602db5222879365c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580b96a208b2c8af92587d614fc5e2b05
SHA16936781603085e90193520dc6f20c55bc8cc598d
SHA2565a33546c1d7da40c9c86bafea65d135ee39d5682ea34b3816a071a1a9066f6ca
SHA5120c606ce2db8035dd045e2550ba5cdee0a05192198810aacc5826218f61231928983db0bfdce3cabec338e5ed98dfa68f75516db6424ba7de6a99fe51b1260bd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537d271afbf1517232b1e6689df19bdea
SHA141b30caad24035e3117478ac01198f77fc1e42fd
SHA2566182aea41793a6a4d0b3ad72a921c228bcaff61bcccf11107c06f307deea35f4
SHA5124bc0fe6f29cd771209728eec0de9794fef1bcc2a0122b0650366e777d7ea3154a69d97ae07fd06e7303e32e994aa9ad1afbac0e7a8310d3898bb0460188c1220
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a47ef1f007e565360a3d98c9bd404b47
SHA19627ac386fe18dc4e76ee399f0102fdd3810a52b
SHA256d344e536b0c2b53693a71a60310c098b36e3cf46337ea1aeb1a86495e2e9b5eb
SHA51245df73def797480e88c1dff59b94a5552ac77dde0119f27a8e5bf60c26965a0619f84424321596156d068ae53145b3de6971982e8508b94ed8c1b514188d8cd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfd788c5abb42ffa13559ed51992b5ef
SHA1ecf1478db1fdb0da4aaa90c924888a20cde84b15
SHA256ad94202ae6050fd27e3803b7bcd266fa8cad6a37b8ca341e172ec44afefb8f26
SHA512b4b2b0ffd150df5f7e63fe236966b22c53406a8dcfb2deb97b077ff15cf4b72737bf4d9cce77a15cf27ec075ce7ce8c34d092b5acd1652b0db6275283e66a6f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57586cb7b5dcba191827fed3b697fee64
SHA16b5c0c67314964f20f23fb4c6bef0870711d2006
SHA256949b27b2442d7c64ecf9d3301934a2ba7eaaba87d04418ac092567cc3768505a
SHA5129929c4438f9e73ed4778a8035e9951d92d18d5f3022b5327a01608224c0f5cfa0527f0b11d6b45fe4a3473cb846a3c55cfae19cfc5004c4190616433aab887a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ffeba7bab3db824cf52a52ed023c1d8
SHA14452d9e25f110c52caf62a7f32c9c118d0b8cec7
SHA256ed88eacfb2540e5f1d1d5d15cc03c1a1e1f26cf8c98f3a3a84cb73cf74abb86d
SHA512fe89d28168b5a92843983773359cb5583881ef37afcfb4939510f4ca8943f493d007a6da5a6fc87e27fbf49c9e7e2a20dd4d4473a82a7fea352f7336ac856eae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505b85649836b1a84e663ecb7b511a90f
SHA177be6d15cecf8999307746d3ccf16f8d5ff6b4da
SHA256f5bed3b80b3b685a13b8e54c7aeea0337d03a6a83bb2504e46abdc25d3a4d4f2
SHA51214652e326b239daa4ff7be5b258797e62dfc6840b5e1e4a2e8a48eb43828e8271696fe9eed13f6ce75deebe87ffb6bea3d94cec6e8e224d95ea99bfe15bc7577
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562d660b9b1ba3b0be3209b0f7e3867d6
SHA1b5cd567c0684a2a111ddd9938304a25c77d54d25
SHA2569828eca178e7de898b546083a18996eeb264cadb0a9f7e2aa55412a7e45cab96
SHA512c63bf59cb5bc81cf48ad38c7daed7f96f7232a916b47f4ed73019273eee264fb7fe7cc614ee356003bd70f88b306d78874245a2c5d38562944b5248a1ca300ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2f5a45be52d8d31ca4ae2acf3e36bde
SHA14c30d3e8a094d35fd27aea4756ddb88e8dfe35cc
SHA2566d67aa7922974a0942595532e9e2bf51a065bf4ac92f99303da25aee1ccdf175
SHA512d66b924dc5b4391467004de2524ee6d8c0bccd6b7afd6e598c8770931c6fb5da5630eba8ae0aa70b0447adbdc46a5599b1920bf48045cd663912d103b48584eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5117c988a78ce4dd679cd7c441fab77dd
SHA163ac434bbc55b51bb7409284f99e8f20903c6219
SHA25652681cff39257556ef2b8d61ed6f73bb994aa1f4ea2a847bb66f3537f2b254d5
SHA512a3ba9887514b4c471528a27f8441a6ba0cedbe87f3fccc8ad86bda35529d2a1168ccbcef43d84de43ffa482a09ea01f0fd2acaf678b1bfa1395901143c8a67b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588a999a55f3367816c04d3266a613829
SHA1a0439855cc6b72d780bebb56333bab832193ee2a
SHA2562b2380fb696f6d17886d6cf4a1c5f6e996db460b10a29ed343d1f7a3f8dfa3bf
SHA51225860ea99a63d4d246deb9926a24040099fb734661e8e8a60b34f8c21d8429bcfbaffd71a1c1129bbea4637d0bfd2ec25550903b7e18f7e74e0665305c4dd593
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543074b47d4e8ac89d628cd8dcad16b7a
SHA12a17aab6e50bf516ab78512d464286a7208436e8
SHA256f5eafe93633397e25d0d2d3d1480ff6713f98209607a142f196512b8895279e2
SHA5123e907709f2930fb86acdae242b676c1daaafb14f001bf7723d12a0e3cf5dfceb629d13af4eb38098e3c822fd834e2036abe89d06934624ddf77af88d0d2982f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560ad538551ff11aa0c0752307b482f04
SHA17d6876cea11d2fd9dc8e19c6080bd552a30b9bf3
SHA256ad0085cafb08c885f8091fcdb648d549a0dacc94418750c7466e26a27a15fec9
SHA512482be833be927d0e84c25f6fc595bba14b199e42dbabcdbd3e15b0ec359c0b12cdea40bd5bf3765dd20d382f76aeb9113cf3b510a42efd9e371e63f6fe852cbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a55756f7ab94f7644fdb499f2467108
SHA126cf71e6f80e5f52080c37e35cf67e848644cf74
SHA25648fb8f72ceafca7401ea13ddc7675a52e8cc25806355b34a6f6eaf97ed84188e
SHA51208796a4ad12ca3473b8f6a11f5d64a0af20adebbdfd6a78c3217f2c2024b8b926d134e11a01b153a5623b75d87c844f7a2e23739d4cf08aa9d3e1df21f19365f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3a5f72f176a46d17b04bfef6bbb89c6
SHA1ae67ac35ad01908c41696cdf5bac5b43c545a2c7
SHA256d1eee783bda93e6c6eb637bbab29fa6930bd161cb2cfec5386259d9021c6155e
SHA512d06dbcec17b168f617c6bf7a9147af1183c285aabdc3ffa6271b267c5bd5f739939983915ceb332642bb878c3b8150d3e536a6460579b96b5e1a75631d3d41ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7e39dfc21141204ae2f35327bead897
SHA1eaa13ae182f84256faaa0c80e721c2957fb6e867
SHA25618a1b9bffea5902edbb981f858a0d0b7c65ccd56bf6703b5af93c8c861b31831
SHA51276aa786d74f71935a9027ba3f54db959aee3eef3c5cf56ff71b2f6ee00d9fbced82bc904dbb79dda523e0b03b039f429557d15f027781700a4deab8c81fe77e8
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a