Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
21/07/2024, 06:09
240721-gwhxwavgle 121/07/2024, 06:08
240721-gwalhaxcqq 121/07/2024, 06:08
240721-gvzt1avglc 121/07/2024, 06:07
240721-gvjg1svgkh 1Analysis
-
max time kernel
134s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
21/07/2024, 06:09
Static task
static1
Behavioral task
behavioral1
Sample
8x9x6e.gif
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
8x9x6e.gif
Resource
win10v2004-20240709-en
General
-
Target
8x9x6e.gif
-
Size
10KB
-
MD5
2bc3d12a9a2010098292ca62117c2091
-
SHA1
b7fa4ab4b0d8f483df0b7e334f2c0eb1044e55fe
-
SHA256
72d2a440203f2e2985a6587205501383df6a56e147d57ff98029f60b081cf5dc
-
SHA512
13fb7c591a1d93667494bfab77bf324dd0a3147d75988220f03ba1c296e53082d8b217f6732cff82128b395e86efcfa4a079e491c6a1aa34cfea82d230c480da
-
SSDEEP
192:nfLxVjxCREEd2gSFuUb0bfd+6FPLrUuXRG70/ulm0ZtHPOhDkdYOcE:fbxREduuzbliuXKOvyvnSM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ea209734dbda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000563b146bf0426a4b63867367524576f0bc87d5a8ee1019a99a35fa3fd4cfa632000000000e80000000020000200000008d9568bda683dbfb812c950dfe530a52f891a103f8d7ff27f3c7a0214591aae790000000f3ef899ec7493f5ce5e080b0c0d10595872d548592e0f23c837aa20d78544dcbd9ff8c4f24380983f1ca7bce01039ffa8e6f394db66690b09a7861f6f4ded756a93bbe7826fd21b912fce351fb52acfa3ef4eecc25b7477f2317d6ab5065fd350fa12dbf0119f5346a4300a199d404e1befee64cacc331479c760205061bad088ef8fbaf74c9703c5cd8937fef3ab55640000000a6f04101f3b44cb9708a146f7bedb4604f733b9ac80e8c88df23a8bc409eeb2cb925d0f4e9d8dcd57ee37ed007fa0ff2ddf0e1797d0f3383b21ca7ce7139e66b iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427704024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C27AE7D1-4727-11EF-8EE4-CE397B957442} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000c314c1299ee415c10f9963b36f135629b7e1f5e126aa1c9b7f335799876d8f3b000000000e800000000200002000000002ac2c4c2357fedcb8a67140ecd058c52978a021d1da0f5d59f32cbba077cfc120000000079a138d95bf856c358b6e23b2e738811cc17779fd9c9f70f9f07a86c91ab32b400000008b57ebd0e04282c108e69b3c4c0a7b769e120f8e069a35f7ae90d567f181e078d1a7de22295cd310e813d2363baddae3d5de339e9a41e73e9471a52600916b18 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 884 iexplore.exe 884 iexplore.exe 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE 2348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 884 wrote to memory of 2348 884 iexplore.exe 30 PID 884 wrote to memory of 2348 884 iexplore.exe 30 PID 884 wrote to memory of 2348 884 iexplore.exe 30 PID 884 wrote to memory of 2348 884 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8x9x6e.gif1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594a733ffa454c543ad6cc14b1c5d0837
SHA1a8dae55f8b7d613b681c4caeb917f242b22bb1c4
SHA2562e3f3fac8f8e11f4496799641bd3726dcdeed1b3df19ab0bb42ba49867126105
SHA5126326fb8febe19cd1e28da86e1508aed3745eb161dea9e054eb61aff7ac524a553a4750116c9d612b11395abcadf94e202dea8eeac3368e801174cead67fc766f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56a99c781b4283b956c682d93803d02c7
SHA10a944d4cdcec8a62db6738773e64e517edf87b6d
SHA2566d8924d38f1093edc0f20b5adc32053f999d5e8209843e0e56bafc15980c6adf
SHA512b27dd8a3e86f5273c4893b774ffe891f9598c890eaeace36ef39a67970e71d1283dec1bf383086326a0640453cc5541aa1df7caf0b4123b660d64f49ba6c52d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD517f8d36a45e924d2a9a1064ee030ca62
SHA17cf530966c2336e940740ecb9594cc1cb4e33cb8
SHA256a52bbb5d41418be2346a77cd31888f54647d95b994041bbcfc9e5ad12ba1614a
SHA512ea0837e1016f93edfaea80e2d89f39e4d4344da8188759846268bbbe8906214fe076fa292bca6f6c66a3479a02eacc07f5577c3ab593c243694af3530c18dc38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6b077792d10ed58e97dc1ea306c3f43
SHA1a4c2e758ae12a4c6f9b1a70714a1fde1cfd64966
SHA256b8ccbe3f58a4a884fb8af859637706b45d89f338cccc3ffe7b885cc929833f4b
SHA512e4ed9364f667ac8742c33cf00759826a0bb14e4031a569b29852356e11a8d8706c388ff6f5b8a4f6d8825eab685cfb98f7f4594e27d02c955e55e8e035d598ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e575eb754874f1fac7b81ba1f23d979a
SHA18efaa2ef36099c7e8a37963c6cdd37e541e02a9f
SHA256a3864805eb0437fb1866760caea37d12935028b2d662936f2a916870aef78688
SHA512021a37eaf5745584079fc695ac26041aa62fc7f254badb0fe1781bef4e43bc80f3c50ed2787b417b1ce6f6f1346c0c208b32e90fec3e1fb652f05fc96cd4a8a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD560452eddee0cdb5034abcb34ec7b1c27
SHA1e138ca0180d7d932a9fd38262d310ea7b9fe3a83
SHA256870a0a9dee425ca736eb19acc14e1161699a364edd44a4d7636d8c999e9d3bfd
SHA512525f41b534189fb943ea772b64d63f6029399765263ccfdac830619efd8dc147e353b51db8eff227c99ab92e03c558ef3aa68106f1c5e99f8bba013e9b4123d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dcef9e8b6a1b7447b2e7202547f03d03
SHA14ab90150c68c18aa410965c40cba2a54a26474ff
SHA256992c94790bb7efcf9edc6f0fde5246d889767733d9da7334b90a5eca0fe97385
SHA5123e1725432dafe74485aa8b37afe2805db311ea8736bd656f3710a8ed9e07973b881405ad716f1e12bc35edf36a5bf00916ddec51037089e031f75b379683ebac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59f7b1350156f17ccff640a0fb3889aa2
SHA147d668d2282c6fe688182e5f020e2c9ae91583a1
SHA2569f69118b034fb021747e2969a4e875dfd9e61224b8200bdb66ec45fb73501b19
SHA512d17c02495f0e060e7a671f58b02857a76930d25c6b7621b33ab2b0bca65627403f78b6e5fd1a023e5526a08d5a1dc0bc111617b17e87e526acb4f33068c38644
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54a2e982c45b44d1cc3a34246b9415c7f
SHA1596d02301e76e763cd176e40669d804a1be89cc1
SHA2560c15aeede1a4daedee479a22131e9244be492fe9d6866aadc09ff38116d379cf
SHA51258c473e9a06e65c13bca704a8c82fd9dfd4349129ddf25f81095244da4912c592abac1f6b51a532cc7c2f8a485b0f1351e8952877feebf2e24a33798efc136b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5030bb74babd313f65b35ae0851925dab
SHA158600d9a85e9b13ce541237304fd15b6fbd2b521
SHA2561257902d253e6603b24b9f4a9fbbea6747a21919f166fed963c8b5a3ae32151c
SHA5124ecaae6ccaa974d15f4ce41a36074830eec62f84226fd8bce5e382e1566fdf5c5e8d2b4732cc944af0f05d97579751a391952489348f15037c2dcff4d44726b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD524092fb352402fe75f00f839a46e5c03
SHA1a056fba7458c103e62275da642ff77ee23d8e2fb
SHA25697336e63af90a1c1331ce7ae24e4a831110323192771b235f131d5c85763cf3d
SHA512bd258635040c29714e7a1c9e49c0558d3fb1da75cee0621ba68db1bab4a990e8acef8fb962bab067c85526e9faee28f51e54d0100743a1c6f32a973a0ad1fd8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5497b633ee23cbf88d7118a7563ce05fa
SHA12091d9a5b8c30cdc7e519e85d1732b87422ba6aa
SHA256d27bcc96f983a69e0b52cf3b42779e3b7de281f105e255349f5862198830b43f
SHA51233e19906cc1b914441f2a4ba2c6c1f0b8669e27390be85e98a595987186047c4fee42d9221e94a05b7776576cb0b610e965fc19ba9bd5c482ed4929c38b6fec6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51e0888eefed30ee328c1b03e29b15108
SHA13cae8a15834ceac186cd8b02bec7642027881b6e
SHA256218d6087e1235fe42d62fc24d475fc42a1fecd063eeae5d1e595b66c6d52c195
SHA512e0b3435f2636c18cc3fe9348be329f89f617b4698cb17f6c92a9e9f6d6d0779fd37240df8e11d12b7c0bb497c69fba3388985b43eaa54d22f118815904a5eeb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57085276ce8048f547116e7034999e813
SHA1c5b8144ef674737f7feddce61a5e5ead2ccb5cec
SHA256823470a954007eed62525236abf4a120d2ada38c94dc8adef31e751da9759f29
SHA5120c23d1d8d6c6b1b81691046240e16c03757e4193bc33d2de7ab95643f26c0b8c0c87f921ea20a26e49cd65920d6dade5a9bc80e786c72a32be638d86aa4ea985
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55fb2a8df4e8456522eb57de3aabb5de8
SHA1f5681ded51c302e76d1316be9ae4d291a8548ffd
SHA256955119be822cf502ddbf901d7806761a9dfc7f716489caf9d3483423228768ab
SHA512e4e2693c4057bb3d66e070c65000d808fd1b0b924eb7a6c4f9c7bc5fb27e680db3ab6151c67aaa699a118e4d944445a36edc907331dc779480e9628c282e1113
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD551ab16a2535e55da7486323fdd1b7bf5
SHA15240103cedfc2d44e2836aa342f783c78252fc9e
SHA256fe61c59918e6a02b07614e4289d06cd95e0ccab9d044580d2ccc3bca8626aead
SHA512aa75af3322cb86a8b5d1c3788d920c2e7c6ee3cf9abf8f5148a250a95ac41892a01e784faa8e5961c8ae2b7008d3c71b1ba5aa92c91ea97e69b73f5cd5ba6a93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5823a71bc48626c4cf27315c20e6b3684
SHA1a0d7396881840c047fdec0200cc94254b2ed367b
SHA2560a15dfa538bbc7b0fcd3618800a6637ed4063cbfdf64e260e23ec3636d7c0e72
SHA51277ef3f761b423a01022e22fbffa20293d8fa8347a3e54101ea5e3e38cf5bd4d481ba543314973cc0d4efb5452bee81fff2d4565958be130de83d58b73c215c82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ad390300497442a113d8be00c709336
SHA1d2055d34c0feb96c92c878b45f6941768f93e2c6
SHA2563ecfc5f95f3f3f92023368e95671d2b55217cb9345809f17cf652c0bd7a4336f
SHA512e00574e3f852f82ae5466eae775c4724e2701c5163e3f186896dd8d86d3004a78dec0731b59408d3dccddbdc36d99db030d137c38cc0df41d06d587f5ec6a8eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bd71c62d3aadad13e5b013e264ae1db8
SHA1590d3b0d1712dcf2d34266ae40d2dec182553503
SHA25660d8235d9c352e2c45259e9182d192ec8c7c85b8172cce116c71453fc5cdc1a5
SHA5122b976481911ac1b1745f253642ead120eb6d61af5f7b9efb97a72f7895dfb8f50ef0bb87deae5b35d330f8690bbfef075bfe3da9e5a81e55f9671d3714aa8edf
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b