Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 11:45
Static task
static1
Behavioral task
behavioral1
Sample
31f9e408c26fedb227d7fd2d6ec29289363ffb6ae29510fcaefa6855e1664b41.html
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
31f9e408c26fedb227d7fd2d6ec29289363ffb6ae29510fcaefa6855e1664b41.html
Resource
win10v2004-20220812-en
General
-
Target
31f9e408c26fedb227d7fd2d6ec29289363ffb6ae29510fcaefa6855e1664b41.html
-
Size
46KB
-
MD5
38161275141296dc025b7acdae0c1a42
-
SHA1
59a455ecb33e876b4dcc7a61c0d27d3d53c71fd4
-
SHA256
31f9e408c26fedb227d7fd2d6ec29289363ffb6ae29510fcaefa6855e1664b41
-
SHA512
663dd20f1628a3242b89acc36bc97d6e1aa5856123a2305a5a816f173e59e48d5c319fdcd3b86450766d2453f151d0ff042db3cd9d1e1d23135a8ec3bb7a9f10
-
SSDEEP
768:4ggvMnZaTHp1kt52HykoHf8yprc69v7u5Gj5w5aVb02w6aebfdAykOp7uvLW5nIV:4gcOykw3CnII633leM9Jmcpxp29Ef/L/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370381289" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97E5F041-3852-11ED-979E-6A94EDCEDC7A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0df92715fccd801 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf00000000020000000000106600000001000020000000083187ea95bc87c691b301818358da28f3517e5a1943e993079b08870bf8b8ce000000000e8000000002000020000000d624b0063a90a831f5433366b442e222c6af61a623c537fe369f6ee48375006b900000009eebceaa6a73807e3e6021a1171293014a50ebc4832eeab451760fcc138f72780c3df651b6d8017dd53e9b7ac06111309e29906c0ff226bbd5101dea081309fed7542456ce8258e1cdb519400933019d96cd3c0ed45a84c1500bd0e9603d357bf73a1939ff73f3f97e1189098cac83d7e3acfd6b7dc593788042846789c62e10137fb2460767ac3a5babad1da2b6ef4640000000fece172c5828ed7dcd4cbc6437fc9f8ebb0bed3bfeaf41204c16cf2948e2c6f738cecf5afc583d7a39f46df006d303e47e918f3bb296385d43da72e6d7305cc0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062e6ef0d45f4454ab79548c962d74cdf000000000200000000001066000000010000200000003dd674c189813045e8d97f3cf9a39828b11b8ec18c51efd5f910e3948bee1b84000000000e8000000002000020000000e67103f5624177a9e90685afd5e8434bfeb8c4c0fa9d3d463cfc298a108fcf6f20000000e37dc79bf29e0fd10692940f5c383f84b03e120bca70eca0f48b1af2822300eb40000000e016022c6cd590838c109aecd3af30a1ea5fb3c63dbabc9509871b465f2be5e67107102da9d5e30244fedf4b6465d122596eb018d2e6377f8e78aac05d866c08 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1080 iexplore.exe 1080 iexplore.exe 624 IEXPLORE.EXE 624 IEXPLORE.EXE 624 IEXPLORE.EXE 624 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1080 wrote to memory of 624 1080 iexplore.exe 29 PID 1080 wrote to memory of 624 1080 iexplore.exe 29 PID 1080 wrote to memory of 624 1080 iexplore.exe 29 PID 1080 wrote to memory of 624 1080 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31f9e408c26fedb227d7fd2d6ec29289363ffb6ae29510fcaefa6855e1664b41.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:624
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5817e45ca535cd166397892914c743199
SHA15fe07556171c98489128f797494202ba07385afb
SHA256b4013a87bdc6c4b1f3b20664c844d433b84425789784e60f83aa69ea1b797e89
SHA51289d718afa19339613e1b653e8a91e1485b1dd8d31e4b323f317cc993220f3bdff1d66957186f36593fd7f7a28f25c740f4637f11d0641015c3646a92ff437d79