Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html
Resource
win10v2004-20221111-en
General
-
Target
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html
-
Size
42KB
-
MD5
71ba35e1d99cda384dd16df1255946e8
-
SHA1
0c3e2c86e5499c65a70b376da2589aa4640b8fd0
-
SHA256
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d
-
SHA512
d40660333d45f4ef40d5552533ca7b1dbf2d513a3f087e99d698f0d5a7144c387fd72206a9f3874e98d38b9eacd007fa23670b062c4dfb9d06726d264e4b420a
-
SSDEEP
768:bwi+B04Zyn3kbjF4rZ1EFLxNFdjNRqWdZx47eW7m17u7BlfFi:bEB04sn3kbjF4UFx30gV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E86E281-6BEE-11ED-A824-6662AD81E03A} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a10000000002000000000010660000000100002000000034f282d9eb4df1b5a7c9c721f507a95e55b8367da20557d0d7bdc37843ebd05a000000000e8000000002000020000000410232ce63c72d21f8ad9eb11ff35bae7508502be2b529d6b0dadbbfddfbdb6620000000385a0e0a654fe76670a128bc329acbb989c4e291b7f42ef1c0f497924fef8907400000008d47f238bac8cfd8bfa4e1e31e3c79d523b7cd1813931cce8aa06abdfeac3222c1c8769a6667e3944c755a12eea3d4f35341db6c5221b3bb2577a4b703a625ca iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376055689" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbafda4d2839344b902c87c07ddf25a1000000000200000000001066000000010000200000000db108baa0fa6057d1f89cedebac819a36db8d19e7a4d5c68659c6288aefb55a000000000e800000000200002000000021cafecb7027e81c30cc76c2e853d02c897aa7388e47ef0eabf484e3312646a49000000051283742967407c9b271a0c39e568f5571665b9577a942d33171662d8fc8ae58fbc6b1d0e18a9b9e14a6be5e99011d06ef0ca3d1c15a56b92e8ad7583fb77d55dd28584b25840f035e9200e097ce39959477cb4c4425acd7f546c5df42bab0bb5dbc51cae2ec29b84abdd119f10c2aa4d1e1da75ad7cfc4eed7eb907e9d5041aa28e28750654c855f62e9248f57b6c0840000000f3963d16a3fff77aa4c3b3236e30bbd233fdb89886aef8c3c57138b782259641f35ff8610f4ef457067b4bfb07a2ee295383c8129f48353e2c8f6da983930215 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 509c063cfbffd801 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1744 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1744 iexplore.exe 1744 iexplore.exe 520 IEXPLORE.EXE 520 IEXPLORE.EXE 520 IEXPLORE.EXE 520 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1744 wrote to memory of 520 1744 iexplore.exe 29 PID 1744 wrote to memory of 520 1744 iexplore.exe 29 PID 1744 wrote to memory of 520 1744 iexplore.exe 29 PID 1744 wrote to memory of 520 1744 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:520
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5dd84675a1f103d9c51d57797f16d273b
SHA1bcf29f157f54b44ef02680fcf258fcb4eef45b20
SHA2567d719a698d0cf64c13a30c7bb70aeffafe913560ce4ea3136280cfe18ff82448
SHA512fa68ca3df07877ae19c72946d5beeab79d6c68ccebe415a12af5e2c920fb1a125920fb883464590dfb3d412c9a5cc438b5dd9885edbf457ae36737217e919277