Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
97s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11/06/2023, 19:21
Static task
static1
Behavioral task
behavioral1
Sample
dee.html
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
dee.html
Resource
win10v2004-20230220-en
General
-
Target
dee.html
-
Size
2KB
-
MD5
4c5e27b2d6471347c93de4832ad5b260
-
SHA1
e1e1b50e671d65226510e2c060913746b1c8e587
-
SHA256
925e5a4981779086c61bb0964c9c8be7633d7d4499716dbe2f02978c7c2b4f3c
-
SHA512
a524833f6bce50fb395a2c7ba0a484357ef4af73d00bcebc59e74a01968f34a03057744795a1bdcb9bda99f88d3a5986ab95caff9a6750ebf9c4a2d381fb5324
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fab0a7e1b1508a45b985e75daf83f0560000000002000000000010660000000100002000000082fafbb994906cc6e1cb23de0e9070125e172b89f98810a4050992da1bd8a6dc000000000e8000000002000020000000639815a5c6c5452d9734c16ffd2bedda5ecd82b10aacf21352487e7e0ff10973200000000ece01b6c2fd4da6a793f57135281b9d418c59bd4e16b03b48424ffe65b86c754000000058d3f4d042d7e47e07aec86276668bb5845ecfae1c036ee863e81538ca2eb8077ead7cd4704c27e37b0dce568d00f680ac69cd5d11c425afeea77144e5114ca1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806e76159a9cd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fab0a7e1b1508a45b985e75daf83f056000000000200000000001066000000010000200000000e95e7914ba513bcd6dbf7ebc0e95003c67a4543105340f83cd179e48b544c0c000000000e800000000200002000000004bf5db30b134a33ac020f95d176eead2af50c8ba3395b2f8deaab16ae7be271900000002fbcfd7de0aa14d1b7ae262f0ff097d6aa4c008ff622cd2388765128b121db54f01a56f78cb4159521d7b60f3ba432dcad536f2e06c6b6514f3ba23ac58157f7034d86672cc1046ef642e79d1bb5b9a2effce28e470566f7b1deb9881a0104830bce328426cd524f0b315db6c7df89bbf6eaa243516512b99067a4286575b86da6fc5c14435e1db179a4f15e42ca561a400000008787eba1cf534c10e2b0ccbaf2523cb9a48c87c6786665fc9d99211feb52db6c7bd00d7bdae21ee4bd1f2247139282bb95da4d83114e36fe3392012e1cae858d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3EE79781-088D-11EE-8698-F221FC82CB7E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393276298" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2024 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2024 iexplore.exe 2024 iexplore.exe 428 IEXPLORE.EXE 428 IEXPLORE.EXE 428 IEXPLORE.EXE 428 IEXPLORE.EXE 428 IEXPLORE.EXE 428 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2024 wrote to memory of 428 2024 iexplore.exe 29 PID 2024 wrote to memory of 428 2024 iexplore.exe 29 PID 2024 wrote to memory of 428 2024 iexplore.exe 29 PID 2024 wrote to memory of 428 2024 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dee.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2024 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:428
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5aff9714257a525ac4ed85be1bae3b542
SHA1c947c622d3027fe814f17df050246b111f1ca035
SHA2562d2627b185ef9566b501bb07734a6af01e3b822c916616c76f097e19cca7634e
SHA512260b290744f0a58824651182ea2261ddf6adeb676f06ca779aa3488614e26fcdc0b325539885a7057759fdcd6cc2c554366afc6abdb8b4dba8b62dd3b4269afb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dc4cf33ee3f9cf9e95ba6573c57c5869
SHA149da00adf4e008413c061d80ab38480522080e7b
SHA25676507a14277d5bcfc663d5517ebdc5fd5ed76a4eca78ab99e2bb0126b24d5c45
SHA5121b7081b7e46ae3cd2dc8d84f90f3972fe5785af5902850d4cc1abfcd67bc3347b3f9da8b7da74fb59637613ef0207ada3c9abb081caada90f0279ddbcf105254
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5044ace81c6c6a8b4e848c8804259cdf7
SHA144dbd85c45af01f7901043f388cecc796442d5af
SHA256614530093a4e3408a66d7d0a8d819471954e082a6b59ead9938ca143e8c89acc
SHA5122e3f94765ccfe437ce0e161bd9a2349c73e7b1f8618dca8d2c407eebf7b71ac432635118ebdd9cab8e0b5e12fc5da3e23959c4753bc8ce3a23479916be55eba0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e5fd761f36845ae3beb27e24b28acdd6
SHA1e1a0a839f85f90cf213b5c4607081e641a2e8620
SHA2568bb4104ee85299050726127832b07be5b67a7d55046233b67b994b816e1a32be
SHA5125b789e6c1a98deecfe4194dc7a51a78a6ca197383d960df178211ca43899abea7c9be13d706a9a6430026dcde0658da8540a13dc4f324568caaa10ab87c712c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58832e0ff001d206c8d7cf8ed448c6dd8
SHA1ece7df94870381b4dbcd10e2d5527795f009f871
SHA256f1bef3d6d9a5b03091d9b1636c8f1030a5052ceb137ec737ecfcfd0faf1dee58
SHA5120f24cda52282460046ef341e0ddf745c739632afa8fbcd1edf5b8a4d858b6b2715003b8a97b5fa8e00416d7b889fe51ada5e87bb6910e5e4d74d6456d35a2764
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55e3c65c81287db9899e88c0663ef355c
SHA1db89b23e72012b78669359048d2a42af43590c3b
SHA256e5b6ec971fbaaa07bb9b5a43743362fb023f634637c8219966035e331fe8c44a
SHA512043627a3b4a34278399a7ac74b4285b9fa3359ee302a11a172d2b7fbad51c0662c8e23d2b1b2ebd5876f83c1b22107b4bc30a4bffd3a5362a24446bf86a7a11c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b6039efc353e9f3a7ec41dd08cfff8ce
SHA18404103e8b1af11b8a6aaae4cbbb89f3e038a6f3
SHA25645f113383f9c0d0eca51083f1babc4bb8cffca3b15731a0e8214c81a437b8f69
SHA5122717aa5df151ef5d6ad52e3762c756e03181bc48bbb18669de086c8722acac188684d44aba46c7269fc126f4494706830e29aa62aeb498975931756dbb2b91a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f85dc1d0ccab21a44051591c1adb9092
SHA1dc0763490a5964cf9e2fea0bef5e1b1665638f56
SHA256ff48db5f29df922b90c5e19bd837719bddc3c072bb7e1e910d38f7298d732d18
SHA512edf21ff876844be92f41b716ce96b1a0e7c4cd2e06bae90d2cc3865a13fcc388d25ff7a8a64d595df31c5fa46a767960afc207ec9fa00ae95ce9d03d943b94e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD567a0cd3f288b7da40bd713222a8ccf51
SHA185bc3699cec44b79bf1ec3a47694645d8cce1b6f
SHA256121948519cb275e164b53a431b87ca29d05d2b7523b3d8f07001483e11719c16
SHA51279f9ecd8445bcb0e7b0b39f3060e0a003b79429a8798b452024b4e19440de993718221a5b286bec2cdf01a9b830825feacbe30580fcff94331c1649854007410
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
603B
MD5acf64f08151713cad5a4f1d9e277a403
SHA1b1ca3fb510831025b5d30c60f8e8b938fc5ca736
SHA2568dcddc26f8609d03c038c8b61a35c0b8189aa8840fe348699944eadf64b729eb
SHA512592fe445f7e681aefd33e895da6808d0fcb44aa8ad798d1e5a59cf555b5e03db3040a82e5673c915f435860c72ce7c3d8b1df69652c17ca2682be40e739fae40