Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
18/07/2023, 20:01
230718-yrv53sdd99 118/07/2023, 20:00
230718-yq5ywsdd97 118/07/2023, 19:28
230718-x66ppadd25 1Analysis
-
max time kernel
33s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18/07/2023, 20:00
Static task
static1
Behavioral task
behavioral1
Sample
Untitled attachment 00011.htm
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
Untitled attachment 00011.htm
Resource
win10v2004-20230703-en
General
-
Target
Untitled attachment 00011.htm
-
Size
86KB
-
MD5
e5b0d9a102e5452fac56cc86d3d3756f
-
SHA1
66a023efa3d16fbb94fe2a15318a0ceb004316e2
-
SHA256
2b6408ba93af92f01978e09a01631b71bd3221330270def8044168d3c0b629af
-
SHA512
e479d7c099069804eda957571ae3c611ba16b3b0b7a47a99ee627cd5bec64556dd635537ce0c25c22e8274c7804ac26e4005ed9aa159d630c7f3ad876585c955
-
SSDEEP
1536:eDuRpGBMgws2EAYiMfhWFl1n97McThNyQKxq9FhDwgL22VS7cPcEJ89:ggBEApMpWZlhNlM19
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b40295b2b9d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae000000000200000000001066000000010000200000000d025d61b828293b6bf3a09ba7d0df5dbabfbf7ba845780126c7f1023b0a7bc9000000000e8000000002000020000000bdfcb6a1d6f647d063f9839536746c4ece95bfdf9cf8851706db84677ba36484900000008af662b90b64408797c68498d36c94d9c2fd323b37932a1049de4b9d587530397ce84f4b23f235a0c7986b1f847c7a27ff5506ccb0a1cb421e19015f838252b346612ed66db94f11a92176393e68980e769ce0015264b53e73cf2e8e593b06182fa1ed264ff6e0f8c257344ea0d37920dd7a0f3f640704ce35afa71c5ac1c85c3d5fd0335cb36fbf6362ae29f78dbb1a4000000039576bed1890454da4afbafdcbdb3dae383ea00f50d21ea8e5bfb52a0febbfcb24a47cb0c4286e93355012885b7021dffc30ed99bf34ef0dc111d69774d59b69 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000015e49348610e2a42ac63317e6e4271ae00000000020000000000106600000001000020000000070d7c22bb88c79c27806f1125700a6354d10a49640a39392c98d7f35ae5b516000000000e8000000002000020000000f1962114eb819d49bf32dd25de355842bbff4ef9026501d2b6b70888b2bb6b7b200000007059985ac6be793027ef9195d5ba0743cf595f823360d99fb4f02696b1b7466640000000db0e97f28ea2aff56cd54ec36acd7954f8b00ff54a1c012ae4c9ef8f7f28542168452a9f7ed6687c46956bd6c1d1bbc6241cd949f1a3b13e99fd1ee2c0fe3b25 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFAC8491-25A5-11EE-BD9E-CEC9BBFEAAA3} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3008 wrote to memory of 2404 3008 iexplore.exe 28 PID 3008 wrote to memory of 2404 3008 iexplore.exe 28 PID 3008 wrote to memory of 2404 3008 iexplore.exe 28 PID 3008 wrote to memory of 2404 3008 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Untitled attachment 00011.htm"1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52877f992e2e9630d8dc751e794ed758c
SHA13c5f08ab4a93309dd9703cea8f40d960494e2a5e
SHA256f4980c2644c4b5a5d17a71226a4e59c6a296e7967b4745751fe33b7477abae72
SHA512530e37b63d7be5403f0b32696053e24e8184543bc56a925d435a3c62a5e700798f9b7412c086ba304722d5e913ba53b2dc4980c4d0e0c1e8c8fbd8c03f58c3d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51835b577a9bed983813cd47653879ecb
SHA1661508621e7b40116138811e58ff66119a86aeec
SHA256b8ad0e59513605be1cb2f8c3216405ec85212da4e10c17e03313fa05c5766c23
SHA512437a389ee6dc6c86cf2c4831c3e006cec565f462216e2f6f5cf689534bf8340ec8242461f61fb51ea6072855dae8a82a78c334d66f0f4560cd032ba3c2eed775
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52298e4aceab074c1bc3834f093ce265f
SHA1d94c273c1d55ef0397eb4fd7296036be1b5c91b6
SHA256bf5eec655fe6d78a38a0514b7546200e1e91821b0bc8d02b53024409e6cba26f
SHA5125b1473db968eacdc1aecdb799eb05621eca3f7b27448e3f9fa8ea5b589b9f42358ecc068052384d2ba20e9ca898e033e79a931c173f67838496ab04aa7d41288
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527d7a743494aa64fd5ff2300a732b854
SHA183862b6d331325d43000b59a2412498de6cf797e
SHA2563a7ddaae55ab773463d3254bb508973c9154b70e2509f133b7738907267be64e
SHA5123de886cc7f487832c1d1eed0d666a073fed21dcd8c14a2707da097f323ed0fb2b968950335098b0d45dcde6582630cb9c24c994d9b0399e763cf61e93e56db91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532f6aec447bad97a8ce5c923c7130ee8
SHA1f2f8259249febd82ec05a6e50e6bffa5fb9e41c5
SHA2563aaba136d51d0012d91f48da1ccb04cbd9d0a6818509e31467596561d0c0c926
SHA512d949864f305d5b76b5d3b83188f3ae5744fabd620c0598f17f9c59c9e670539e70978dd50395a2035b7a4e84b5e9357dcbfe4915f3a207f848ce2a26a9d4308b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5936a26e6b1330ecd12c0ccf974799423
SHA14f95933cbcd37d0bbab192408d0e0cb9d7168047
SHA256370016ba7c94d9f3f3c51b15fd3f31508f8b886a792bf04294ad0a7ca6171db1
SHA512d3f3859a7791b19a86ed0f4ad0a57923812296e82479b194c8c1e9409ebd677b8dcf9da858ba9d88da93e29b550af29c2c48408a37fdf978834908ae7cacb163
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a501a1102a3cf057a3c6c49370dad820
SHA1525c09ce10c33dc8b5c3e74c0591b4f81b3273c3
SHA25649d88c961f78e6be868d54da641c2e1ff4b35712795c6c6ebe61d6bb146625e4
SHA512ffac00306cdf5dfbcbf2143326af161224bf007c407b4098ba8ee95666dd50aa2c26854b2df603afff93f6684cebd9091c03ae269c17a25a8359150875660a20
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5524b6e0015a009373e50e653abc45031
SHA1e997e7568eab34350680d58c48aa1e6b8438f7df
SHA25640c24e39002c3e7528e484595bd3deeeed417e0376612f83936f3df10eaeb570
SHA5127bf9fba21fac7f45afb134202f233dbd2acef17d83e08d68b68b213084974973bcf0fe659bd24baca08bd34e3a6e58bf9564b3f03f9a7950898047da541b3f1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db679e0b46c15bc167ecf52184b3d1be
SHA1a3f6d735987cc30656783854664ad84b5da632f2
SHA2564bebc8aeb9626b8b09d25e9cc888a2ae628862c24168d5a8c1c58e3e5beaccd5
SHA51233583a8a3e12bdce54e626a103eb187644955357de1a2c7df48c3703fa88e867e2c5e9a77b6cc8cabae426c1cf5a3f5fbb161cf3c685e540a83638666ea81910
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c09fdce6aa78386bcc9e4370de198e6
SHA18a081520e246247eb6f85610bd023e60c098f986
SHA256b4c8908428b5ffd0ed3ad1f3a00f67e1aea61d7bab06523a2d22f1a1a9b9c3e2
SHA512a14667d863160fb9ac9681dd7108f06ebb2cb98e4858c289b82e4ec9abbf6c07ee5a0c6a54e0c37419c7695765d7b0903a039a3a19f8fcd86f08deaa6df49ba7
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27