Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
15s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/07/2023, 15:12
Static task
static1
Behavioral task
behavioral1
Sample
230503-k4fdhaeb44.html
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
230503-k4fdhaeb44.html
Resource
win10v2004-20230703-en
General
-
Target
230503-k4fdhaeb44.html
-
Size
59KB
-
MD5
16437a4302353ba52240f1f77d78f256
-
SHA1
6e850ccf7f70ee6419604b0028f5331932f8d18c
-
SHA256
fdb0d2ab1eca4b0b7e21dabd60f353dbf6eedd4e8c32fb6b47c40550a1c0ac2e
-
SHA512
512372569fc14fe6fc07d50b80fc1598a5ebb5296b9f3def324998af34e0d1f67f64d9028866939ea2e3d861c03403d269a496d1454e31eaaf0c806afb270fee
-
SSDEEP
1536:Bm3+1/73UWqx3gk/HGgZgX/+3Ndg73W/HGgPYLr:BmyUWqx3gk/HGgZUW3Ndg73W/HGgPqr
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0E812051-27D9-11EE-82B7-CEA1BEF6F4E2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2816 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2816 iexplore.exe 2816 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2936 2816 iexplore.exe 28 PID 2816 wrote to memory of 2936 2816 iexplore.exe 28 PID 2816 wrote to memory of 2936 2816 iexplore.exe 28 PID 2816 wrote to memory of 2936 2816 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\230503-k4fdhaeb44.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f08a147a594ee7a85160257535b28b1e
SHA190583d6329778774f55ebfe176ab456e20da4eb7
SHA25667cbc08a6d002ae6db2462905ce8889b5a88e2f608c4c166b60b5acc06c56bd2
SHA512309eabe6e10130c0e55a8855045701d887452bc94c7346a6833985e9bac46b2c6aedeeafdf40ae9ec038bca461629be2498c64bba899c4cf9ba2861f4e9ef5e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d272968753453c39ed57715540c22346
SHA1056a847d2b64748c782f603a900d5e16b4cc140b
SHA2567b46d34da1e838ea6b1c4486cb32b3500ff480e71a04dbabd4c7e8fd899136b9
SHA512b3281e2813732b5b1e07d6003dae9372f6f04a1a540e974276c78da3de554deccf1a4a8c2d8205fb6b436e35188d50fcb6bfbc1f45350c81e70ff499a35c13d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a163e7d2d8c1f4adc361ddd68104cf3e
SHA108bdd0531b58597e37589605b368f78bec5b4f15
SHA25669df21062ea866757afa6dfe341bd93b5548885efc1f5d53902f3f5b5c05d1e7
SHA5125872349c9f6c408fd4077e46fbb6e81eaea0072875acd71f109295aecbcdc5dcf017c6e3fa17f259152bc80029b34bcbc9ab38528e0ac44d4df97150766621ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c847f44c1153da3cf1e419e39c52c609
SHA124e037b0dcb912048c72b353b20104593ecd5fa3
SHA2567bcdd8bf86a8aa7c9d3dae9f1964c58ab28907f5c47e3c2018ad7d7b709b1311
SHA5127ce8cf0f5667818d58f8e40e2c7626f50dc662391d3606e0e5720c35052f8bd4f1fde3773101abe6a304e2fc3cbe180dd8ed8077dd260deb65e9caba4b802315
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585d55c69cc9934677e1e1de3f04791a9
SHA18089ef15cf87c3e79cebc7b0b3628d46ebe73ea8
SHA25667de07f5b905351b01e976ab06f255ec55ac2c24a04ac04ee6b189d01729eaac
SHA512d624dee01ec8b308883db697067834a449243884893cde26a4a1f4e927e8f05acdcf7b5e285f2aa1e26f520e64c86c8a3fcfb7f94311e89db4d9096feb25f305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4122c0f8038d94eb1f2efd81b9f74f2
SHA1b36c9738fa5a567744ebda5cfc898a602c09f89a
SHA25694ea710497522424e0694bee96591216b4ba2645802448d8ad448bf51e064b13
SHA512863e177bfe8ae1d24fb3d0f51ec0ae234db2edc6d17dbcfe54e636413bff3e79bd6d5f24537109738e4202b35cc21f0b91be964e5e17bb8fd9ea3fdd5cd4baab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507206470f391a84364956cec46d14d7c
SHA1b17f0a6945384e28a9495988b565a79c5953ad5e
SHA256ea9c4d0fb52249ca83956cbb332c8217d38ca8e409203105848324982387f7e7
SHA51266132d8d91e9e3e89f2c05e5201d7c2a71474cac497c9b0483dfe95f88015b85e665cc9c0621491b6f36b73f31992fbbf3044732a49083122b692b24e8f4f3c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efd4380b819dc9f8bed98c72e8028db3
SHA17fbe97af0a8a67af6f86c2a23ce4351c799b1a7a
SHA256f9dd0cefa72ea91f123aaaee58c95a54a074f7e8cd6ab345c2db5cb94ce09733
SHA5129cb82eba06eadfcb4194d7ab52cd79e8bafd828585c35c0c20bc3e6dcc1494a1710f8868b88831cc7d271a4f3026fee22832999dc1ac206afc2a77fdc22c90a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e461d48505144da12dc09d4966bb2bad
SHA11aba455137acf3ed9193e434db09cbc35b4a09fc
SHA2563cabab0ea68011c10e6cd9b92c2190c2dee575c8d2b7dd29585bf8911c2cc3ca
SHA5121e0dcdfd66a11fd7174ad3bad22e7c4a5d9c125389e2e51d21f0c557b02cd2e45bfc4c11a194a19d8c9f99ba6a07d34868099d51559e6963e6595088816cac76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de6701b503127d5d5e79495d5d624d66
SHA1c16f151d506b3ea6b02c087726f4ffa895ca5c1c
SHA256a343daaa18e6cdc9b82e1f0a060cb81603fd4e46b8afc6a350e5df02dc703b82
SHA51243f71409bbb4159ee6747e0a4b10a5c61698d9538b1dfee8e1f126fb34e01676b7acce3013f035aefac78410758c295172f4928484ef2462b7efb3918da0d6a9
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27