Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
26/07/2023, 13:44
Static task
static1
Behavioral task
behavioral1
Sample
08ed3b.html
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
08ed3b.html
Resource
win10v2004-20230703-en
General
-
Target
08ed3b.html
-
Size
315B
-
MD5
a34ac19f4afae63adc5d2f7bc970c07f
-
SHA1
a82190fc530c265aa40a045c21770d967f4767b8
-
SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
-
SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A01E721-2BBA-11EE-AF47-5E6847EBFE3A} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0c7ef5ec7bfd901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb000000000200000000001066000000010000200000002143979ce41f2ed900422c118ffb5fc4cbbe2d9deddc43deceed33b519147f46000000000e80000000020000200000008a1897e00dc01ff0025bd694ec880e9076c51de7269ec0cfb79008d2e42d3828900000008fc57c552131d42540a88dba379f050ba311090a7e54511b882ac5b66fc0e67b5720df703211cdef9709e327ac4f90dda3a1407d3b3f91d004df1a53a554e3b8539b0d7aa818023043e42cc4aa8428f25388079e45daa224015f58c8d61f0952d1cbf58d61b62cd7e2b0369db9b171b51e7b76b74ffb6a43fe953dc62c6b581b573f313c578d54e3108ef86fd1e6a974400000002346464d9fbc05af5001ffadf280338ea9928b1b41b95fe9021125582727b8a56f44d8960087c230e03f12396d7c5dad6e4d0c75a5ef13a281c476ad38f67fdc iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397144042" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a31a35914bcf84cb1db54e391e8cdcb0000000002000000000010660000000100002000000033f6cc26a4ade1c1429e6318ba6b533edc73c0eacf202de7ee7ac69cbecf02ce000000000e80000000020000200000004b3128a15800b4ebf7841098dd91d1747edfcca3d4d53283265bf99b605b973820000000fd5e12ecb0f804a00a1909ea7a74b80cf30c86248ff0d69958dd3a1f1b42170f400000005c92b257e83af912d1aa65f37c3820b60209fa31491c39353118324fd486e0ca66f814bbfb407cfdad280bf34118bf8a467eaef4441ff14d74356470520ef07c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1932 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1932 iexplore.exe 1932 iexplore.exe 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE 1064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 1064 1932 iexplore.exe 28 PID 1932 wrote to memory of 1064 1932 iexplore.exe 28 PID 1932 wrote to memory of 1064 1932 iexplore.exe 28 PID 1932 wrote to memory of 1064 1932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08ed3b.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500479205377dc82f855cf073cadb9f1f
SHA116fb8f619eb62e4bdf7d560e62791b89709e06ce
SHA2567faf7da09992f86925d9dffbe227ca1bf7100ceeee1eac6e2a49234b33eae59c
SHA5128ff68053614b7849b2da7c9e1ae849f92cb2f36feff2affbf8a17c8bafef0efbc793140396fa8bdb5f06680e99ca04c82f3c0309059786e04b88090b7e0d6cdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdbfb43ea3a487b68a989c7d144dba20
SHA182454248be6e6e0fd989540cecb6c2ac8d2c8a06
SHA2567b8d5a4b8596e2c3454b1282b971354c14654f74f0b67f276e4e3bec0221e005
SHA512ba1511b235d21fc9f4d669ea74d3b4e5964f1d5a49f02d3626822cb71b4e9321d89c9afec57d2c6a372e7cffbd06893d2d16f10d5553fbadd2a9f95a781b06c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539b4aa3b704321063f7fabd4d4b948e3
SHA186224861d502ee840027ad656cb19ad427a72577
SHA25685e23f23150e19b3bd595003c93a7a3ec2be62182a9ccd49e2b3c039cf954c5c
SHA512d4f2eb873d502a1d7e54a7f0697d421045eb314f25d1316fb22dea0c67fb9332468cc5c6c0646aa928119164fbf3dd7e485cc49fa10e81f92fa88f741e32edcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d30a5008686924e3faedd0376444164e
SHA15ce58e69da8b43cd6a97b83d81972b0348058cad
SHA25613a29624053b1311fa6b43ad8b86dc2f4c7d5397c4dcfed04c25cba9f426d099
SHA5124d58967ee476174015b53c258048cb49bea1ae74776bb3c654cc985fb7f31c3adf068875ab702b1777e1102b0394964ba75fa7d2fdab6c17940a1a10395d2bbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555601387699b9eadbf7c98942e705323
SHA1ccea8c08c8201a84da9518071c10fea21178a572
SHA25624ff7715b4d88c5908c24b8d3d67719da43b5fbec8f9bbceb58500de33b821e8
SHA512886e3e27c5dee3caed7bb381e77adaad6870eaf2daa0921a3eacc335a1217068b8d282248e156b0cdc099f296070048291afac0b607cc89bb2d3a0e3d7a5cb10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf949dac056a8f47176cc4418a09553c
SHA12994a9086874caa296d1c0a3ea7d7c1762067ac3
SHA2565aec7763eff474d354170ea24bbe0da377fb504bd4e357e76814211af1fa14ba
SHA512506900ceee084a2117c520b1d5257f691812187396f09559869bd5da59ed40ee7a846bc124fab29789a0cf87e52a17b91c5a43a05be319551b04639bc8e875d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a42e071fc9bde8eaa7aaec2a3baa03
SHA1580d288612ceb9b1e909129b6081b0c844bddc2b
SHA256d9ecdba594367dae61c72d39d5db3d73e0f3c93a81d46165b05f71718fbe4167
SHA51221519ae01022219204dcec0da7b8e0e0a92a80e0a9e655be8a60c49c9a66348b65cbff3881e5a70a5f528775657670524dc93c9e0aa378b1aa32e6b85c779317
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WEWWZC8O\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
601B
MD5bf488ff5f919c4d31d964b84a2ef14c5
SHA1b1018c229ba1fa9e0b3816f2de7b262d0bdec297
SHA256d9f8bde4bdaae5606a2281e571155b49e1f63d1599d41ecd33c3a458b570ca5a
SHA51228575a0064959d9d5966e0c115e8d5ffd374cd667082e20c04ff395bd04f4444b580ce9d172b41fb4b702378fb4cc5ac9ba4a83cddc5b175b2a6134a17a8d4fb