Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 15:49
Static task
static1
Behavioral task
behavioral1
Sample
z3hrs0sqN95O.html
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
z3hrs0sqN95O.html
Resource
win10v2004-20230703-en
General
-
Target
z3hrs0sqN95O.html
-
Size
70KB
-
MD5
a0441d40079c5bce056794a7b39ac1d9
-
SHA1
1fe44345bc81d9cc8c361be5b1151d65f702df37
-
SHA256
9d74cab8eac079886257d80035386edcfaa312327ea210b8e4f1d00885720320
-
SHA512
927bdd72a69e479160b152936c005e4825c21af852f5423f517ce0e6a6827109846cd304d277be36e71598755dc1da3fe42aa02672a2d0769670e659fd555e3b
-
SSDEEP
1536:+C8ipu3X221f6I7PyHL0N9fuffWle5cU5XqVckUQJQDt464Q7UhV:jI3X7fGHI9fuffWlU5XqVckUQJQDt46G
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7B786C1-41CC-11EE-837A-C20AF10CBE7D} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc63000000000200000000001066000000010000200000005079f0b40245c5f155b9842622591dddb5bd54bb35ae5d40eb76d29347824264000000000e8000000002000020000000feab955e1586b8c8f0067e869c4e3138884aebe95195dbb7919e870effcd08c2200000000c3d79449d6244c3756d97b6907f91bfdddea240193ab0dbcfd2325f429ccea04000000096c3b37e1662fc533b6251655515a088212eaf9a29690e3965cc436f3cd661a0288fe4e5fbc1824d40186d4b49590b22de9bc730328b9152c04655d1c4656168 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30691cbfd9d5d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b14723a8e389564aa88fef2378dcfc6300000000020000000000106600000001000020000000a7430e17d95b74247f9cb6da1c1625b933ddb45c1461af47f2426eeb029fa46e000000000e8000000002000020000000717610e68c3edc705df6baf30204b067ca667c67af89317027cfb06dbf5053bc9000000087be0e4afbb63a79caa8cc1dce4ea3775f85ca1e8b9e9023046147efee2aefba3c49c3d26736263b90b4074231b844c08f6eeb121e786f9d4f1fdf437d466a040011a41e1f029ab1b149779386d35536be0ff29cd9b2c100ac52a83e81a49c51e7f613376566216af852b626dc34673a5825085b43ca5750473b31ba75ea01ab14003ff52cae9c3756242789b2b4b486400000000013ab735f2e15a4b78aa47678507a59d102e52ec6ac58f759a7ea6b88feb73bfe2d0c1b5c13b8747bf10e2308ae8bc84afc9c0e9a3d09cfa4dc63462f8ce86a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398967689" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2444 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2444 iexplore.exe 2444 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2972 2444 iexplore.exe 30 PID 2444 wrote to memory of 2972 2444 iexplore.exe 30 PID 2444 wrote to memory of 2972 2444 iexplore.exe 30 PID 2444 wrote to memory of 2972 2444 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\z3hrs0sqN95O.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e56ec378251cd65923ad88c1e14d0b6e
SHA17f5d986e0a34dd81487f6439fb0446ffa52a712e
SHA25632ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0
SHA5122737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c7bf37e11cf56f42987a8fd64c5fff3
SHA15dfaf7519b5face714d017e4e6c05e2625973eb6
SHA256e20e9de30be68536f7f0be5b4b62b93e4d79603afc6c2a1b177e8d1c3c8ef940
SHA5120842fb0a74da5d43d338e70f3f776973cf7d9b926dbade02ed6b272c8c2c2eb5a7028b1a352b54e9089c936dc56d3f657410905c1207da5b90162fae325b30a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD577c3fd9060357c3d9de949f088add68e
SHA1cc0af02a8b77bb6b2028bd4588a8d354d1a31f42
SHA2564822b56bb3883aa9c1e7463bdcf7d4c194850fb4df77393fc0e515e8e0f4a989
SHA5128bfcf594bb9acead78e6e71949fd633f4c9ff8777e17bcedce977cf1aaaccb28a92a5aa0e693294c73714ef74ad20e435ab144e5857dc01039b4fb1a016834f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a53c864c725471f416cbc519979123d2
SHA16147ab54c6219ffaa8be48bb76a91cbdd0da11db
SHA2565ca3b115b28a565e5971896c5ec90ba27a7b0cabac44f3329c02b992560ebd57
SHA512cd7eaeb5d737b07b1788d0c7f16f05c74df4c71ca393264b7bde6b57670ecfd55c0c89e1f9b9486e90e348a714cb0e7677506e42df27fbc1b93d98a99b9c1d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57bd22d6bc2133149e89b5a3ac90acf0a
SHA1ccf7d1c0cb8948aca2438a5d2e2f8b2182188abc
SHA256544876c754456ce137bb2801a3dac4c71054babbbbb7b43ea01fd35242b65a04
SHA512f2747f583a55562b51b795e0fd95671cb755544aee9dba441848a755f29dba9cd4aa5d2c365bc7d21a77254e5decd9cacebc655d95da9db6be376ea04ae079ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d3f1a3a6f999041c24dd9ff413ba4eaa
SHA17410972bb0c8b436a1a8bdabd76d583ec2b14608
SHA256d04fe7a9a745866841bdc84ae1a1a0570ad44ed16716c31bc351053beac98c4f
SHA512bda918750363dae0b05ef26ff26d2a80853904dba3e054833883ddfc031d13b7d159248827ad53bcebd55355e919b7da1110318d49267b6ac8e15a6b7fe8cde3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52662d2a3cb7c4c13d77b2180210b06e6
SHA1671b86476f13f2c0bc4c7c12aa6561094b7a5f3e
SHA2561debdb1c89b02c7e546111bd2e398a58c6c285d676a166ce688855cf7178ce5b
SHA512a1bb1a8174b89bb5beb52cc11a4b85009d03e4e2cab0f345c448112a12a794de846b308d42dad63d07d5339df97cc5eaa0ad578b0bbdd29958f80ce6031be2b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50e37deae195f39182423d6d605207083
SHA12b5f693e5237aa663471e84f6c37193b8c99c077
SHA256bfacdd90dd287624f992551e80909c9c1a0b63964e4127a096093f2a505fe0b9
SHA512183e2ac8cf5c09074547901c4cc8050a4682109096437a5420a0932bacb92f8fc19c6ee8f7f9a9249bc329a5cf5c45a7290ded67c784cb8a18583a0825bd7a3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d670f97b9798867206bb214f9e4531f3
SHA1c2a157bb9a28412048ec72ecd820271f01a69073
SHA2564878ab9dc8247d233b0dccbf3f575995115ba4c0dd0b30d53535910ce81d8495
SHA51267238f1dddbc8242ede5eb1c1a9f16a0fdc239f9a7511ddbdb87d5dc705621baeb2146731439f1a32f1549585e945f37fe43ec93cd58c9b334ae2c71cf797f26
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
163KB
MD519399ab248018076e27957e772bcfbab
SHA1faef897e02d9501146beb49f75da1caf12967b88
SHA256326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9
SHA5126d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103