Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
21/09/2023, 18:04
Static task
static1
Behavioral task
behavioral1
Sample
phish_alert_sp2_2.0.0.0.eml
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
phish_alert_sp2_2.0.0.0.eml
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
email-html-1.html
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
email-html-1.html
Resource
win10v2004-20230915-en
General
-
Target
email-html-1.html
-
Size
12KB
-
MD5
59422a97fa17f5460bcfc130c2c232f5
-
SHA1
19d4a49f3cc8b4bb49fa20fd671459ba88d9eb49
-
SHA256
24de50f90fcf85d906818a95a05f7225f14bffa9568486bf67991e89e0f3348d
-
SHA512
e77da4a25287750db70719354661203535e29f5598ad48fd50f70b3b2087b7f315623c42a8730a375eb22a704db55766423c8b6e90abbebdfcb401da22e635e0
-
SSDEEP
192:dFJx1nxZ8GFNeGF6Zs01dJJwLVw95Ea70:L9xqGHfaYG0
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000e16526123accc4e530e34c655d9543bf01db77ea062f1c53b47571f033738c4b000000000e8000000002000020000000eb70be77bcc8a999fa5b8538bf0f3f9f04c211770e23d3e67064f66b224dc39d900000006734bf5c43cf1c2841033d93e4046601d282bac0f419f160aa638348e13b7f8184274f991b95003b7c34ae099f2487280f7f3430b9ab570c7b8885a65764e05888e3a3cbeb245ba0f94ff560be8b3a463fff5280a6c8aca6c8208b8ec6b03d80428fdaf8e54042d73caa527dc640308b603a8f7be58110358ed819a05277386991a47d0bbd0eb000b09df637e425b92a4000000049249e67adb41976ae8daa4a89f3c5a57ac75f333d6a358580629158752da400623907d00475b9907ffc723f9abad1ece7bccd6017bc00b27b667a5f2822182e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401481323" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{456A8471-58A9-11EE-B710-4249527DEDD7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b000000000200000000001066000000010000200000003538b4335cfbb547ffad96004530599f01a3481e57ae27abd2145edd9c5a121d000000000e80000000020000200000009022b4300e255fe555ee9f48de6e03810403ee07abfd987b3f672d361414da2020000000888627effd5bac3e5effdfc2cd82c70bf655a0518e1c6ce583087a551d76e066400000002f5826abf75d3a72c1d6969125eb9e792e6c562dd9896c68a00d6fdf5d0a3b69a0a2cbdad477e05370c1bd0c3f8f7f1a85e424ced14e0d6f7a0ceb18885425dc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 306b8f1ab6ecd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 3056 2372 iexplore.exe 28 PID 2372 wrote to memory of 3056 2372 iexplore.exe 28 PID 2372 wrote to memory of 3056 2372 iexplore.exe 28 PID 2372 wrote to memory of 3056 2372 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\email-html-1.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD512ce38f50200fbe8b71db9d232231dd3
SHA12b06fc83758c78163a069e41de8ca0eb53bd8ddb
SHA2563ab5be037068169f1983aabb73d8581b4f837fc758dd7d7fe204476933d98067
SHA5125b7079544833d7fd9743d7827fd0d36a24696a4697f0769109cf029cc63bc25367d339f0917d31e72466f6ec4cb033d88902245518eb5f45e4679956993d2b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56a6db69839a2dd87be50d93024019075
SHA1d719363eeda67bab7ae63c49458168ea14f28418
SHA256de0fc7f0d700a3065a34bccda4c51ebb586ee9a13b80a7b67c35d03c8a4725e5
SHA51225ac103a5d06c89c23d908eb67359b6af1daf59ac983d0482721cb1855e456d67ae6a0cdeab4087e68109ac527d9807c449818a7b1aad210d0955db57908f774
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f8df57638811ef2225d975a8b267adf5
SHA1cd59faca65d4ab2b1e8bc012f878e8d06f46bf0e
SHA256ea13b13f0eb5e634b30ed97a983f48f3a04ffc9fa83ee0767e6c66af67831bc9
SHA5120b13f7b9245b4ccc242d7a89b705324ac14f3b771a82b9eea03716f1eb08f9b61702fcabd91885eab95fae87c4a2b0a6368ee1d62e0a011919bcd3b9a9fef392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50fc833071b730279cce8275129d01a6a
SHA1f893ab61fdadcb01d52262fb2e7b6e8e8b27aee5
SHA256002ac6e3759a3f5f316e587bd8c4ba4ee0c71958aefdfa0343e68700c0e260de
SHA5120c57d8ff3f451776d046a8dfba17df51e6f463a0eb07c6ce71b330725e5c1a3f6ee4a6c487d08acf3bb1eaff301de5108912534126d5604f0626cf8a06ec2b45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58aa432d7f054475c746964fc78daa12e
SHA1879cea5abd37cb9fb8566eb2b7127b3738186ecd
SHA2569d933a0c066243a80322dc2efe53b29d999e242a8f70c7651283afe4d5fd7cd7
SHA512ff05c95bc8d4fc670fd0333ba127ae57bb3bf3f4ebb0a8109afc57c1477fc4da19c8f6936b204e4bac9f9b9448e42c0b11ed43c1e33e3fca01d0eadaef214967
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52b77d408cfda2975e2f620aa35ad611a
SHA1380a6dc749deee59b6109ce72fa8ce0b19564677
SHA256e80a1ca19142476ebf7ad3aa7dbc89083c33b4466e9030acdbea2052bdfc61a1
SHA512a77d9564b5441e1c54d8c032072027751a65843c254504c133e303b9494675b09286a37bc193b496e8ffb7294b6feacd02e69dc806401817df5d70611f9e61ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e19c38708284df95d5d75089e8587c09
SHA1c11fefcc37cc2e879327cbd3912c6f523694e90b
SHA256b956bf054327d09ada202b0d58251d676c7f8941a56b74a79cfaf9e944a50469
SHA512f87f69f947df14dca0205f2ddac2aa8cc75a16d1aee1ed1627a2342ce25ac81aa19b253b44ff09f6859eaf73ff5abb2c518cea3b8ed89e3968f35edd98beb565
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ae07b4e1be55c9136bf4dd1eb6e8ee3b
SHA11bbb490f3ed8a642df30bcad5ba921248dc13c06
SHA25684c3b25bd6c4742518372691670f39f470dd9317ba11e2f8fdc8392d1a2d519d
SHA512cdb992e53fb407c9761bdc96b758c8fec73953d0173a38a87eb873c5e691c9510a1680078e5dd961e6af30f0f25170a34b788d219abb23344492336b0748a392
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55fae89c6dd9bb4cb5b77699267a04c87
SHA1ca45f42c9244cb3394d5d6673d7b644b0bef1c67
SHA2561d3d0b8552e26c501876147f0e901c34458e6aec0dc10c7eaad53de282da70de
SHA51273debb83429e2c24e9874acf488d2192bd7f8416e25bb244e87986a6e40487662e06edbc96fa489b75a484850200cfad5e849f2530feae0e25b988845d309ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b74d4f570e504e3b189e1dba5db18807
SHA1ed86a9d9b2300d855949e1a2afb37be90335e4f5
SHA256b0f8d2e064b094cf21f2091132a9f9f97dbf85855164920fbae51bdc8532156c
SHA512a2a1ce6c5ca82119172cc0e122769bef733a759a1b95818e15d3c813dc496559b14c957ebaa4e4f6f39c16f75ca18ad1e145221cf17aa931e795b058fca7b953
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD594fe3d1fa4f3e01ca415b6c4fcc2f7fd
SHA1788bee8df3c497b49806e1171ee3e27cf9adea10
SHA2565ee8842d096d38496338cdd9df46f0d7709314cf7559b4a4299df475331fceaf
SHA512b5eef1e128bc18f11fb31daefdc25982ddfd59bf21e7052f4bbde1a20219151cdb454ad6bbfcdb63e4c2c96527e59a6207603e4e1817edf19b758eba441852ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51985afd43204ddfffa973665dbf61304
SHA179766eb4678bda0eaa6c80c2092689a02f4a326b
SHA2563521f14ae5c193fa1ca6030ee0ba3fc143d08c3656db943d309c87b58ee842dd
SHA51275fa155dae3a06358af0488666afc56f702705ae4cf814ce31e393e5a92abefb09a253e04884cb2ae9b391bb963bcc6db3c6d9ae189a266b2cc8e79179bc528a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54cc98c763790ff3349206e969a0dd0fe
SHA115b64e11e9ca6049fb3fb830e3ad8c17430f80b9
SHA256e4aaaff9bf515ea3c8f9367bb785666c8e54a33940899e21be5ab8b85c5cb98d
SHA5123ae184e942bd61c84b02b18c62eb8971be5214673103ffee94261e667fa47a6bf18a92d0253354ae66628c2dd251499ea221a8606c935764a640b716749161c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bff51cf4f554f52f07340ad1d8871ca8
SHA1ad7d1ab3d855343d86163b74a9d532a464e5de24
SHA256d61280c806287988ce44fa9845945aaa6f32bc6fb81008f3df1ddbfd15b6ff4f
SHA5125c8f843043e75d8dd316cc2524d86d5c9146508852db4d7e39de8ebeacd355699863b933f86e1162345f50385ec942637e0965c47d398343ce9862ede4561155
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51d333d3130736c424c80a2fa4f6fff6c
SHA1d5aed5e8b871415c81a543f0a3193b73f4d97a11
SHA256847b1f9afe5a64254f20281d32b7cc29f2e6c33bfe733db99986d289aadeda19
SHA5128d53b81cabf2e9c58ec1567fe04c054d923663bffeb210caa2f066c334d9eed3e6241abaa476f9babf4ad814d08bf3c21731b06991bbf1b162c234b38bc6a524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d07f21586914c8687939c6301e13ad1f
SHA17540145fb5ea884f0d48cf7336b7d1c66294a91b
SHA256b37eccb7d6237692dc9a2473eb6a49d9c8e78b48a4a245eefe67dcf13579e099
SHA512113f943e843d4f321aab3d0b5511eb5d9a2d636e1568cb7982437240bc63e4efb3550c1af00ab736aed3cdd21128950717ca3c0849b6e7291cacbcf0417c0a2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58d6deae90b93e852519fa592819a92fe
SHA1cfe2d3a670a5199aa7a0a3ff25f8424ca4b650bf
SHA256969560083c96831e86498cd9c7431ea53efb455c35a6bbd40e66d21df6638fa3
SHA5127d477493c04e72d835704191ce5a49622863a7d57062f085cb30d23d84f09419a9522582b4abe96b7484e04d00087254753fd0fdce95853c1c807ed406dff124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54f84b2239b287f4b45984fdc7972129d
SHA19ebad33a5a07d251fe6bd8e8fcab2084760167b9
SHA256c049d500d5add257463839d4a9e13c1b703f5d57e29f5934c15739578bd168eb
SHA512f1ed8c036cf0ad6fb67882e1cdff12993208ee3a005e90f16dc0b74e56f4998fd5248d2df78bfe3b3ac67c21656ae1fc7f8a7d37beb045515205398ac3d70979
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf