Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 12:00
Static task
static1
Behavioral task
behavioral1
Sample
🖨SecureMessageAtt.htm
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
🖨SecureMessageAtt.htm
Resource
win10v2004-20230915-en
General
-
Target
🖨SecureMessageAtt.htm
-
Size
16KB
-
MD5
eec682344a6ed3f9f85213d34da00d37
-
SHA1
99d5be29b35e494b6e86216a6c0963793d669b26
-
SHA256
7460cf41c9ac2740acbd90c0b18e8ed1e5422963b33a9d4f3e672c6074cfc22f
-
SHA512
0fb595aef5e977ed249a0b16107cc7905f56f9ff0cb977c0774e731e624ce36c761ed279654ae725a561361250afd5f38d6d2a5f4226923dccaedd05e21294ad
-
SSDEEP
192:5Fd7UE6qn2wRBrA4oo7qB70B3BeBwTBjB6DoBTj2kTHUVqLc091JHQjGf0vBGEWt:5jt6nweMKDMJjUVq/1fOat
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403187493" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C31AF1A1-682D-11EE-B32E-661AB9D85156} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b0000000002000000000010660000000100002000000027288c0bb7569e906d11ed1cefc60287896dc28dfbb8dece4b0399d00ec4931a000000000e800000000200002000000025528d6fc4caf8dced34daba3ece7a5d601b849f33356864941c1c9191a8f78720000000edba1595e317095842fb72fc024671d460797cc872953d0bcc867673c113e6474000000089e25b2b22f5b1ed6f2d510257b2b05be0024618f0a1f8e7a84f8ec7b54a1c6fcbbe5aee219e25fd864f82140ddf25e6aecf98679427b8f37154a4de32679e70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0d5ea983afcd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000ce695a891c964e1cae5afe3781bee0a5e53e1caac37caf66ad9eb4591819fc8a000000000e8000000002000020000000b250968345325de70c4639366d4dfa01fc9d5227f7ff3e430ef5bdacdf0ce21d90000000034deac204ff264947ca26a2fbcda0c1b59aa6332ec148d29a83d8cac67c867a77059b24e843252bcb45c9731c2f586913a7f0f64225d959a0e59445d392f0c40348467c584dbb9c13387d5a7b43585457b177c86d86e3dc0ba3619ffa9a69fab2a407c11f972fd9f06451a95ab5b656eb597c79a4aa4d51c043315923e24d777abec428a5112d4d4dd4c6bcfd64103740000000ec4e40737ad4cdd75d296aab81ce3bfbec787614783ba5bab4517b8a785856ddf12196a6a232b05a6bc2bd527698306ed68812defba7bff68efd4311c355d1f5 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1076 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1076 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1076 iexplore.exe 1076 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1076 wrote to memory of 2284 1076 iexplore.exe 28 PID 1076 wrote to memory of 2284 1076 iexplore.exe 28 PID 1076 wrote to memory of 2284 1076 iexplore.exe 28 PID 1076 wrote to memory of 2284 1076 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\🖨SecureMessageAtt.htm1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1076 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD587b279f80e31b213200b265a50cb260d
SHA1b57259d6699a6112204445a6ef707a37a9939dfc
SHA2561d35ee7790e70ce71d1d0220f9d78f2cb55635f25c90b5e38b3e614582233078
SHA512477e3481733a614b4c51c23bb5c1fbe8babdf19d742ad512a5881fd53461433a09be6afd173a6aa7e94cc256b042086c449bdf9cc892df48b4dbda0ce773e0e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cbca0e9df3e62e5a04e6711638f2046e
SHA1c8397c6ea2194244c5ef6f7c25d5cbe043094c03
SHA256ae3f081a15185f758fba4e81b4587eb9fc15f57c92dbc24ec1cec55d21652abb
SHA512ea74ab24bebc89c731c8e63f99f2861cf00c5adbd523aebfc67cb95db3d42e6578136bfaa9edaac99f8c76b5eccc6ab46a2832637c08dc7701a045f13195f77a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ef4fc432271d51c31f6d6796d8e63d14
SHA1c1d8a16c10fbcf346889bc691e4a2215aa02993c
SHA25614f3d951d0b5c158c2713b200af2e13a33ff26339f1f5f978d8f715d3ca818a7
SHA512e7388b221fd74eeb50f79b56ef5e796ae0d63e5c23eb1ed7adfbc13b01cb18554fb3e87cd0261569300679bc2bb21c4bcedc24d99c2c5a24d9c756cae2916b79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5834fff7d6174caa4811df61538fbc0a6
SHA12e216e0c2f496a514462f78477f78aaa4f7a9e62
SHA25694c2638ea7b6c4f6ae01d6812d8dc6e61687e03ebe7dd033441b8f97a9105bf9
SHA512944c05cbaa78bea9210c93e83e0b56a21a65df8a3035828173ebc6e942dfa32e16edacdaafc65418ecda6fd84e8886822a449696dac0cc046db33ec2ba4c081e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54b3df7a7c83595f61c182da174b7418b
SHA157b86b310bd93473ea9d34ce76828241af7e8701
SHA256b181f0c15bd86cd3027a00eacb850bae150af435115ba97409f38deef04dfa93
SHA512671e49529e95092eac56888b02f0ec4ddeaac79a826841245bf09f6173682d3f27c474eb29e61206ffcd3c21c3336a13b7ec5d2abcbce4cc686f431196f2929b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b333a56c180bce6f525d994c4a94608d
SHA1e62a392fd92cb351edd79741f714fd20e66144d6
SHA256ffdedb1d8edfdfc74153b96cd7cf5b4b5b1bbe2c304bb13572f3c68fe9e05947
SHA512f4abbd1367196d203a4daaf35cdd525c3ee0e13f76096b363858fb0b84074285074ab0e2360119f8e44b33151cf1c0bdd76f306842da8ee4103c5ae87eee9cde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57054276b7df6001736ea5d4e12d73cbd
SHA1fc05f33f8698f0fd52c53d14373607dba91db166
SHA2568bfccf75bb116a6de0dcaa6aa5009b202582bead75a89366f41f39078d0d9d87
SHA5125bf1bf21684503e2581c20c3eb1c3bce878244c564e7ddb75d9b1908fd8e8d2ee135cdf7f9c752e24f2343e7d290830a066353527b257359f81ca702ed557d5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5522605157cdabe9fcb17952727cac777
SHA12e12f163adc579b686fe4e9fd9e3ee567e9593a8
SHA256c00d7d7cfa5cf376482f25ebe81de73c8ab4a4d3d5f18705c16a918276d7dea1
SHA5129f551d1405141012c1a71e1bacc1fe6b9b797d2e73348b23afd5a99361ecfcd665a2ad9328f1bdc6ac6549f1acbacf965f0a8ed5dcd964b3eb650485ec8d727d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55220c1de824a1f39520c74fa126fb3de
SHA11db21d8169dcdec4e5d7174bad8f4d071eae341b
SHA2569310c9ee17068a7dbf3ab4cf37e89f10b18963cef05bfa31e008eeb00c4d7f3c
SHA51275297dc1a407c4017d30c19573170cf9e8d94dd3ad07e14759e0d37143fcdadd0c52dc306df19777d9791f64721179d5e3cacfcacdeaaf1676e088851bcdbae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57165a0949d8ee8cbd91ab6c87aea4781
SHA1be67075621326121694dde2ad4680ac217dd6edb
SHA25646f4d10894b550002e3a66707f22b5b58a99bfa895c773ecd9ad74b38c59ef71
SHA512c6017cf29efe25d204d5f0363c69c364d6e367904a62d681b76652a635168f976d078e6e0897bb389126dc3c7ef9a3a7dcd0d845aca4a2f824eca0a215799925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51004cb3d0d2de4214db8c77aa930ec67
SHA115b1f81b23dedabd841f568b22d1b58698ef6bb3
SHA2568cb2b1256dd63c3cabda0edee92fa7785ee4e1b710c8644906bb6d269534821c
SHA5125128845b37505771510960dfcf1e921ce92de4c6cd67786f61e10f9d738d15f35213cc4b407950217f089922e13585cbda4bac4306a342b26e95a3933776af6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f3e70e92a8201b83c888b432134af43b
SHA184402744264a0e890966c919517099a50acaffdc
SHA25645c20ab540836587ab16b589b22f1b0501688e127ef4e1ecbfa72a6f6b2898c7
SHA51279df51dd88836c0987abef9b1f9ba183e5b8a9d4ae2f4a4bf95dfede27f5e17b4b014210ad6c6dbeb4ecf478ecff7ff2265a8756541b267f05272f085ae5d25c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD509f6f03496b417a192b95fdeaad75268
SHA125ac2cd053634476e10ecc4796ef64b3b47c2ee4
SHA256b4b0113c05c15bb60c35840b29b9e4740c46362e3a866c671431624989400dac
SHA51212af99f7ae00906dbe5737c0ca8ae72fd108db485f75956f854773f3fc3a1a0d7196f34a09d5b6503ae06f3d417a9f88fe52bf162a91375209ffed4a2703b2b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD555916d9aaaad888eaf488b52e6456b2d
SHA10020d38e21a5a3233bba29842948557454034d44
SHA256fb925b324c3a3a1e4f36dbc0a66fc7d696ce7a8dce9ef7198772ccbcf6ada96e
SHA5126c8f5d4becdfb9af8c5a99bbbeb36a26ee615689dca39509bd1cedab02a6456b3dc086edab2e9af2b80deea31a5c9deaf40084f28665b7a95ae3fdf956219ef9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD518d5fcc510c7211d146d93b228720e1f
SHA1e9abf57f42f9d5e7536825997131156db2cfd49e
SHA256d02999ba8c197b2dece02bd85a91b383dc1ec61439ada5dd436cf478a6da819b
SHA512d7c4d89f3ceacdddafa84686317ee07d92fe75dcd21812c6c96a5621831acd514d605d2d300037fc1807c00bbb182129f827e31614722d758193acf7dc21d2d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5bcf78cc35f050e4e3862ea426a9b26c9
SHA1b7ec68a4c436a92c333da466b3e0e07280ce3485
SHA2565b09eb1977077e1276af6298c0e40eef1c51f429361f5e65837edb870fcbd75c
SHA512eb76cc71925de43e2bbcd936801ddfd30d6c456a1f3b30e9a4b138a21f7b3da94b9a40bd77a5bd33bf4b70b241072294ab48614d09bd5563c5eb8a4d57ab00c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD594fedb8d42bbe00390d970e42690e93a
SHA1822a41e3e520634ac9bfca28629d0eb057300e06
SHA25657ce8bd16100431bfe0fbff60f2d0d5e571d78df4befc0d270a5012b807155df
SHA5124cd1b59744e06e75aca0cbb07780ee7b008abed5719bed346e183b0ea558e4af1dda16cd98b0354f14b230d6b1212e5ed4a415f0cb09f8684cc7525e71cdd3dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD561622ae601510b3acaeb737c1ab3b522
SHA1139df85ff9c20e9510f0ece99aabe6e000edc9cd
SHA256ff8ed04d9d97aadba33c1d0512d3660c100bac45252229f3dc3bb81574484d8f
SHA512a6a98924405a52050759982aa0e2868befe1abffb59f329274c03179869e6b4a56b4b0e221c46718556eb37b9bed1dcc28e37f63adff7aa2cc27e7801a12d42e
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf