Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2023, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
1c7f99fbee49b9b96bc1ec1854758095.html
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
1c7f99fbee49b9b96bc1ec1854758095.html
Resource
win10v2004-20231215-en
General
-
Target
1c7f99fbee49b9b96bc1ec1854758095.html
-
Size
42KB
-
MD5
1c7f99fbee49b9b96bc1ec1854758095
-
SHA1
cf460c346e39a20907fb420a91e0f4cdf3b7eed0
-
SHA256
7d6409366ef14773fa678a43533be8121d5ae5780fa909e0c6beab5edcff0d12
-
SHA512
7c21766e73f0a4f7e1294aade1284041f96c239437f8f0e879f0cdc42f51a0bde1a78d34954eca496bd3e340e99f38fdb4bede88c5ede9310ccaf0e01e904433
-
SSDEEP
768:/fKXIkcluTMo1gRvoI/O3HCulkM0jMTl6RUz2l2r:/fKXIkclJogRf/Opk4Tl6RUXr
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1747997935" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077014" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de622100000000020000000000106600000001000020000000391c30e38fd5879440531a5d5489d9876ed34fe00d1466f429ce2b9d66645253000000000e8000000002000020000000323bef1824609b2582f95143331af537674f2eb32a58e6b2b06bba444122b24420000000ce8397cf3ad66cac0d77dff0e61484e6d2815650c815e39f17a3eb879d687aa44000000091fcac43774cfd2cdf932e729034e7586947049a4d29a0dade308a1248ae549a14f5cd46237db764ceb1cf50d5152b1684811acbf39c769242018481c564bd98 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0c8b09e9632da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077014" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1752061045" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409767420" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31077014" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c039b39e9632da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{93D0510E-9E89-11EE-9ECD-FEBFAF1864CB} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000cfa71eb1212ca24fab6a788c17de622100000000020000000000106600000001000020000000490ccbf124f21d558e27c9efebc9a718404b1cf80d1a3e9345457d4eb1db7e90000000000e8000000002000020000000475f9318c1960216acaa805417a98a27a369efdbed18ab55b276eb41cda27aa420000000fa77f2c60d99a4152601ee54d41a0ce3713fffbe0f9312f37e3754c09cef4ea3400000005dcfe4a99abc41dc8fcecc6759ec19f9e6a742ba0fcdeec5a4ddba4ad4a5a2b53e3f451c356df34787ad6ac4cfa771cfa403e7c1fb40cbff3b31d00a022ab461 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1747997935" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2424 iexplore.exe 2424 iexplore.exe 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE 1388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2424 wrote to memory of 1388 2424 iexplore.exe 90 PID 2424 wrote to memory of 1388 2424 iexplore.exe 90 PID 2424 wrote to memory of 1388 2424 iexplore.exe 90
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c7f99fbee49b9b96bc1ec1854758095.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_C3562A0B8E0712C60A833D20308DA4F8
Filesize471B
MD5ffae48db55fa086fdd33a506259e261f
SHA10d51f8d471c0487cd9baddb564636dc29c2fd1fd
SHA256fc11f0ce7ac933bd580b91a7900a6c052b0c4f908ff7eff2ba0dc295a70e40dc
SHA512fe6aa5120f5a5627e1ecbb5898beb4f471326b6cc442381d80c9544b42f2d5016c5b55e87036aeb5c6dad6c2c659a478766e62754a3c5221974a2bbdaf276893
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_C3562A0B8E0712C60A833D20308DA4F8
Filesize426B
MD58c0c48205798194d27720725a489f132
SHA164d9a598ec43d2fc407cd033e8990f0b5c5b0d56
SHA256dd8f87e3d80463503e056656b97157218fbaee2616442a8ada9de939526afe40
SHA51217b70ea642012c985339ee42d9eb4787f15b0029beff00b925b99035b08dbe6bbc5b4f83938ed4f6a9fb8592984d0dd578d4fbc4e0d26c6b3b129a8e3ac22ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_C3562A0B8E0712C60A833D20308DA4F8
Filesize426B
MD580f2fe144e7436b750bf330da1c54d3c
SHA19c13dadd3ae278d9db9eb1bb4e304c4e753bd21e
SHA2563bd8ef1a983e20da74de7000b439947e0fd9a32531bfb4dde3ab8af291909515
SHA512a7a87ca0af78c1cc52d7c930cade8dd2acce05fea73d7b9b1f62ebdc0a3c2afefa39083b37d14d7af9e7ec0dd994c3a186c1e82c404ea04fd85f4bfe8f43069b
-
Filesize
5B
MD5fda44910deb1a460be4ac5d56d61d837
SHA1f6d0c643351580307b2eaa6a7560e76965496bc7
SHA256933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
SHA51257dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1
-
Filesize
94KB
MD54f252523d4af0b478c810c2547a63e19
SHA15a9dcfbef655a2668e78baebeaa8dc6f41d8dabb
SHA256668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
SHA5128c6b0c1fcde829ef5ab02a643959019d4ac30d3a7cc25f9a7640760fefff26d9713b84ab2e825d85b3b2b08150265a10143f82e05975accb10645efa26357479
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee