Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 04:21
Static task
static1
Behavioral task
behavioral1
Sample
62ee79934d4b1e212e4753109b273d81.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
62ee79934d4b1e212e4753109b273d81.html
Resource
win10v2004-20231215-en
General
-
Target
62ee79934d4b1e212e4753109b273d81.html
-
Size
2KB
-
MD5
62ee79934d4b1e212e4753109b273d81
-
SHA1
bfc9783d0962bb849e77d03869764fe75736e8b2
-
SHA256
3432ce230836e3342f79eb40635b37c952ac1f245dbc4bde7bf5e6bdd87eb07f
-
SHA512
f7227ecd6684f5a2b0f87aff896392c13c5b2a3680ae3eee39714581db26cadd033e9cbf2046486ef8d6f40c05e1b6f1855efc9c6e8200ce1cf32176cf3ecab0
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409393518" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AA87BC1-A09F-11EE-839C-EE9A2FAC8CC3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e27b20ac34da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e3e07ce7d3fa49a7bc8214d48f3aebd1a47c030a9e2a7fd8f193c45d2b367b31000000000e8000000002000020000000e60992de382cfeafb4a6f2d5758dd74f4116507e225181dbc092711f8eb21fcb90000000bb314bff2678a3201ad04a4b3acdde13af7df502d4e2c836ff2fa31d8c72530a5ea83beb57aa54d408129cb435aa323dfbc87d0bdfc0a6e76a10e0b1fd672f11577d599f25b972618656c00a6764a1fa8723aea695f065319be7b7890bc1595bb6654db16f5a44fe6d01efe852f266da11d040c191455633d84cdf11eba4ed2f9bbc0531483e5bf6e68cd1616d3940ec40000000985a681902bfe4f8fd9c16809faff7c98754779421e1dceab02d91510c04b1f01f61dc16cd21c2e274fc17ac4162947814990873547ee15819e34a1e65f33d9e iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000006470aacf228edd207b39c66fa2d6a6efa10beca0a5ef0d5509d44dc1d721ca94000000000e800000000200002000000029a64ca6289a334bb6a1ec63c7bfee6454bde1ab99542465375fdf0a6e740fab20000000224d18d332470109502e5e2a7b806eb2756aaccbab1e78a99b615d93c4a1ea8240000000ea67e77d384e9c540d6e6d2f0d52176296767f4c476ca4bb1695429eb9db912098d61ac2e6ff429c876ede64f3e55400eca1587ebef46131eeea50b11f9a89cd iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2296 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2296 iexplore.exe 2296 iexplore.exe 2416 IEXPLORE.EXE 2416 IEXPLORE.EXE 2416 IEXPLORE.EXE 2416 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2296 wrote to memory of 2416 2296 iexplore.exe 16 PID 2296 wrote to memory of 2416 2296 iexplore.exe 16 PID 2296 wrote to memory of 2416 2296 iexplore.exe 16 PID 2296 wrote to memory of 2416 2296 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\62ee79934d4b1e212e4753109b273d81.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2296 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2416
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595640f3da58a907f0b099a7990c66060
SHA16f2698d9afce07a5dcdcf4e61b56779ac1b0f95a
SHA25608d51313986f8c1c407577a0222f51886a8611ca3061a44048bbcae82dd60975
SHA5124850dfb707a9abc451dc8743087926156b7783b5fc6f13c211f08a8c87e07ea981c16c8ffee96970a5ea210ecee8b47955dc2ba20310f6d2837051d2f247cd9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c898e318f65fae695b1f5a548a287e8
SHA17cb3b2d9dfc84b293c2e6200d8b760efa07f824f
SHA256271e19503259e7e8e07d0793a08b7f29b46bd0faa6525173ff41182a07ad87e2
SHA5128ed61f0e9a720d15f0f5a5c77e72e87949a89a6d67fd2ce5745a5ecca85d383911ddeceaeec43be5d5351c36d12dd4b0e8bd3604ab0447476e3a65bc619328f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a3cc4010849f104d6c12feb299bfd15
SHA10232ccffa6849d7abbc3e10d731585a8f26d41bf
SHA256b141aa428478abf6a65c5ea5831c777010d453350a6944b6a1b9be0d69edd9b0
SHA5120b1d47afb7e75185c7cdc5f02253881d08dfc406a64e7a97522be3ca9532c1962176ef49e4f0925a37a93757e432d3c48405b2d969281ecc056f7b6627850f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50db580a95abb01d130eeb9d5cb5d1b20
SHA1fa6b27a77a3e501f270d8c0c0bfeb398255933c9
SHA2565a17ca0093a5f51e19e7417d246fe6dbdc49aa8f193ae48d2792d5790872622d
SHA512110aa8a28c7aa3440461025ccc85b9deec2d1f7147b3797ec511c874457b6cbf40678bc4d160a2b05bdf75b7f16df129cd205552aa2fbf0fc301d2550918e0ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8fbba621c2ca6748d5970b61a23fda7
SHA17435d5f951906a4a7a86393eb4bfbf78cfa8d9bb
SHA256074ee9ac4aef9d63c2256fe310640bd36c9fe6c8519ee473fbf22c0a55f73fdd
SHA5126fa310f8b761858b34cfcb0713dc5c9df13f2f5e1933d1d5c63e590acade50c62b0fb5b5c4ff5ef3b4cd926c38eb99d4e9d76df65d9714c4de0d8e429622f09d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505e74f62833cdad878279573b0637156
SHA1af6398821763972c1d7f67f286e4ddba18618702
SHA25663249456a0c45f83102bc0094bcc729fb61d4d08602afe7120a5ec586678ae4f
SHA512bad7a07848e53f5bc5068a7032fc00e2c550df07389e909609c606af7a1ffe873ffb52d260b8211eac7a8b28471154d74f7ef6ce9c02b85fcc005db2abb421ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553418b6d6292a8cb98e4db45537d5e51
SHA1655e6a70cd619f7295098345cf6ab94d561302ed
SHA256eaa76ef7da0abfd231954c4fb0df2fc10ce9478c0acf090b2fa837b61ffcb131
SHA5124ebfa194c4d361180c1b5840ec144cef897f094d4bfce08edccc04c953c92d95d649278b1801f0fec7f69ff22810d9906936cdd0bba7bc9e8d7c36465d732cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f1c99150d0ca8aa5db946ae0d75bffe
SHA1845559e5a2af4579c4c01f29968edade8a200ecf
SHA25616b778418dc75cfe7be5418504b2a1ff2149d1faebb6195e8994deadf92cf026
SHA51290d03fa41879ed36b98563f74d331c825f91f78b9642fadf79d444b0cf33e1b474cc9742dbbdb24e619b82bf90c8811d65a18ad39674922b30294c8408a62f4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c85875f340310995f4d017ca0c2700a2
SHA18709495926cbfabfa92a5342cfaacbe3788c9d7f
SHA256bdfdb01eca7d6aaaf9191c1ebf904a1f6507c3cc43edc957b7991dfcc03af79e
SHA512fbbec8c876fa81b039b23014a043ff56b867f11025602b0b451e3b81cc72e4697efcffdb2fca5478d5212da0aaf0a4cf2d2bff18ccfbb654fe2672173c4d855b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e411d1a8a764176b1abcb36fed364df6
SHA1f8ff039004026b9cc2680ae40b4ffe25479ba83e
SHA256e8ed47e789463274b1d2e7904c4195a891f8babe667d364a9971b948adad0b72
SHA512c65f06dda1d57a740bb64553f3e0df863570c7cf5bfa2520026d1e347ee93588c14b3f3042fec24bd2f7dc1a7100c1819c1dbf608577957d93f116b93482f86b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568b06fe1b8925963174f0e62513d3d59
SHA1a92f18612172d6d4d4358c8890f3e8ae7b366744
SHA2569ad63b5688ebcc838bd9cc88e8073da48af28929932ab2e30948ac19c22d58da
SHA5128ea66ad48972200e659640f6183058bb499ef5f96b620328234a1319c45514167d76915f11af70570cd47b6fb3469de415b410ef9d39fb46555eb92b3e46efdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b233144ad29102d6a9922c1a0dc6c4af
SHA1c29d1edd7cdb2f2c7693fabf1611477bc685504b
SHA2566ac39276c97f531fe2407e9414cc2deac93be81602a6d346b3d89ddbb989ecca
SHA512f2c897d365a56c885c29e4a7e1f7185454ddcfd5f457c8bde531fa9005157d8c88887cf645c9136cb3cea54266bfea7b63016f1539e4f16936f43498b72e4300
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f5b1063c08be3e01e2ca331378ae1fc
SHA1964eda81d9089888e77575985f29960466b5bee0
SHA2568469f2d57bbaad423332d9f671b8dd23d94be097521b41840c060555972cb7c9
SHA512c0c75da1c1246bf198f7875fc8f1bf72f6dcfe8923c6d0b1609f921d0de652d400c4f4d91fa17e86e24350d1a6271d759c33f30c5dce3074f8e69db928e3a560
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54405f0ce07c1b6e0133e258c2ac18fa1
SHA1b4b6605640bde59a5a60a89286cc04593199b4b2
SHA2567169e91839850825c68ada1a9a6514710fdad388f245834a4897486f76bae3ff
SHA5124675263e1d0c3471af39448cdc6d4b7a69332fd064b149550634e149f0fd05a536e9ea371a8c0f042f544d4aac9db55e2e518d2ae9cf19a4102ebeb011c940ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8f82a6fcb88377a361086ecbad0abdb
SHA13c0670e31ac323c322c6f6215183865887465f38
SHA2561032f10115af2fb875bd0589e3455868c9961985f13ba42346f05920cbd94263
SHA512f77286e382898ad82c8994899dd4f3e0bd94463e418d610418791060ad180bde21183b275db4240b1dd4a5ed3449e50196938be0bd7e8adcce20e25368c1526b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6eb555b3a6b7c876a8076ec9effa7ae
SHA1706a01ebc6ef6c4c12c4c1f0b6b1ce904811578d
SHA2569ce79a0a9d6957cb2a6cbe8187fe8f2b9b7b1079e8542991dcd8997816b10a92
SHA5129697a35abeb0fe7f18441b22933c60b2a484774cdbbd37a03a19a28b1b36f2dfbb2127a9f49e1703be52cd5f87da1c846a74d0a9a0d0f97e2e5441744a5e6d07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e1e415e20387464c34912066179c64e
SHA18c5a7851b896cda1c394f47dfdeec9b06d548020
SHA2562245440318f7f15966dcd596ea62d118056bae7f6d18b4ae76442f8aa4ad5707
SHA5123a487f9369f840c4da65401f52663784101b5c2f6d11cc9a08847f023c0886acaadc54225510dba61c177dc212918a8398303d55f0b8ecbaa6a893d09db41958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d817aa141e2a2b3ba91f3f4b673b82a
SHA16a65f9508fc1992c5b438c40d59a07951ef3fe5e
SHA256758dc40f12a9cd4e27f76ad7efd69983ab748df187c54b1f8365eaefa9b82432
SHA512b76ca5bff9b589a7463828f1bd4f838a17f055f858b30d7c806081896606b997b9d24594393d8958aa071674b92cbd555ae59ae2a0d075f0141a034461b388ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e58fe5eb8fc1241bdb680be2e75729c5
SHA12b2be5da13b3de6aaacee0b568468b4987870211
SHA2560153f82e7bf765a19943625e1d64c47f616c3aecae39c77fea0331ade3d4d993
SHA5128bc13e72e656375546cc2bc827817767a403579acfd068a6b042dd543c51bf2d509d2c5ec24d12644e9c32a9010f7ba382b4dd156a2d00e674e634d018843f6d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06