Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
b31556289f888100316dd214fe3929c5.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
b31556289f888100316dd214fe3929c5.html
Resource
win10v2004-20231215-en
General
-
Target
b31556289f888100316dd214fe3929c5.html
-
Size
2KB
-
MD5
b31556289f888100316dd214fe3929c5
-
SHA1
005682b94edf2f733b6a0450baf7fb7690139927
-
SHA256
3537a59718a65a3f8e436da0e44ee80d5854430f713437aa5f94bb9316d5a942
-
SHA512
0dd456ef03beb8b197dcbaf9642535af69b7571710ca397bcd6e4270947181804ccb1a90a8ff3c4030fcf70bc1dabbd604ec55c6d597077e1a82808d4279a8e3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a1b9f2f334da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409424369" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1DCB6AC1-A0E7-11EE-AC02-E6629DF8543F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000000dec9faf49f6a3d03da73788f7a9ded9fdf43f3ec87a3f4f1df5fd9e05b87fac000000000e8000000002000020000000fc831d1ab14d71cda633b0581a989fbe25fb3501f5a442b00574a8e5a175a18320000000f5317bb57db259164c38adb2bfa672e5658832c940992521519f91cb58116cf64000000041bd10f892b82df122d1394b97ce82222c249d8955397ed7680291c5c6f3657e2ff5ddc75c7247941fbf52569916930be4dfaa5c581aacb47d4d23febf530b1d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000579087425aa97527cc1f7bc5399b4da88843e23edc6aedbc91afb7355682f22b000000000e8000000002000020000000447d619333806aa03b44eb40bc15c0c94ced4a56920bb51273b45c818e59d21a90000000e29d49fbb6aa9f53dd20960229e4b5ff3953b7bb09b0ad15ec62a76ed5e719fce11000b25c89849eef29237189836edcbaa10098304a94db32561c1e835603ca63ab2c5561d7d6c36fe915e3e0f6f3185c404dad44cb9f9d997702031b63efd5f6c399ac88f81fabf96eb0ff007f32fafb24f965f2422e1852f35931743b125800f7e49679b4b808442697c6b5a6bd4640000000fc49a883e1485039f320c6f79164f84f38a1e01f919835963969745a1666b2619c9c4380a52fbb2a6fef86b8fc3a1e2f12dbc1713978d46b8bc3ec62d04f8143 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1988 iexplore.exe 1988 iexplore.exe 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE 2420 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2420 1988 iexplore.exe 28 PID 1988 wrote to memory of 2420 1988 iexplore.exe 28 PID 1988 wrote to memory of 2420 1988 iexplore.exe 28 PID 1988 wrote to memory of 2420 1988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b31556289f888100316dd214fe3929c5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b8d1d3510c67570bb15b91ebf7ef0b0
SHA1f5a3aa828dc78bfb9be40bee504ba9c1ba7ed835
SHA2565c15cf3c0d64994ba67c387a5c9774c1fefc9344d0946b776895e95fa83a6608
SHA5125c9b1920fcda78a802c69047b46bae4678dc165a92221f02df144bc2939babfd664f36d0c94af7648bbaac2dee3c9d3b4b23402d9ff6c7f13e25541508bf5bda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540765f83444efddc5c310c478542ee1e
SHA1cbe9ba0fc7e4b3dfded435f238f4578721397bec
SHA256cf7d90ad07150a674e21448435672fa3a456e0431e630dffd0dcca125afc0258
SHA512abc5cd8f8533a27867aa237801f80508eaa4974fbaf9104d7fc1e82e52c2bb91e7ed03dd64a256a4578068c2d6803085cc488accab380586dc4938babea1dafe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512f4ac3855f82f2e808c6b3477eabeee
SHA1258998a420c9d18ce09910ddde81911be7ec1135
SHA25628033c457befd48f65d01e1488c1aa2926b43425514684e015b42693330d1cde
SHA512ee60f02bbb4b521a96c215bb8c3e752f1525a74be59a4ec522e55b4c20f0e9f604f811654d9b806e828f0a94ee8f5dbd443c219df8ebe81217c07e8c585de8dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564267c5a49c079dc7a02e6dc8fd45b61
SHA1fef64199da72af251ddf33bac6b5374ae11f17fe
SHA25658dabd97261a34a6ef1a559daba12a468a8ca91eabfe870201cceb89507cce1c
SHA512efcd30a4835ecae1395b2f83bb98658b271ac51ff93b26c9bd8d9f71f6ae9440aae265b6076e2a663746540af6eaf7468d25151410cc34ba76b8c728ce206064
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f7d4fb293eb10c3d92048073b70c65d
SHA140fd3e560b5b8e355685b5f79a19e071b1031853
SHA256fd7571f39360322a4c4c941f24798a62f03cd32b908029bac6b0edb1b5fdcc19
SHA512695bf6329b23837bc82d6c0a5f4d542e10c2363237f2d74d3586a583925f9506b393450cf6343324830b804e91e4776cfe716c31b6e7545b3e4490d4dffd97f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1a09b28ea8ef61f281a39b973510c38
SHA160737114eadd9184f87c4af483b18abb8471d3ee
SHA256afbc8880cebd0bf5a0f539ed62382ff254b9c925ea25d4b6b4c3e533fc4ea1d1
SHA51277d9fa4d6d8d0611fc99d93e105c43e12291894d596297d9f4a2fd92f8cbbc3f2b66642d37fd62ffa12df898b72f63c36a02366f261f55982c07ce1c35aa3715
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac2e0cbf46f916c64623697571a80c7c
SHA1f5b1e84858fddbdd28e552c11666330253a723a0
SHA256f37ea534773398c0f3d951f8914186df3193221c29881979b9e47fbe17ff5259
SHA51235ab7b4c879da17990784e0ecce30c79d73e6698a86a009cfa5411b6df783bd9ad88ba3e5fc55c7f0cbc2b09b19527e2791484d1c9982b179c83e1563228f002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f2d5030b89690849626b2d4c2fb92ce
SHA110638e414fe3f07496bb3273867b917e8ba95ac7
SHA256a88d582fd63b8459c645ca82e83fc2ff8d4d961e800cdc1f35d3daf543867111
SHA512a8a2b161444e0fcca14f451a41c579805168d8c980299296da4d7bf6988201b8380d35dfacdc49ea37798dfa88abd8501686714f318444f9bdefc2ffe77d451b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b10a9c767b4a00321df675fcaa7c575
SHA135a98f7df015723548605eb53469932b17b27363
SHA25641df119e0ca91571a47178df9ecbb25ea2c8febc010e23f44fa66c6f356c7930
SHA51247d53a44ea2aea10856b5e5286d31725098c1177868148544f39dbbbb08b8d34b7b1d99cbde8016b0f3ead06a754d6d818db01c9a9dad8e0a99e1833c3d55b6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553cf26f97ee159edfce650514a2bdf74
SHA144efe677dac275f9d9f59d9eb4ece99938dcb870
SHA256867e41a645e39c29e9c30a8b8b8a68e3e322cc56f28330335037d24a943e853b
SHA512ede8b1a461cbd7ad5745d6f3cb938c3868b09972ccca7c632710af8c5720717a9d24c649b4a69590d62f4e7e2901b719271dd7124cc55d7874c2946f91d95a21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56de79ced148306a2988e867d4060d1b7
SHA1537a1ee20941e598c8679b78bff44bcc56b22858
SHA256f08843982052f7ccf8ca9988d9d6ac77bac8695f900e273f69954f3b1b92995a
SHA5123da13829c709ee627eb30b641ac01f59552dbafa4f28ea42a8098a37f3e58f16f556c528a1181ef32e56fbd5c2957022fd7aa88f4f646aeb3382b0f164d81767
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5758b30696e5316b2382b77b099498064
SHA16c1c6e9fbbb2648c1d611a85559a348bb1fac344
SHA256451bf2241787fc1bffbb8ce0bfa63372f9229e960e621e760e2df57b0d26871a
SHA512c6f9e3660968426ae2ad816cc0c0ddccd1799c2d1b53677bd81612f1fa2988b0e963686e9c12d1b0aa077c33d199f6b5894dbac54f7ae0e55f448107d049743a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eaf9192ad160cd2406a673c7ca827b7
SHA1cda0cfe7c22f865a9b5b81c49bf4cf297e1f277d
SHA2565843ec31f44a44a583b77b92106695e0eac3049d8c7b99000c03d6030fbab5b9
SHA512f43900bc36d40e2bd10abb8e77012c67035447b995f462f2d9dd6e2a66aa1c3cc33c00f25919e96245474597e0fc3145c53b27c6ea7113d978278f3fb06500e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb15cb8580d8f5cf2e7f5340f00f4181
SHA12a6e85ae1b25a1b6b296d30362da7ebc304f1ae5
SHA256057694cf3fd1da7a7422b968a84141b86c0604995a19b015e8b8a28c83efb03f
SHA51289f9099fe4fad2efa2b8bab1d6e439c078e306662ec5ccb7f5fe577b1775d33e57b55bae3b37f2ca5552ccf05588c744feee4c47d6ea33a1f7cc76ad3b337198
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf5b28dff081029f3e83026b7249d99c
SHA1fe6e3f3214ba2c0329918fa1b915f3422c577ef4
SHA256bf20165910acaedcaa5b840d1c609178a962a688e3d38d285699e5789e4d9678
SHA51227161503f8a6c2d25e54ba05ac9b504763349a03045c31d4e17d2ca48be1c5f110467c789520a3530401d9f650a197ab81082b28c5a80e0a028c6c88f2525823
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bcc49fa2de468f9b56f000964875b7b9
SHA15c539f699d406aa5e92275f94b04e01adf997812
SHA256b1d53375a33b757d44e8d07075f3d4f2939d6f324d9cd799f80ca8c6939a6f18
SHA512cf4c689aad77c8af6bd40cd0dee90cbc9e770e1ee897ac9a0c07c0e74a256fdf65a84015700be772e25fb4f7c1f4976865cad4d0ddedf6033b01f9186db40064
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06