Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
cc3c83fe9c7803daef5f97f0e1da079e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cc3c83fe9c7803daef5f97f0e1da079e.html
Resource
win10v2004-20231215-en
General
-
Target
cc3c83fe9c7803daef5f97f0e1da079e.html
-
Size
2KB
-
MD5
cc3c83fe9c7803daef5f97f0e1da079e
-
SHA1
6aacf70cacf2a71ce460f7933cd1a7caeea74ee3
-
SHA256
cd976a3749ff473b9ff6bdec30572e65edbb9abac7daaf731a3b538d75c0a8cd
-
SHA512
ca7c89c2b88d5b014c1c8a13797936c0451cb582a3c686dc38070df8fdbfdddb0b293d7c1f6e1ec1db836c8b1314f1cb24544ae3e8dcdb2a6f0b2acdbbad6763
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dee9530735da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000076d793509a4d246e8af7d42fd69b2d6fe7a6813b5194fa4098288eca9120b699000000000e80000000020000200000000103284319d57b12b60baf499589c32930a89f63694a89090181db43bff59f49900000000bcb02848409f6f2ef6a00ae2d7ab139c3cee2816b1c9c7639d404314ceffaf42f78494ced98e8f81fbc7101ca9d75750d032abc0ac143669a131d0b0fefd35bb68d79ea4f68610030fcd65bbb80586d0171cdcbe889907539ce77e9c578fdcf4fa74134c38db79bcc50ccd1b035093bcefc4e8081844d8ed4c4ab08585c67094ea21fe825dfeb93836c0c6c3f12e5f940000000aae6df22c205fef8ced0dd870842bae7adf22e545326bae585ea0c00be1985418bf7551610d5b55a3b5cd7b7b8d666858cf023429f78da0747af782c5683b2af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7E9B86B1-A0FA-11EE-8C17-6A1079A24C90} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000007c3980641f802f4599efe92c7035841430d59de9970a6062b63679afb1465fda000000000e80000000020000200000009dcc270f6b49e03fd259632329a7ba2cb891c917fbfbfe5f2919fbc4baa700ea200000001537063689cee6bf91b03857d47efb02d6af096be50850ba453aa708e378535e400000006f1314a7388de5303aa27858a8091c6e1c5703f8ad9e546c8654f45ae80ce48a86e9b865a4954f1529b9c82ddba778df0686f6a706a434362696a8e8e81a95b3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409432693" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1956 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 760 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 760 iexplore.exe 760 iexplore.exe 1956 IEXPLORE.EXE 1956 IEXPLORE.EXE 1956 IEXPLORE.EXE 1956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 760 wrote to memory of 1956 760 iexplore.exe 28 PID 760 wrote to memory of 1956 760 iexplore.exe 28 PID 760 wrote to memory of 1956 760 iexplore.exe 28 PID 760 wrote to memory of 1956 760 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cc3c83fe9c7803daef5f97f0e1da079e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:760 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541cb083210f3482be26ee6dd238bebb7
SHA18922ee95007fed9b4df861df085c2857e9663271
SHA256d0a875ae37f2d070794ddc1541ef437d1d544563f90674f94d6fce629fde1f7d
SHA512260c96a996bcd2058c8e639350b4859517774067ea8044632e998cc3d51e5fe51034cce95d9bd986f5a927d9b67bd1c7c2250163be543beed729dad81173d785
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f34d526daa27de42d9c66dab163d085
SHA1830c4f6c3df15d0d9ee23a65e3cef8328ae9ffd4
SHA2565703cec6f95478169d6540bab6173ceb56c76aaa133c2c7a497e476f7f3923aa
SHA512b6bcea350a8e7f6182ddd4560d654c28cc10fdfa5536ce3623a6d760767e2fad92f94d5e66f357803290f7d502412889eb6b87e1fc8cd0c09a0e7ebac3bb24e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fc61f52db0addf5175dc29f65f3265c
SHA136119b208654e4d0766fedffc8bfca492c8493de
SHA2563023b63f2f0ca840eda508e1ffc3b339b40ac7bed5718c2004ac0ac8957ea7da
SHA5127e6ce658d15d8e2986722429d2590680616dc37043d030e33cb4e69d063fbab063490e6b71dbb36d33dd891194a9e0364b82e17bcdb2713b4c4db729df8e9859
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cdc6c00533f2f8d3079f33e547e82bf
SHA11b406d02daa8659de77a5427d46a0dfd0fdd8a27
SHA2567c2ae89fde5f2600006e642f7d8f08dfc02d307046e7d115da3cf6e26fccc843
SHA5120b049a52af8e1d59dd2c9521ad6728ad57dbb25e0a3c4b372823db438e5346ab32ea6b3d339070876317ba2047e0b644214ce9b621725152d63e550aaeeb00b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e584e4f488f4a7d12977e12a700283d7
SHA1534523cdaca3306fe7c5637efed65370516afaab
SHA25648d4500f50ac06c2846f0fde089dd3bfd0dbd790ffe0d25b4f9988c834eb75e4
SHA51254df42f1323aafe2868c2348462e1ae18afe02afc177a506578ce481537d317f16d24593dd38f3669182fe9a3b8b00830e8456a01596ef9083a9c9195b04e15c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55399c86da2b9018e6d449feec2dabd2b
SHA11aff78d245a3ce029d76241115a8789e2b14ee84
SHA256d228a5645e07c934c1b40e2e274a26bb48fe7471142c615b498523b4527035ad
SHA512a4e42da52562bf21d65592bdda4d23c02df7b2244d8e0559815fcb0601de1e54b62757272dd6db7a59b54ef033e987f127cdcfe842c74e0eaa296cc9b4177a62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559bb9ece050ee5aca935316b614d7af2
SHA180b8b9d274c1f258a4df2f3ae63fa502a1bc0b52
SHA256641387c857a1c7cbb1ac8ce718495467113c1ae78fb991bec0a9ba996bc3d0e1
SHA51227b0f48778b1e10b7c55d3a8d73beb76103a3060bb35d2ffd181a4a07a708a9eef55344f4302e88418c1d6275d8b977f520402f3e3be9ae5902d43135c0686e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ba243b3e2a0faf645d9bdb4de8edd3c
SHA1913c2fca8edd3683909afa60e4dcef862fbd082a
SHA2567a37c2c602c90b5fee7479cfe6f9f2e0e35bbfaee6e37afa9ea874031b2757b3
SHA512730f4d0b7f54411fb7ed3d14fc32355fe89c6e6bfa0bd1c5dec66a8e1aa32ead99abfaba5547041f30f1e46902ca015c9aaa75adb9fc162e8ec7e5fb69932704
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a37f6aded37398f22a8ea4452e359c2
SHA101817614bc6267355e47495a651e75c48a67d6e1
SHA25696d40f76884f2f4c34d6cabeea4482f8eda3fd852cce0d804a0a407e03ea7635
SHA512d39f3b352b6c9ed6cfc5068b7a73a56965784ab308e5f89c8df33590636e6e78be9923988264a0cabdfaefc47c08a45cb388263c0b1983de0b3b8db8740f0e74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5045553c26b82ffc3f8a67104bf493221
SHA14a06f20215dfac0bcfb02871243b6aa90373c0f4
SHA2561cc3d395fefb9900d23b39375ccbb4c5c941174ece588a3295302241c7a15a36
SHA51244b1bd4faa5ae205bab5bc95f422e63316fa8a8c0e8604fb3115c914c1e43cf023d8a5bdfa34a52d740f879fd77d6c240da988ae33385acf0568a114e214e8c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ffd03cab5bb26788f8535a3a8146631
SHA163ad0dc03f67a0ed7fe39732c71b5852da5b4f17
SHA256d175ce126073e676efffda9d6b8a8ccf5597fd82bbcd6f2c87a52797c87c589a
SHA5123569a3bb46abe72409d68a2b11e195615aa595d438c6a5c124de747d309be5b7c49219db6bb2415d0db6423604184d5ab0b5b0428e6b84712082b7bb9bd96f44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582baaf39001f571a3c6054ce2d9a9259
SHA10965787a9c124b69ee376966cc754dc2a5a590eb
SHA256db384ba078572ca1b54e65e8cb75c26b73087d428e1a0fd5777ae3b18379f9a1
SHA5121a6d16bca6c1221bc4051efeda82fdbd7d1eaa214da0b954617bb43d57979cada272a86537737c330366493bd83e3c493b3c771649643d4be35c8bd3e6e5dcc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583fe00191207c79935c10cf8b7d2db95
SHA15118ce14c922f090c6c748252438a7679b25b53d
SHA256be22d9c2a360d39bbd1937ba8b18d70620981e1d2c3f71aff510a4c3c2a30ac3
SHA512c3dc8a9d3e70c23b68532ecdfcbf8b972cc4f3cac61e2d575014fd0070e693ec6e6228d79a13dc68668a73ec494bc28e524379b2d6a0032c67bf0d9471eff4d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcc808ff5d5bd64fb11415bb14494198
SHA15c1e71565fb2ccface48b085636a5cf8762c61bc
SHA256d1130a3e2b9ec8aecfc4a4273d74861782bd94bac05bb55249ffd9523dc13158
SHA5126ae9ff4f0af2a12e69978a7ebefc64cd831d1208846d0064a7d23657e3bff8ceccbfaaa39b9c7f65516e5a79ce0e50bb233f5b0635239133a4c7f9ad9eba8a29
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06