Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:51
Static task
static1
Behavioral task
behavioral1
Sample
cd68007ec7f78de7f138ce568d369b1a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
cd68007ec7f78de7f138ce568d369b1a.html
Resource
win10v2004-20231215-en
General
-
Target
cd68007ec7f78de7f138ce568d369b1a.html
-
Size
4KB
-
MD5
cd68007ec7f78de7f138ce568d369b1a
-
SHA1
5ad84daa3872bd8747e912f2efe280cdec9b5562
-
SHA256
4fb28b3698adf8c46a608079788f23911c53e90341d595e5d7c0f2e759ddf5f5
-
SHA512
c9aa044e15e857ffd0ef30cc6faf74342f5bda56f5b51c7158935bf1dbdbfedae42056f2a57f0359d7a71283dc71167dc781b94248761e11b8a3390a3e0e6ead
-
SSDEEP
96:rf9seakGiwLsvfpFFOxUEevBUqsOeN0Eg9jag0MwpZgYR:rf9FaL7LQFIatvBRlVEg9+g0Mwrh
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409543648" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009a9ea8c2133de01c2b02e076cf57a3bf6a8af61f4b6748189f1727733c671798000000000e8000000002000020000000add18740c86572a2bab7cc074aa208b8eb853550e9641fe36f5e3262e150d96790000000f27dc8f2291da8ad7848c085baae071c18ceaf733e061ec2bfb7af733a9115ec9d9319967eb140c6fcaab640c98473603198abda8ae409ab07389f8ce298c5d28e8f4d37ec96e44799981bd976ad808cbf8691e33d58342c5b2a5d11ac5b74dbd828b8e3af9305ee44de0e7e64bcb122761a35d276be600910f0f5ef03bf6e22626ec87b0f78faacdfee0201af5c29a140000000c601008046050837441a1a2abb4864ee7c0f6ab9355093aa316d90b202a895ec9ccf40dfc43d8af98142d8f8488aa794663fadcfb11c2bcc9d0f5ffe10a63dc8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D63BA641-A1FC-11EE-8AA0-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000383668c83238ded93dd663dd8676fac78c6c8e9c01a811e5444a368f253ebfe5000000000e80000000020000200000002cdc5f50bafaddabe7578b4c87a5b1cc7222658c525e5ac13f8d6cf0c929615620000000bf56ee61003155fa24d4f35c4f002f13da577ac3fff93d1e85600b805d3b56e340000000693b20c8420304460c2aca7382655d52156267b7b54c31d7619444aa54a2092d82c7afff72e8dc8362cc01645014aac7218436809cff397fada1781fe4ddc851 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 403dabac0936da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2312 2080 iexplore.exe 28 PID 2080 wrote to memory of 2312 2080 iexplore.exe 28 PID 2080 wrote to memory of 2312 2080 iexplore.exe 28 PID 2080 wrote to memory of 2312 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cd68007ec7f78de7f138ce568d369b1a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b39cb308328fc61352423e9123e68753
SHA127115fa860db5e7448c5496161b1052ec50246e3
SHA25636099365d70c1cfffa3d149e485830e56fdd32a789705e78861d83f56d3c7894
SHA512f81790c147251034189ee7777f6c64afb45efa4a0414a026edf587f53da5facc4ba4c337af8934efa5d5da1364daeda2d814a15f3cd1603005c63be3177e1942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e3f6ea53479e24fbf94f4fe199dc4aa
SHA147639c62a7641fef1c02b7f827cebf4a391a9eff
SHA256882fc487899fec80e9c36f3cecfc48a710710875e1b53b33e3bd9e46ce14bd58
SHA512106453224b77b0ed25e55594bd92c2323006ebf4bc94f98f31cc4e16a2f353af582db3190b1f831c110a66fbe10195c690030751b5e0fcea0709458b460847ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c0338e3788384874b2829791271550a7
SHA1299ce6632c9488f2d5b78a958ce355b4baf2c72a
SHA256904d4b6666a357e7ac85a60acf1b7e8d9e7dba3b84db6a4bbb55c8410eac3fdd
SHA512e00cc732c3770ebedeafad8b8e3052e89313ff1d7d22e806cb1cd8c929d1084805e628c29dcdea0cf204bb0d378d3c3216288864dc40c0f9edc9718caee68a78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f6e410fc569354bd80e13869f0fda77
SHA146324a3b3658f07658c18da7ee4742c47071fea0
SHA25657d19214c4a99d0baaa90db7c9f5253cb4aab0812be843b39ab077f6d77b0399
SHA512d84cdcf144f37c5bb0df298177e8a1e433dd8c4f3881f8559bc5b2c5a92ea44291e0f0d8152ea6777c1e2edd051776f4d8307e4c144183dbe7229410d7474cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bf4ab954c6a4f3186351d4a3b2a564d
SHA10732f4b774da86b593d1040f32ccb687571a5418
SHA256a54b1d4e1db14f77639dbb015c1928e2f0462632519952b4d595903584ad8bb3
SHA51270e909e514b622171356c0398e41acb3c6ac81030df9372470bb4b8d46fc77b74fa8c67124c8e2f0ea2b9e24dbcb3d989f97e3f125c993330ca75b5fcb5c3979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e54e279d2a13fb53604c9eb6bd14645
SHA19934583024478580fb65176b96749c7ce156383e
SHA2564eaa11b4675ea67028a915af8b54b89dee29b999ff7dc33e205cb852ddcce2f4
SHA512ef8c4d49e6e2e9803eb3e3df409985e124aac518989692dfc0b133b141d7b3b02d2f95d6de85dc85c7338eefdd97a2075c17424738eb0f238e7823d96607248e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5174a6b654a34c9b570e93e4865b666c8
SHA133672f927ad56bede643de66158d5c3405898ce3
SHA256e7aec050be9300cfce9b8bc1d97a433bc4a1b66ec2f9224fee7a00181473ac7b
SHA51263f3bebb1a3c39d894ad1733eef135d096fc4e1d307065eb49731df86f800e6b9e00dfe1b9447571f48c28c81aa16ed800590e01c31e317151276ea923f37317
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d4542f7e7847fc212c7d2f32cd0f3995
SHA1e6c00dd98cdbe5d2496adb4c9375198009ed1178
SHA256e7748867d208d2f1b957529f416daa5e45276343496c86e3aeed6af6749759e7
SHA512b16cf7eb749e3c3ba3940474095b377fb48e760d8ce27f744ece60e2ae02a4816c08695b5102654ad9c343c9f906c50df9a38833ccd9f34b7545e4064769c546
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554a0bbd6cb2f38f7044c6487cd6155dd
SHA10e84608d2414d4a61dd731816a4400016965ace5
SHA256d9718711936d82f55f21b1447a5fc8c22e1661b4059d98bee85bb206b767860a
SHA512a1c61ef86400c040a63ec8044448b7738c8ae2a875e048c1dd8d6813b9d479902c5c009e53c8c49c6a407129e077ec8093ea4ccaedba86fa089a363693087dbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a27513be392f0b4af34094c4b9e3ba5a
SHA1f2a3826267215fd6281eff46d0d013f2d91f131a
SHA25612041aababcbc3043e0b51090c455e0036592da5e2bded64e9b57882e609a3a6
SHA512a2d7d34b4c65d63934687af52965750a2edbe39de672ca68cbc29f2828abe17624fdde966d7e3cbe5837af4a7d0611f18d2e4dfb21c8063e5e554329bfb5568f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54028fe1687f7cfe7a2850c65f5eb1477
SHA1b9d286b955014c397854133d55b3b0c99b4bc6d5
SHA2567d0ad323da4e38a43f7c7d306aab15babb62005076200f0fb9312fdf61363f8f
SHA512a605a5f1ef262660acbe1a1899c4a33d888becb243cce0b66eec5b87c52d3ba9797036459b56a393141ac235ab51943de04043dac8d187fbd7b81f4775a3824b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ee9d96f34a5b027fd9cd50da2a9564a
SHA14777ec524b4c99051998bf9eb33aeadf50ed9b6c
SHA256b0f9d69c3efb0a81bb4d088ae3083a5fce016d0a8b78cf9f1750610b3b82ee23
SHA512499ddec129b14bd4fbb0eef3c9b609b282dcbe18eb630ed2ac0634f1f2e01453c7ce2ea7f51d56e159fea702d5928aa3303a958f2fbba4c2f6ca2768b1d34303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e22fa6b46e4e7f7f88aeb3857f3f3a74
SHA1be9895d57e0e0a3bcf74434b8f577c9903d87fe8
SHA256315d4ce1739c76e38a561cb5759bb2b3e2610a3b4ad12fef933e78377bc8a6ca
SHA512277b9372ee9aa3728103083e34d960949f73638e6ad8478fe0a114e7245e128226b1834dfb6ab78ebfb616e514f2103bec44ba1c87a25af6a6f1e018f7f2c69b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f403ea709f7620fbdfcf4b432f6d09a
SHA1e2c40f957af6844b30022da6a792785c891fafd6
SHA256c1985d2816d24948b652b9071236499b4f38e314937cf52e58b5b558b6a34a53
SHA5125f5906d7f7b05b609dd98120b5b2d3c322656dc9bc690d07bc52d4da351ccb287eeff349286324a3315c10ff5d87310b421215b526651958c76d52c589208f2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a83c1681cfc3eb0e303155d188d99d07
SHA1f663bee0459e37af43fd210e86432d30bf0a8246
SHA256258c609935a145be3f51deb91c9049ae6ad1c0f9d4c566a494002235a99ff60b
SHA512421ae8ce3b69269fa28713fa2e43990ad4c40328c70bfd974352c5865b7415eade12a854f48d09c71b9c8ea5888365f5ad5f6521db2ba617a14ae2f01c1e9de6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ec311511e87421736cd7267832f047f
SHA1c3616aaf11ef2ce84fa928b9bdc804837d81c962
SHA2568fe1965d6463b2c4344692002dc29378516d8bd69953740a77ddab940793ba7e
SHA512e4859f988e4b9b4e2edc66c76e8324d29f2a27386022011abce170e2e28eb13e76031799092bc4071df40a2c92cf3d9536046ae63b54d186e6eb46dbd0096e87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54db2fecc33ce837d2067c56d276bdcd9
SHA188449f6c29c7ae3e1b49a2936babce9d6a89a801
SHA256c80b3dab7c49271fe9167432232304e681c4185b56961f1fe551664a78affc3f
SHA512faf078d33f0f31657dafba05a9e77e70e0cb86ba0073c885b40e00b3d1e7180da54b631159f5db3846f27bec51e2ad361ec31f5a3203f74a3dbe5e71078f9e29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570631a03e4c20af33a76eae541f26243
SHA111459c7fc40e2350cd03e1182a0ec025f407c84d
SHA2566b7731ae2cc00fbeb2cbd56a183a09e1cf7d0a19d1a5735f85cf19d6ea969399
SHA5122fd14a5a5679cba06bb2702779829a141769806ab9c95339e6cb2e884124bc711ba378f2f66acccacc756b082bd244be8016716c1cd691bf5bc89d386d502ba9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59283d5ef932637cedd5d7a0a0f9eca6d
SHA10e8bf320db7e7b91424cc321fc4bd1ce717fb981
SHA256e27643899c714e6989b2f3fcdfe90451a8fa311ea83d3365e1292db98f6b727d
SHA512bac3fc30e06eb4c8cafca95b52faf9ff13f94471b87f90688b65212ad4f41358e7d40cef2202599e7b4e96ccc03329e187d4373195d65c2cf1e1e887454ef5ae
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06