Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 14:29
Static task
static1
Behavioral task
behavioral1
Sample
c397c212631ed51c928172e0db6ccac6.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
c397c212631ed51c928172e0db6ccac6.html
Resource
win10v2004-20231215-en
General
-
Target
c397c212631ed51c928172e0db6ccac6.html
-
Size
14KB
-
MD5
c397c212631ed51c928172e0db6ccac6
-
SHA1
a67505b2ef6acab2a617346a412c2263c9bda3ee
-
SHA256
ecc5907279c3b500718f4cc1610399e6fc27e589b4744a93e7faf2918e37fcb1
-
SHA512
bab079145de829cb368b25b1bffa9516cd4a61ea723d62f7a0d0bc363720e04fd1a7bea9098672940badf73c868f75b1993ae2f9404c1c151403a4223161607f
-
SSDEEP
192:+yEioELD/ZmXg8oWllefMJkZQ3wf1vimlKt6DvE:aioWD/ZmXg8SZQvmlXrE
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000008ceb56e2d64cfc5af86cb1e97ce61ffbd576197124b37aa72427d3c70c7f6372000000000e80000000020000200000001e347f6b12f72de57121854b5992fb6841c95b197e3038ff63672f22f649067090000000eeaca2d33994e10f41116ab56b8d67fe7099bcf934d2fe203ee79406c3730608e7b3ba0c01e01dee970176ec4b16b59537490a0acccb256a84e2442f395d27d02615f4ed8dde9cf6d0efc1fa6dbd07e18f7d5ba13aa76b5ed7c458410906dae5661bfde52d92a5c54512e8c131e838a1f79e5150dec34915530975047735eee323a3c3d78d1426c49d12d157430543a7400000004f4672394d9a5e0f36b80d2d82dd370638ff626dfd0f8b5ae4d051c377a7af06ca05eab88defabf4d48a878a831490d70da807310e202d4acdc155b6c9c141bb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{853F5241-A0F4-11EE-AA86-EE9A2FAC8CC3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7059a7590135da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000004568c8e8468670d22305e08b5160a1552bb2f124ccd86640cbb637b97b5b5f9e000000000e8000000002000020000000a9f5a34cdc95320ddbcc18566d0b7617727d9744ea760410f184638667828fda200000005c80606f5b66dfa4f22cbe4897c085cd6f769e155572cf56e382235e5dbc982540000000f954f527458d6b6affdea0b61168a2fc3647b7b32372a7c0e8830c119b59897940094efbc09816140efd6e25234a2e83f07f52a7f0ffdfcc737aebf2cee3ae02 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409430123" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1964 iexplore.exe 1964 iexplore.exe 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE 2088 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1964 wrote to memory of 2088 1964 iexplore.exe 17 PID 1964 wrote to memory of 2088 1964 iexplore.exe 17 PID 1964 wrote to memory of 2088 1964 iexplore.exe 17 PID 1964 wrote to memory of 2088 1964 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c397c212631ed51c928172e0db6ccac6.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2088
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e29a8afe55fc247195ef7b16eba06575
SHA1582a8081c47189486be634cdeb48e6096d928917
SHA256583ee67ff7af93b3c56cbe8cf1efc1b062c7f0ae87d66365249e43c8e3ee6911
SHA5122a23b24aa9cee48f665a53d286816e7742ec1dfac6b0aeec017ff8838be6f50e2eebc4792e5569d6cecbc7538ff2800d82127e6f4ea9ea9225b84e31812a9070
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513a57001fc005dd7cd1d38409d461e62
SHA1fc4429929164ee1af7c9bcd3e45a68692ac97147
SHA256f88e5b3ff716a493be28ddecfc4924d48e03a5c91d39fb539135b609923a4d9d
SHA51282639e8d01dd042620f444b78a5783746ee168165091dd5fd53f94eab56cc84d1e64cf6cb3181d0a321a94ee515c20f6f85be63ae6dee7824953f60e0480d956
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5734fc282509e97d35547182bdf700da2
SHA19b339712d004eb9120b884e6d924489685b23bbf
SHA2562b63122e672a7954004f3794267eb8476e0e0b7d1715d71393d9fafc8bcb021d
SHA5125bdcff13019a98a85ec2e56625125422aca0c7bbcc411f0ca7c89d9619af7042021a20d2736dbb7338c5765689ee19a4b0639ffa239d8260fb04286fe7c8184c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56530a856af2c30dba28f951e0393394a
SHA17ba78846bb5ff268abb1596957e3dc7213d5b58b
SHA256e7f4513a8a2adbcd9a8c537b98cf209974758217da3c514e3993b74886a3eba5
SHA512130dbbd4047c8c92c8198c070c71d1b9f783b36b7621df220d8835beaf7553a3205ff170231b1039b68b23755d782ac394c4e1898ea5e3c218b34bcc03da2c2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1bc076fcc975a2e86e012975a41ba5f
SHA10fce1caa0ecfe7087bdcf0ffd260be2821cba473
SHA2569781b8655274466601d9b6673648e87a83da21106e129424718af1e45f503c69
SHA512e18f6ae37905ed36fb92aa8834d0aa5f67847be6b8a2758a69f505d038e6cfd56f784380ec4a69784413b19499cd5720362d3219f3881c046832a38d992bdf21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5175040b29e4ceff7b33c380c94822709
SHA15b9050809c0d46a08b4d412c2280bf02a5c0e11f
SHA256086cbf085a072b720ab704c0daa4a3428fe35d2bd340c56a9ef932824a0303ed
SHA512f30991ed09d3d2abd60bed1d3d00237ae0b7a2df1cae124576d080b408217bd681a32d5c66e0eacbf17203446e5ead129a674f48920059724c44b5ba434bd908
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f371252b6b13cd2c6f48516d68efe0ca
SHA111c62ea9c8cab457011e64a808d2b764c6a39ef8
SHA2564fdf9661a4562742242969d0baf020461a39a8f05267c8bcde21ccd828d87119
SHA51262fb5406fec90772488716b78528ef10328172aa9dc2f98be0d6c2e3e4ea0e32b4c85dc824f3cfcd9041c6ee3febaecbfdc6c81356cabfd1a4dee77e46998f3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f26a83693cfc503c863bb7c0c0141fc
SHA1c9d87b5f893a128f88ce222f1a7ef8658c39eb10
SHA256b0cf381297ae0df52ba9d64172628fa03b4417dd5f290c2eb84f21db656db299
SHA512dfdbfd15a4ad1d5e55e19e2f34f4e1c7430e35cff3e4007c7a32cfcddd12de8d38f834f638af4480f764c5d2c6e80d7cd8a0dd4ee1a172f3c637fd0db1b80b38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578b2e0fa4540ed55a3fb1b3d765f015a
SHA1570f3cba8be53f0958838e4ac54938da8df88655
SHA2568009a2cab56c9a25c03b8db0b7abfc0b40eb03c0f4c6d9cf83d4bc9e82fe3d4f
SHA512739d3e9780c52ea4144b9bef3aadc0facc2b15028263a054c8900ff2482402b695729d4ec3ca0c0a2d342464ed69ea0d96a083ac1ea0b65b6a5207933f1d1354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a46e94c0d555ad76526df39a7532b89
SHA1830e806f03a9ac11b6adb137f48ea25426bb5b3d
SHA2560a60e89a12061267b4b9ed7f0f0afff8483f6cfed8d7a41599d7bc213df23fcb
SHA5129e76fe16f39e72530a0089737dce9a64b05e0e725479c6836ceb5c918051ce6ae5965e8ff9ec8ed5e76477281b83442a3ab96e84b0ba9a08a470d8569769992d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513e0883a0dae63124bdf6af3290a132f
SHA13e1684b4589b9ee4ea9b7aab248f6800033fdc1f
SHA256b40e40c12206d9cf9b90f8f236024d060fba705284a8b4a76b1220c8ef261a1d
SHA5128c8dc4896eee71d0c490e4bb2752897bef08894c6f95cf7f27d950e57db78914eef076f94e292d0c0ed16261a97df077bb13ce865fb0c2dcd150b17c343be3da
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06