Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 15:33
Static task
static1
Behavioral task
behavioral1
Sample
da35b1f9904071f8cab8733e007bfeb9.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
da35b1f9904071f8cab8733e007bfeb9.html
Resource
win10v2004-20231215-en
General
-
Target
da35b1f9904071f8cab8733e007bfeb9.html
-
Size
601B
-
MD5
da35b1f9904071f8cab8733e007bfeb9
-
SHA1
a1f5ae5836db4d2595b5494e8c771f74b15d20a7
-
SHA256
bb752e1e43f0870a397a02d5a9b87c34cf27c6214ea462692209718496bf9785
-
SHA512
b573e20d156dcee143630eda6273656c49d45f4fcd295d18bd6413d6bb5f738a87037153db2df36ed0c366a9f87f1419d6c9def0d0145586eee8ac891c3e229c
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{75028F81-A20E-11EE-8427-464D43A133DD} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e1483b1b36da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a9a1740908dfb1707cc7d4ee705c33a42131304e243479d05e21a5436c1507f0000000000e8000000002000020000000584c04c0242f8c9445fb74ebc4e8bc12fea0cc292c43df5e0f51f4c7d08691d19000000004070f5ceed430ed70056406c604b1f2e657ae0dae008036121a0ac937732aa8052912d8f121acd5f679c57f30276e8db661bfc110bf7ae124acbfc6a43ba9bf76d371728bee3cd0764fe7198f9430a7ecffce00e3175ba9f94e2958aa0faf26ff72eb7b3774cbedaae74f777c4ea5a626e31282d128b7a56d839d2c2b74cdb15a5910daf46308a81304f75effb179f9400000003d339ad24092911d2f40573b4629a65bd5ba1e4295fdb2bbf59b06f353aaba7ab483a9a58c21de7bdee5b321645bb0cc0479c378102172e74d9f3eb990f267aa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409551217" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001025f9a89905fd1718a3d2439a6d91968e7d86e70c25ef292206c660a69b106f000000000e8000000002000020000000254ebe0b2ead2862db36ba325aec26e1be979be50fc4f379df44e6875853d4fb20000000791e2e3cf8f06d104d913b164fcba3e88218f1c206be7f71b4c9e863099f885c4000000068e9d843bc398b9a473070718febd6239116ab5ff88f8860f35d13cc699eec629eb4ccf2df9a776173fe3a8fbb0c2528e87508ea411b1d52cbd6df6d93af6edd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2168 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2168 iexplore.exe 2168 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2168 wrote to memory of 3024 2168 iexplore.exe 28 PID 2168 wrote to memory of 3024 2168 iexplore.exe 28 PID 2168 wrote to memory of 3024 2168 iexplore.exe 28 PID 2168 wrote to memory of 3024 2168 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da35b1f9904071f8cab8733e007bfeb9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd42c12e096b58a36c39a78a77e39296
SHA18e95764172aa53a6cea2f9edb8b93d7f8fc0b700
SHA2569acde91ff0eaba0829687e65288110ecfb42d0dc5a60b2b4a80921edaa220174
SHA5123cb1cf0c1919ece0acc7adc551a73c61d2efd6e10c45b16a2e3d15041d09e5120a411ef343415633054faa1317dbac01cedcc1ba32aa655f5fd1ff5757555281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcc956db187f48e19f6111355540a7ac
SHA1ccb6c0a39405255f18a9c471c3f2df3a44d6e5c3
SHA25642b555de5347db3547f95fe477c3cbdcfeeab95cc2306a5afc64124520c383cb
SHA51212ab0f14d89b64600406c6379309f6bfb83430a1a129f73313536d402bb60f17f1dea132f5c4fc1a71a253e10686d5532e6f15947c0f9f3aeb42cf9de47b0d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54091025a26f0a41188d61ecf0abb31c6
SHA1a6f2085cd06ff20436a4869ce08d27264bd9132a
SHA2560472f0e4b8892dc4e44eb785555596a0fc1d80e75238562144eaa31e0121dbd6
SHA512e6301daee3518ae4a709bad9be5f21aff3b782fcf174072db7421bc6f495bfa524182267037d15a2077cd84d2a4d467d713fe1bb9e84d021dbce9044112e828a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b4a477db91eac3dd090d842d6a57d4c
SHA1080370253b9b0dcacdb6884ef98da6d3f7346f7d
SHA2567808f5328447ff58a5cf11a91219f55fd96f01aa2a723af72ef0dbc0e465c8ac
SHA5129dbe8ff78e16209d3abbe60b8e899f920f5226f7212b191de85df9ae39d61ea8959fe069ab9fdccf78ba2b0d5f19fcfe4fc30cde7ba3fc5c523f609364e7797b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5421d5dca53e945427d1b964cd2f6774a
SHA131ad67bccca7387631d0fd883c420100673263b5
SHA2564328b1dc55dc5ebb0d2ff66b5142e958d4c537e7492e4831892be29253f270b7
SHA5129c06cb504bce4dbd96a7bbbbb130c48c59b185e6cfbc09bfe29b0925b6f8aff777d082b499a47fe5afdcfe61509db63e4b73e26cba6bd91772f9028b1cd0cf72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b2e5f7e04d4a8d29e9de4bcc102dc93
SHA17d4e27dc4ac5937e5789df2604b54723aec58621
SHA256f284e76b5c5e964adaa359ddaf7049503c7746c12ffdda5f6542bf50d291d982
SHA5126853b7e39c8546131b75770eb30e244bc0ed7a7b276ba9e71487c186320628c647fe752e53bb0918ade03401057aca9e563e06b0da497cc5cd2df5b009e52dec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57857f274ae7fec21527fdcf75e0bf42f
SHA17f90f6e0ffc32f5b232f5e8bd2186419a54889a9
SHA256fd9a0406b29725619a908caac0b795ad4944cb6302a4ed6c82285c239fa7f11a
SHA5122a1909fcac7f0362e8e5b04046efdb84f1f529502d476296388c5dab17ef25e2335f2d7804ae486f4358c40994ccfeaf5800df95b6e1eecc3167a938e3811245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53b70de22a0c9f06ea6abd3a94f06bc7b
SHA1d93c856d28a0af03031b2fd2b1d06bac5fac6ab2
SHA256c97c19829f8b754f94644c69080d0f16821a14e8d1554a42102110f81b8a54fe
SHA51203fcd652bc69774145a6523246c385cb8a42f5f5bb8cc60405054e6b2483ed23300b5aeb187e6efd3f384734b4c6e760f62a99343d4b5610d676948b1d4af922
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505cf10743c8571e00143f0b1dc73b5a1
SHA17a820335945f51ca7565339a9b76f9b0ad3bc6c3
SHA25677243acdb006aa9d02060edf7690a61df232db9726e7eae17e25d24107a870d3
SHA5120ec4d72d70a28ba5706f98690c794f11cd6c446949c8cacf6f88c62157a4148b0d3753e9f15b096967a3a94f04b187ed70ed1df3b1bbe9709eba3ea0011114c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fcd3e384bc557cf62c2388131c02e04b
SHA12246118f7d308b5b68d873c5451cf770d0bcdff8
SHA2563be19c40d3d19a44a0251c062e38f2a7af0b874a6eb98233dd5984dae8a36d32
SHA512dcc776c82de0bf8f07a13e6c2f1ea82e7b151675e1e24e7753362e25b094923b571ba7c5fc7185aff79ef508bd0aa88beb04a9e6482f221684946ed6642d7191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3fdda8e6bcdf0b79cb4600041affd8e
SHA1313191f8eaf147236d031b4a7ea3ea63937ffbd1
SHA2566a5f97297fdbb1333d69bce7f3b52f941362b4fbf238e037aa919725b25e2c4c
SHA512ab0c743f21cd134c82e8ccf101ecf98393b4f4e8b79915a64e66a428013c885f328fb4e24e57739ed5cc5f033bc8ccd03146ef3f097e0f711f60b21aad6ead8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c80e8fc9928a9af52537e014a227fb1b
SHA1307638c53b8959b0ee2ce0b09cf25a3d0fb30252
SHA25696d232fe0538dd43d62ad3d0f02d1d0010cb7960c2b733a7952cc2271a128527
SHA5125dc050d90d2d79405cd4de4f6f5046f977b0f985f6c67f8424f82519e6582fb64af5afc2d2157f8e2194b022b0c0fe5fbdda223b1efd10c27960afa5ca07ba2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5902a373da69e08fc478ce6cf0eb8f0f7
SHA1bf1fc4e981896ba2ad60fb98a3480b489145489f
SHA256c1da83cb5bb7590942b37b02023f5be2b720cab2af8910af176ff4754d73aa96
SHA512f3d1984fed30a2308a64471d518f2bd44ce4e02ddbe48be0526388494ddf428fb1ef5e2d504b7ead0b1f2caa30c1c3b699bc6ad02b6d356fbb0b1ea2f097fb05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5109f7c9b01ab3c7d6439f5f0d1663c49
SHA13db38cf7d8fade13e14a957599d07f0387b495ee
SHA2569002dc57731bbeaa78794b2ef735cc17366366dbda92d984612978e8b4406aad
SHA512a83a3246571f539cc9de3ec09731d4da0ed5504526ba027d429ae150d5c195dd2f4deeb606fd66994e20b525b65c4d7c910d15ea25232b5ba016fb026fc94cf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d670f16cc554a1884e931edc17465bca
SHA18d1d64980b8000c8cf6f3cb7733ed7d129724875
SHA256b1437e8477f37ccddf4ee58f3dc603f8443183e5ac45060309ff5d8d2af608e9
SHA51265b16dbd1f55aa1b1baa40c944a27e4445102c2e80d88b12fb1e84c02d28cb927e9c2837e47b895c19903ab89df924c0c04f3304014d0d0ac547542fc2b9e2f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b37121183e2c0302364b47368bbf857
SHA1b2390b6378bed3b67c68122d909d62014113dca9
SHA256a68ce48501d975043d7422d43e773651538cd8ed6d2ae415eafc2ca7427107ed
SHA512447bf799d0e69fec905c32401d00fe80508f98a0de5facc98a473fa49b19bbed326504db8e11cf9b132d8e9ecb5dd3cb7f42cec79033149271f96867cdbc0497
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eca303a7bec478957a0ad0e7a76e1a4f
SHA15762a38f2ba0c5d0b22f7fc47fefb7607c0a6344
SHA256440493359f30103ebba7ec267a901127a88d557188d640340099dd35b0d4e95e
SHA512ce2d4601f09aa9538881f128b319de01272caac8c68e5736d34ba38e1c36eedc3d9f263901fddc535be48d89339bb44a7b5c06b97d5d5ec1eb27289456deedcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c312da54336b706ca7bbc4960cd8d8e
SHA1803351c227029315678f3321d0baec495df5e6ff
SHA2562d1f6ebcfc24daf8914d553413349f349829baf7311571fed534ab7f0a37f53d
SHA51263f5cc926ff0b489b46d35f20d3bad7f287a20d09c639d360fef0f3a3aa2b36d6ee83237af0ffa9ad3ebf50b37167e5244639ed0aeaf2681301a715a9f9e5b76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536f16a7a00b8274a5f957e05385f60dc
SHA14f12cab09ab34290422a0b005dcb457bcbbdc2c5
SHA256bb0b0d314adae9080b641129c2b1cbbd4c6d71126178b6359e816b5be158589b
SHA512f8f2fae9f5840f61c2ee77c7f5a1a06d14b9eb15c2e33c3d0916cf7ee426ab7d96ac13e0a4e038704336d9035f8f9e10600d8e53782149e55b8acc8df1a57330
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06