Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 16:50
Static task
static1
Behavioral task
behavioral1
Sample
f835997f90ecadd84ce70df3730774d9.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f835997f90ecadd84ce70df3730774d9.html
Resource
win10v2004-20231215-en
General
-
Target
f835997f90ecadd84ce70df3730774d9.html
-
Size
1KB
-
MD5
f835997f90ecadd84ce70df3730774d9
-
SHA1
dbecbdc0cc0d42f423879ebb5400235b86f5c48c
-
SHA256
7b17d7495344113e088a1014175436fdb660f7fb63225ba89d674dd11714b8d1
-
SHA512
5f7ad202b9bde4e48646a1ee8c9ebe40a8bae6af53460124b127723c0928fbf3551f6261ae48b4cd01fec29ce148e93fae872963b9263298541577c8fc4d2fd9
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03e288c2935da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7019531-A11C-11EE-9853-CA8D9A91D956} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000c7d1c69de06b470250a58a1619dedffb330e5bdb99ca65bd16eb317e8c1cdb8d000000000e8000000002000020000000035dce17ee7e218b9fdcc0e74f50968cb6d10fe15f81bbdb300a42d8edb9ff2e200000009889d9d67113109774fe9efe79a97ac89b8ec76fbd8537bd8d91410e66c7ae214000000089dbbfd85770ecaecf01653039a99572b95c5d1ad492763cf8f1411643205f31472753b7b69463a8550e15915cc2b5fb52517e936fb70004746184fff4ed4517 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000141b65323c3b7dd9cadefc1e78b4f0f3691c51f4088ae5652ecd8b31daf3c811000000000e80000000020000200000002d7fd0b7a661004ccdb9a5fd7356802b245382b35e88b8cc0516b88ade68d944900000007bf4a4bc840b9fb250e1ed60238fbc104a94db7d9224170ca1f89d232c954907473ee4010d8c729e3748f672eba20d818bce1bda2e5935114a9c87b48bf4bd5c4a92309ff677101adf79bff10e7f40e5ea2e69a0a1610e4269a73ffa5d6e6b29b4ab8bbab402bd2baf409545cb35e1d40548c9ef4e204b431e22c55941c9fd8536d6578d4d0a48f5ddd502b61ed86012400000008295e6f1b7e672d5664439581e2758a21009f0e888703c9331e493fb7295398cee2adc9f026cb78daba9563f3486a85f2bfb6489a92c1234f9dae2e783aeae3a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409447442" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 776 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 776 iexplore.exe 776 iexplore.exe 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE 1212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 776 wrote to memory of 1212 776 iexplore.exe 28 PID 776 wrote to memory of 1212 776 iexplore.exe 28 PID 776 wrote to memory of 1212 776 iexplore.exe 28 PID 776 wrote to memory of 1212 776 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f835997f90ecadd84ce70df3730774d9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5681008428cb65ed9cff16f1b3fa656f8
SHA139d81568b54823291254767f84cdf4409f79e109
SHA256c944a1d625e32f4a98753481205593352d61b2032443599d7443e2a0541427e7
SHA512c1acf4d178fad99cb43582933f098218552498103dbf32d44524c49691fc1dc6ecd87f501c124183824f9a58dcad6e019a6e02afed528f957f864fe1aec6e1e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598e270b3b3e89913a43b595dad74aaa3
SHA1984b864c7dce5858a53d8dcfefa19db2570a71f3
SHA25625db840a587dfc16acc9dac09d659be43aaeda4d1d3f345725b90a92d8576104
SHA512a7eb8175321936c74b4e46175483f60682fff78354d695520c426a6182054a9bc668ff814c315bf01ca8318837b4504a41f89eabffdf7e4138ceb2dc4386d91e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553125b2aabb5906fc37736a00fc57e82
SHA146f20f1907da6ced957fc8fdec5367193b714f48
SHA256c4fbe97d2a31bfe486ab39ba67ba095dc11b92ea568eb278abc54b09e2876f75
SHA51254ec887aecf07da733c74c800a4c068d5c6e4621473e6eb98c6b67bed94d53ea6a59531f34eab3e9382d46873c03554c7eb8a450621470494aec65a6d8cc6a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb699e1cc775be804aeff13bee3417ff
SHA10d336177c6eaad01fc9d7de2edfaeb7858167794
SHA256ac93c5a2052622b79015980160906d10e6d71c79308a1511be999a8b51be780b
SHA512b6cfe51e0d5498a960f8759361b620e29fb84d75d5fc45b170bf997947daa90296ca89761f6e0815f2429a38a1c5024cbff312fbba0c07b04dd45c6adeb3cc8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50edb1ca4e21239c50a54b8c568376a85
SHA1e8601f400573db810e3a7724cf333b3a02382781
SHA2565770d6fd16898c5abc7799cd22bdba2b6bb3c11221477d190021efdb6d40164c
SHA512c31cb38bd84bb9e064592239fdf3b2006a22b67580fbda7a9455d01c3838a3f337f6e426ac7b8301322bff49df86bad329042a1533f7d6ac309373bfc5efe47c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e2c1a86557417d303272941671f43b3
SHA1ad0d3aea94fa844ad459e5b54b341252f4d98789
SHA25652bb9b97ac1bda8b8274ca1249a0de5da6cac1c7e232ecd1dfda198e4d534500
SHA512ed99daec0c227c1fe3c3b24c456ef9f2c3320e50a8e309b3b37c7b8aca96659b238b9255f64e3f82cd888716405b70cf38cbf0ccc9754dbbd440ace3e333b8b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526b74349faae12aeb8ad0c55a1a0a885
SHA18303e928519aa456b374fd72c3cbe253a5e8ce28
SHA25624f453d5760055ea77b672882664c61bbe6ccdc0a444e144889e837f292a92dd
SHA512497b6f2bda8ca81276644c2f0ca1ff6a6f333786f8c896d8df8d5ec833cafd4c9879e6b5a8c9c77d443aee250f0c31925c827cdf6165bdba7f1751244ad82a3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c816e994e9be626fadd8685111f5719c
SHA1e7f99a1694e20798ad3f6c9a7dc1f59b46684078
SHA256a2dff48f628b5a1a868e2fafa8d131ed8eafccdcf6e6ce67579a5ac7e3497b20
SHA512c4875d59e336301a3b06ce12fccb256c160d0f4a2390a036db82a988f86b11994b24f64c6dd5b4fe1452ea4e37f80c5b3c790e71771b2a25f58fcab9337384fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d040b5ecdaa5d9de96c66614271be99b
SHA1dc9cfac53a18c17a8ef70fe6c8d71b834948568d
SHA25656cecffc8d809d24681a1da51dc068fa5491654a441cf4fdacd92882dce25986
SHA512434028c6216588457bfd05b7b047480c914f92d76a13496ef66d4d0b37a944704af7e5b8f07c65feead98a329f6d760921caec100e26ef001e511b2b7def6e3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51966640493d8d7319b6f7fe9b837583a
SHA1ccd06080e3186f85565b2f72e3d3b05a089a1ee7
SHA256bc744b8acf55c94a5e00207168d87591aaa4e001ce5eb5cee0241131f130f264
SHA512143da9e32686e3f1b805249f8433d5c79ec02556313c2f1ecfa5918cfd18eff75d2fb9af6d3ff3a5302372535e11adf4a78d76bbf2ec37b4442383aa57e087df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fae58e93c330ce95dbfdbff218d7961a
SHA1edd2c9ef8c515599c3bf86095f7e867c6147c559
SHA256d509eb1979503c6b91171811efe472662e6ce8b2bfacda98af97b1cf2b539585
SHA512e5a9167825524b9d3dfa1f2bfa1e8949e65c03a0d92f013acdd668bc4e86cb3f4f816973dcf1ac2c503417f984e6df7a2f42cb92be9ac36f92009d292acb5fb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0ae54936eb95a472ccd13f44126b0f5
SHA16ed07a9fdb07ba78b39cb28f8bcd7eeed992db1a
SHA2561e697586f26aa330616d898f0bd7f8c0588f1f2100b9680d17cb4c38fa1c5cb2
SHA5121a2582ab22f9fc6485c735847c620005a7d192aa214e299bbf595ea2b363ba2a0dd34ba9ec9291293ac735f7cfdd59b4dc2fdb3bb1aa2c3e1523f8601ff19bdf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdb82d37985e904ff966d86ee765e2f8
SHA1e81abb5d65723683161a6927aebe00973be2a341
SHA2568046c9e2f949fb7a2f6215730a660e557ba81bdd99c3345ce029365f441b8056
SHA512cc560dfe75e8f466603e42b4201063a6310dde1526d67a078c916ab6c7731a32aa870b98e474b019ae41ade094ee2d33616e55bb1f1bbc19a3337dea5df5d37f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06