Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 17:19
Static task
static1
Behavioral task
behavioral1
Sample
fe4e057f3a778114c762db24cca2e49a.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fe4e057f3a778114c762db24cca2e49a.html
Resource
win10v2004-20231215-en
General
-
Target
fe4e057f3a778114c762db24cca2e49a.html
-
Size
1KB
-
MD5
fe4e057f3a778114c762db24cca2e49a
-
SHA1
fad31af7a94d8f6beb880be8a40ac8080c5f1cc6
-
SHA256
0a35fdca4ebb8249e67e53aef6492306c07ec2e222e80b5e613ec0061dbab465
-
SHA512
99446be0dc8b77ff0cf880e96a2bb871f91bce75d245f0bed6f31172cbd7336f7f02f4c582e670ad2eae0899c2c2eef85039c2e6e324f1c4fbbc60bb292bc013
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409570177" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03ca75d4736da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000cfd63846a058a19fc5fa9ca439a423b8209b3d7076df6966950a9ee63717df0a000000000e8000000002000020000000277e377e21dfd220d9f44c6ffa2ed0b786268ec082946ce07bfbc7c2bff8b0e820000000b47f8a6ea6f968d234f7dbe68f8c3bbbb7507ce07deaef163fd26c3987c9b70b40000000b97ed3c48b97bd347227fc14d6ff158f946bb9b03c559be68b070e02cd8897feb723446a4216c208485031961cd33ac929dc54b1b294ec8f2681ba91b3846851 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000714cd7327afd4d3f789a017ea46509677b5632e99fe060af09530b7b640c366d000000000e80000000020000200000004ae8eaca15b6f0410ac72c23cc1602e6435f40928c76043a5589aa3ef16efdec90000000f775eb29fc0d5f59fed027c2e60cecd0f779297f87d48e6e3dc789d13998269d8269bc1e2310d4aef85a5a35378496ab7aec31e40cbdc4388018068ef9b4ac046c9df53f83fb3f014d4e121a0fdc1cb53b2a8c122942f9b897844393e875b1f79e7587cb6564a1ecf3bdc82afe05048fbdfa26692c2313aad30754a241a4d53e0953af1cc88b0e10bacdf75b2e624cfc4000000025cb167485cefb80f6a01b6587ca1e5be8a691c30958950f1d0e3ed6bf95ebd573305a7bf5dbd54d51d7567eecea10dcc2742ed029880f0ec2069f9fdb0a0d5a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9989ECA1-A23A-11EE-880B-5628A0CAC84B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 iexplore.exe 2240 iexplore.exe 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE 2212 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2240 wrote to memory of 2212 2240 iexplore.exe 28 PID 2240 wrote to memory of 2212 2240 iexplore.exe 28 PID 2240 wrote to memory of 2212 2240 iexplore.exe 28 PID 2240 wrote to memory of 2212 2240 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe4e057f3a778114c762db24cca2e49a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD53d8fafd961f53aaf4494092a2ee17c35
SHA196c30624c15776157e6ce373f93ac5ff9106c91c
SHA256c2862f0a2b00fd9d8723421a099fa9373290101380cf76355c53eb08ee09d0d1
SHA5124e2abca9acd5d1c5f7256bacc45447e73fa009f2cee0284f75eaa4bf20e60cb61bac5af4d9924452d1c6171f5669663a7f53f7f20cef4da21ae08e21699b2063
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5b7e72a011e02cbccf8b847906a6d10
SHA123cb9be536f16a567252de31885da0c2bdd398af
SHA256956d139d41a331c9b5515477d8c14a43af919e01ce00f9f94c697d784e54d495
SHA5127106349c38c71e30686458c0f1d32a43c0b4d10729bbf54403bed6190a468658d0a546bcca334d1a596509af7261ac72096c421db666573bb9d5dd948d9a379a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4084756bcbb1050d3fc6c29b43e9aeb
SHA1ffd0c7ee91d330a17b9e5a493cae3a474372ec3d
SHA256250685055e81454a1c33e1ff2f8b8c97e0515dc832a331d2035edd09d870e898
SHA512d39b3596d25a7ca32702325eaf1688914390526e8c1f62eaab3c6f531e7863b566c8c297fc9d8f1bab0f655ed2a45848b8e6cac64e5449350b5258f4f4600a55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bddfa1b3ad7a04bc369c241cf4748a82
SHA1fe3867bfa3e69e0756548b3b5f9cb4f4db20733e
SHA256518a8e3d41e4150e3ce45fef4a6dcadf01c88bb8f44289aae51aad44b4ca720f
SHA51251a5c672cf058a737e476fb7af6ab9f8ed200ce85552ba54ae443fae8bca696064c41b8193ba967fc783a723ddec42ae113ee5404ae86c7f0bb20edfd429d23d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502a9d3e01bb86edded9b350ba92d23b1
SHA163979c3d680c79e06de4a96a1d3f0eea9f170325
SHA256473ccd300bdc7d345c81cd53499eb1185a20d06694d7ff1be2328a62e523c12c
SHA5122b64ee27351256b2fecedd2a5337849782f2043b8873cc804fc7a2fe727e4dc57008231f2156a1d55b412b77cbcb9e179a095b6710ecfb82ca305e2fdb4ac265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5078cffe410621ce9f023f2f0fa957a2f
SHA1a3c114a5089352477eae7ee32da3571dcaf32e82
SHA256d3804b71a35beecc2e5739eddd9f1215418dcf212c38a87b7dce5097d98bcc56
SHA512534b14cfd5bcdf65808627546ffc71c7a501796aacf8335eeff110684b8f5ec2dc03b124252b85c8d744d8f0919bb44e2e65521a9d97715f1ccd55d9e558b488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a234d2d9dd7338dacd043c17cc7c41e
SHA15c1e349a3c4c90647305e786201476093a615d20
SHA25698f4dcfe5d17cae174e7523f3a706ab3ef55780431aae3b65b3cc79ce6e2cda3
SHA512be4e1f8bbb812d7e3b200e2dafbfce82f846f189967ddca3046e798d92430e3dec2c0df33c48c04a59cf91a95675bdd37ea92a4fb464c689c715a7ca68d6c26e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b10c3d5dcf83f7568b9e8c47b46051aa
SHA1a807b2068ad9b25e321b489eeaefcfd20e187b65
SHA2569e8c94ebb272058afd170e48b32bec9a513ab738b464f7317cc7840b147e0d0d
SHA51259667b3be12cad4d9460fed2f6fea8b000f9e4856271b315b4feceb51fb3d28d44de3d8e0390e8589337bd2c1487c0db6a9a62366ee7a670070682f193a1b00d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4bb031cd3372e585db8206ebf1ed7d1
SHA15bcb1bcfa1a0241383a74c14f25c867b026436ba
SHA256692dfd24e05580f87e9068f84d303a406cb9181fc98bb842c18f61812433bce3
SHA5123d130bfb296a8c2b1b113ace79b917a5ac831d21e2bbe26f6eac5d16b27972e74aae792b29435ea16295d58acfcdec2864a6f807458d565c955bd1593d4f6be2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a1c38c18705a8fa43717d686c89caf8
SHA123953956ab95eeebe84776ffe71461b70d632a45
SHA2560a67b3f1163af65967456f84f96125d416d7f5b3d1992ec7781bbc48ecf299e9
SHA512f2fe490c4b3c117c07423ffb07c4eddcce02f58fdeaf06d4dc61f14dae3aa4ec69f7db6f227394a77ccb841649433ab4bff2baa4f814d73afd34bfececfce85f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bde202c1ed2764deb34ce4ff1b53ec1
SHA1d6f40b298990586e0cd446ddb856a1f26774864e
SHA256b5aed51b8883bbe9ee6713d44b415f0f9754519a62bd130676f661aa2d763478
SHA512351306082cd7b261a5df6f31d3e5ab1d9bf76d9b3d6c20687a20708b041bae7709b6b09f28b75bee8c59da57b2e59285a6b5ba125ed952f55bbf3fb26adc6f3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca623f35ade4747898c6c8eb34265d21
SHA18786bfb58f7042ac6193194c8c2ccbb70c01cd19
SHA2563eb60b627da658f5506c586f4e95e209dfbfd11178ca714db7638bcebbdc24e8
SHA51265a8d578e68cad19c7d872a820897de914931ec9aa0b3a880460989034116ecd6800ac3d70cad6991e4c02ab265a59507b46feaa42d35a306d76244120de890f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53023a183456759814a160641504b42f7
SHA1ec8090d2921403695800e4672adb703776b92e3a
SHA2567c03e3a5a258d1f40d805b6758daa6d2391450203441a7f98364f12b56178d6e
SHA5125363f9bd58ea5965922ed9dbba2915463055e871616e72fcc114cb9e7c41e19683516d0936a7a14d703099988d34f45883d56749e20c0354d655a460c07751b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f62e68e75958ce8d9d54794e00478286
SHA14978eb1dca79a3a60bfc8f4b3c9d24f8f9034663
SHA2562c4f45d18d4d9df65571e2d41b1371e7667e4e2589139579b4200bdec23e6024
SHA5128f84376ee7d08238d3d37c2085ec13c510bbff23552b4736bc4b2b9b7d1211b19ff998b9bc44d6bc3c7c9815893640854c1bea0be1e8dc9d016bc7b862240559
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f610ff244c259187537177504a65f6da
SHA1e7c716471a87e452c7b9de3cddff84dacd2dd9b3
SHA2567709c925cc797d9868fe896899277c795291b026578b39ef7cf094146453de99
SHA5126abf3e8bb56298df2e6f6ec54e4b2104f062f031eef60f83c1aff07abaab50e523e0936d2b03ebdd69a2a2de0edd3284cbd68378a3484a662408048dcf4347e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06