Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/12/2023, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
fecb720782749b37248f71bb87bb5302.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fecb720782749b37248f71bb87bb5302.html
Resource
win10v2004-20231215-en
General
-
Target
fecb720782749b37248f71bb87bb5302.html
-
Size
4KB
-
MD5
fecb720782749b37248f71bb87bb5302
-
SHA1
3ccad2ef85360f6378e6623dd35234411732c61e
-
SHA256
14263b42fa540e15a9348cbdd7c87ab2a32ab275b911f13fcd0188db9c06241e
-
SHA512
ecefc177987e22a5fe45a7310bbf23155456d6790360e96eb8979215037b451dec1571b6c33da5b86f565dd3bd27cdec20efa71da70563927af7bfb2c584886e
-
SSDEEP
48:+UomXdSez50+4QNzyIOdc2VGLPsEMwKHq48DilQsZd13JOsk8zwVAWwlxlGLVcoT:+UoedSjB8PsjwZ48PsZMbQGmwT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2B30B2B1-A23B-11EE-84F1-EE5B2FF970AA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b051ec1eb10c61581f6e6beb2a0566505435ac99e89217b1921d28335e958028000000000e8000000002000020000000eba0771f2ce19a621dcc2c929cc7144ecbc60428fcd6197d642e8d26c134bc2b90000000c188ce79b680831030cf4ac2759367a8879aec7dc49b5e181a8709aaa18de57daf29e62b9723ce0ce269ece623265a210a6fe242750539e82607f68b7a7c77e85e9cf38e33f3ad52ca9db2c24f1b546a1d4cd02f5313f1c3027d5a717517aadf210699f838fc5c1c2df6138a3628de5075fd404c483d8cf5087e97380c88923bf50bb0488aa95d72b78239a889df2bf8400000007669fe676a5c3c29b08200a20ef382e175f06bbc472b2fb1fb8b4f4a7ec8e9daf9f7b11e3ecbb10920f21000bea789b81c76fa5c39043e28f9d9cec63acea0aa iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409570420" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000007759e34b898f4452c0c212adc92ffa20c120ba4e391c6cc98b4a2a57f85ad56e000000000e80000000020000200000000b5b0287d031591c10221ecb1b5b08c469f6cc9dccd91ea4ee3a355789ffa65a2000000040596dcabd776934ee7bfd75bfb0df98168f7736c48ee18fb99168bac97c3a8940000000c80005e7d970e40ad4799612515f9b3b7f5ece681e18c3c3b1e08fdc650eb05b0bc4314e22c53520d7bb473142d1adad16ccfe88eff36706333a698b4cf393e6 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04813004836da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3040 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3040 iexplore.exe 3040 iexplore.exe 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3040 wrote to memory of 2400 3040 iexplore.exe 28 PID 3040 wrote to memory of 2400 3040 iexplore.exe 28 PID 3040 wrote to memory of 2400 3040 iexplore.exe 28 PID 3040 wrote to memory of 2400 3040 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fecb720782749b37248f71bb87bb5302.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3040 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c391047ed833bccd36119c338f0f83b3
SHA1b63c82129587144c5223724d4e4df4c350d3989e
SHA256b8111ee3fddce687320c4fbdd3fc7c2a739889d68e38cda4f5f2d5a6287904a5
SHA51213cae9da5bdc4df579548e64b695adc4514a4a38e008f2649ca20b955c39e717e1a6a0f29c2c6688e044938d575dcf4211cf88ce99e6901f4fd0a148fa6fd916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536194375b6e6d6133f59ffcf038feff5
SHA163d3fcb7c4b29cbb30e6a0f1a0526eda6a972f92
SHA2561019d279b41c163c743bfa93f2290646b59cd2b902ab2b536c05982f0afcabfb
SHA51215ef19ac8348c8aea6008b449f86035fcd4dacdcedc7584ccfc53c91ef699d32f6fb7b773796cab13c0d823da5d874f7a5e31e76ab3672e8822beec5e905ce2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c650238db60d35a9241391abaa20224f
SHA13297940ab8828dcf207ffe83906bd5a9071b58a4
SHA25631c2d560643987dbde020d80f864d84d8a6b000941ea3e00c406b16501bef775
SHA51209238516230f34d510843ddec008d3cf2c068b599a85e13dfa003a5347d3fa83019f203e68e5b5b2c385473209a4a69eb3630ac08b8a800e905805a348783539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5713f71e69e1ea082934acc7e255d1c32
SHA165c6558616997850c428387f15d112e1d9a43a74
SHA25627186e82ac697076af4c836cd8d84724e66dce0c7065a2110ba939b8dd79a3c1
SHA512d8c77780b63230693cb069052bb3e453daf0af45a10855afce96cdbe96abd263dc04f5397d001b1a07ab40b3ac8970b7dc6ea815f8c159e186a23ffc4f982f24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f65ff061affa33c3d0ed2d40aaf32a4e
SHA121cd0cbe88d7d35c004380432c60fcf51d667115
SHA2560596a3545b73ec4ddc9edad1c6cd4de09cd767a60d5a60b34fec5715b8192570
SHA512ff29bfcaa078699d7fda56ddc5d78be9b81372b37dd01e27427f57f8f54836ccfb8369780c381219037821f945d5387eaf6273422eac6010f7f8e98a98762a45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0639dc28fd22c5e1b92cd7ebfa6bfd5
SHA119ea298379f063b7eb6fe9f126b1ea076c397726
SHA2568f4bc04f528301853b9b887046e884814d48101e950feb46c533c758588c69ff
SHA51258e513a9c89f6718854b038473cbebf6c38d43f64465907a00aab18f3e620518a6a592176dfdd485feb5db2f64113c03462b46415493be9fa32fdcff5186a225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2c61d93948581fbfcc3cd15fb313a64
SHA1c2db2b2845670a3d4c43b18a324354b0f87ea369
SHA2566a6a36e04fa7158a75080a49f9a489e3bca3e9c29cb5216f06fb80b397aafb73
SHA512f13adf1f184cf751c396814ad5a11d2273f9c296a288cfa32e0e62fab9a4137563eaf8f5c2b1b02c2c79a2303443c1c624b7a196f2062881162f427258a088d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5670ad3af4165f2e892812c48be2b8650
SHA1d1079fab1361696629b0f3e654c0c74261663f21
SHA256a428c7d8819eade3b486e514eccafa90f2ddddde0c1f04d377fd94d41d82713f
SHA512c0bd2cc82992cbd390907b59fab017207d0a1a76a4d7fd88ab8b15a0ce93ca4fe40deb2d2e5095fb09a9897eaf7613c99a149890a2cc04925b17bf8378334790
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbd05bcad4b3a1b890d6f35b73400b8f
SHA1be2944d911eda94fe90d0a7ecf1b80146f966dc7
SHA2561d9d39ef102f56d19b09494b87fa30eb0f077eaffa547856573e92464ee5d9fd
SHA5124217969d11f9f1e558f9a18876ea0abc5f05141c1994387898e2d192f41be0429afe74f717951275c6d86d3816e133b22e3232c6d2b4dcef3785b70c463f967d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d703c79a8e90f0b8e23944b39f182f2
SHA1a9d9f0cab3b17764d421a45545fe993d5d43c71a
SHA2566082ff7f98ccfc966f1eb2ce52db939a104cc4b0545bab37c5e8908e8f4047ed
SHA512d791a0734d3a1a73721755c313b1390f35bc9ab13a83e000c3453c712ee4fa7b3bdebf0d34c8959c54c2dcfb3b8ed98553e451e085539aaf7093adf6d37c78ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5550ff097d2f40178205b41b23fc8ae08
SHA163b3269b6c4d1c937c53945025660b4660cdef29
SHA2565d9705985baedddbec58f2b6308ded38c77ed86a0e43e16dd745f68a5d460bd6
SHA512a62e84b0e2f46b8a3c5b59dc13ad18b6014e4945ba102cc57f708e22735ddfbf4e8eff89be3a6703607eee431f106a2375648f6077334448888ed07b7cf96224
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e27d92434a99eba902999163269b07bf
SHA19d66bc3a106cb78338ccc487b7848a6fbeb4f868
SHA256efc4298054d1d1ed537dbbbe39b26eaac07fe976058ecfd8709748bb8b26cb19
SHA5124b8da5126e3a0fb1efba65f8e750b34e431a769bea8b2389c62e228559cc4ff79ac41c421c3dbf02085e145f5230d00340e66da7d3c563b2de6d6affcd4565e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531dadf5b3a90b56ec5d046e5316e4526
SHA184eb23706c2383a23f1bcd112cf1337b8401fea6
SHA2567b364bcd0f7fd02f7ceaf8990821997fb3f8a7b2b644ceb02cbe2784941ad135
SHA512a20c612124d8ce2e1c9dd8b740fa8c22fa13e099884579d2ba5bb02fecf666013f5eec56add1a101354179d9cff8aa853eae41a227cb06236aac5409ba83dba3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a557e65b1d59dcac4d2ece725c4bb7a
SHA102b998e3984dccb10d9ed41e83b778fe5ac0a515
SHA256a03b46c3a334a73cffb1152589bf4da3a9080db75af2a8da86174f6ef7863cd8
SHA512b5d853f315cb8dfb7f8086ec4f2ddb689f2c5a892c86e5d6cedbd33d64710482b2dae59381334aacdd8dd9e7fa9620c5a41e3f6fdefe38fadbc175f635ccfbfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a059b259e41953c1e1a87941784f403
SHA1114179af29dbca795d7f61369eca901e72917037
SHA2569cdd5cc99aa1b9fc6239c6029b721afd559cdbfa910f2bd04544de98cee69d81
SHA5121d13c29a52f2e4367a57341041079443ffef3e1b1576e32e88387f97449bad08a3cd372d935df450ef187889c7a3853bdc644a21b2b8b49c0977c00a74328a95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ad634a305d4ec8203e43c1f197cfc67
SHA17257b562ddd8718a9edf78ff11db37ae24eec9bc
SHA2562ee0a1582ab8f4f74932dff4b28c273abd12dfe64ae9a14d1757be0891ba139e
SHA51243825f0bd2d1df6f7ebb4d1b19c9e196d844ee13dca53d1885dd53d018c5b8658a3bbc8e955737c949a15815e4536c0f78344517ff93463f6c4149ae7a32bab7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b13eb1459a7e7664a45f2f52b824637c
SHA19b3e7f8c95ed57ed1f3266c9ba2d75a7cf894a1f
SHA2569d874ebfdfd541d92f709eed2ef2dce7c858159ea10072007f5397bb590ccf7d
SHA512c02281143facfe59c11e86906deefe69f08d37dbcde3b9cffb4620994e8080c137815418e01e840bdb27e5c48e5f4a14e90406e2e522d48559483b2e862a25c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581cd3743e75850fbd33e9eb1d797c9dd
SHA131445012751ab4dc32bcc08357b0ac1a494242fa
SHA25606b0884c05e56ac81a92c6b1327d5f7781bc262018e32c0a93bd334aa1d439f6
SHA512e9b0bea3ff30d2273b6e5372e34c093833630ce71d7f5b7693161f4695f9a07e813c0e345758bbc1ca1be20558ef9a67b549276149cece41570435b00fc1d058
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06