Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
218s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 22:05
Static task
static1
Behavioral task
behavioral1
Sample
148505c0880f03a7c62587e869e914c4.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
148505c0880f03a7c62587e869e914c4.html
Resource
win10v2004-20231215-en
General
-
Target
148505c0880f03a7c62587e869e914c4.html
-
Size
6KB
-
MD5
148505c0880f03a7c62587e869e914c4
-
SHA1
c90931df5d2a2f981c150f7415906b2b7d706436
-
SHA256
e487998d818beff5606201608eccd698e2a5c8ea96ea6ce80d54c6015547df79
-
SHA512
ee2439173614581daf72b6d002259b33dc04c8152e111aec71f66b2c2cca912c83c137359ad0377cfffdf61a6b398c556f4b650576d00f124effe06a8b096443
-
SSDEEP
96:uzVs+ux7R2LLY1k9o84d12ef7CSTUHj/6/NcEZ7ru7f:csz7R2AYS/+4Nb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d61343e53ed88b00813f82019bad38b5c50b09eff0980a07b4c5ad0380ce66f4000000000e80000000020000200000009e121b5795cb70b427410e479bd20abb97374a68488cdb9b054c9080c5bf9edd20000000c8d3a203e78e31570c7ddcd1a631dfea277d714a2cadc9ffc3f563e70e1fd5d84000000054d5c063e9110577245f9a8158b406635dea49db6a83cbc6aff500fd10d65dcacdb5af3385cb45434913652b0f0981e86f7d1a5cfdc5b1ea94e3f0a8e13007d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b72813a7940399da0232ee9a8c555d4f27dcea7c0455fcd4b0b4480a72e4ed02000000000e80000000020000200000005502fa0919319bd8a1de1ce3f9113e29c40192f80d0207f275e04da46916511890000000bb5849dd47edb636b08b1ea12438c0d75312fb204f0fa69e124d1499941bc5c9145b67e04ac6cd1663eee169c8afe528e0a2379da338253f98243e9655de1ddb095024d41a92ec9d7d4724eeffe6723a07e3d6ea8eddb679aaf655dac66587c9b56f72f92a840d23c62d8ad9d4f79dc21752db7a80e6a724bb9d805f26c96e643880f530d509ad4cc4976eb311f716ea40000000ea4035a615b9afb9543c4863920e990ab62015c207d9f8c3440ab87544fb4084b33e97c70a953da005471590f490d15db0e1f85c3641121420c7be936968cdb4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409700353" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AFEA27A0-A369-11EE-B311-F6BE0C79E4FA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10311d9f7637da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2628 iexplore.exe 2628 iexplore.exe 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2628 wrote to memory of 1692 2628 iexplore.exe 30 PID 2628 wrote to memory of 1692 2628 iexplore.exe 30 PID 2628 wrote to memory of 1692 2628 iexplore.exe 30 PID 2628 wrote to memory of 1692 2628 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\148505c0880f03a7c62587e869e914c4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ca41d235892e98fb6ebdc507fc772a5
SHA1b5863d89672bc3ee97de693a84fde3843707139f
SHA256f0aa3723bec20df623a3ed48cfa1723c102d14e49512481a44810ead559ff9a3
SHA512e14933918510ca43085d72991062a2d6c890c1836e2e4bd9e60b20f92856d047541198a5affe1c1223bcbc0b9d248c12c82bfdd2ba63e47182368077d70d027b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e37ce06f33ca96e3c5f28405f52aaf8
SHA1f82563ac3a92911d2cec59fcab32fe8d6d5550b9
SHA25618e24200ec64dcb6d07d84f71f8f0d4a2e92487dee067831188897386d881ba9
SHA51233969b44bd57d5e52cbafead27e92eef6830d982e6bd5e6e498eaf59389659717df080d235f2b8294edc341f91bae3bbc2409b52f0e3fb7b66fd7479a366b6b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56928de37c6d269b34b5678bbf63a58a3
SHA1abc77d5a21007b4fb63f0644173cbaf02317ed1c
SHA25683a8b287606c7038d5d753078f7a476bd84ce6e1069b0775bef8a69514427ceb
SHA512583796769ef397bab62c6f896da9936ccc62f0a2900a5c4e694071c2a5a767a7ba3e73c5e0fbfb9a17aad6001f03c7d01fc0e570699333df2d1dbe79610ceea7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3b3810285453d030c721951d275bcc8
SHA12350a6b2d0100098281f49636f593a47656649c0
SHA2563bbf04b05bf42812f46da3e1c3e1e9209452ddf17a1793787b4f56e8d1becf22
SHA512c2bb8c00fca5ddb6742720773bae1d4a800c31f545f29b6b436f2c0a0f8ac3057da7cfede0d2d9f33d806916c66f0f98d1933be0154e1e256a819b036c0d162a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdc16252405674f4caeacbae3f5bf15b
SHA1226c24d196f46cba1bb66e5bd7af7d9a53360dbe
SHA256b98dfa7f01681b5a0ca54d7782b170a13b1d674b6d16f878b8eb3fcf6e82a313
SHA512d40d1047a87566768f7c88ba57f89c9e557dd9a1cf3936b885462f69d0136967ebb41f8bcd694cb7c298c45e8b87221a294381ed713b9129acc5daca3b044ec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dabe1fb46e7aa104830a5a60beffd322
SHA1dfd46b9e25b1f014c9e79bdb0c21e437c71a7981
SHA256dfec668edf80a5309c557e870f827b27b490ee08105526c99ec4bf3fae74a1f3
SHA51233fb7b7dabe1f6dfa76bd04c4bf42770c24cc5a9c221db50fbc9a004d6b7b75209988615768efccdff4eb90c5e90842c2e18ab2e3570294a1361805f6c6b211a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cf8e4d6a2f22547c4d45cb91ea0a707
SHA199fbadc425afc0dc7af9785b804c721489f05e6a
SHA25618ddadf7e00e62f6425e8604c0ee05d7ea1476717f1d85ee1ce22ed932b45f79
SHA5126ed901b5a99e9ca5dd01598692bf60c342821d400ffc08a24b3493572d02cd1403be38e2f88d1fdc43586108ff516aa5670e1dab7958cf1cb3b6ca23b7d2f420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c73d6d86a47db8c02cc385a684054d9
SHA178549a601038f45c98319b5447fd233169234d39
SHA2563db9de94ad5f3abc884388d46fc7c1a7607ad945200dbf6b3b3f016891784962
SHA512c3ab5044939b942729b05545aea145cb84b5a7856901b08b6b82f6e8479c3daffee81493847f7c42e20b1d01773b44a4aa26e08e9bcc5f8720ed58cd14a40326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5642d891ed2171131fc4d23be9da27316
SHA1ef402cfb2b1fe52a449d45d881012f5a99804fa8
SHA256355a4b588938add129a52ce893a152c31f3100e82c5ac8477bdcee6d18e0f77b
SHA512963495564b967d1673c7323c090b0bebf11c846266a9329c360d54a1f38d458cb5d3a73a2359ae2a12fa5f5d90d5e9af67ee58b22e326d9ee94a003a80350bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57319ed0c209a2ed7edb8f01d119f22ab
SHA17a765df466f98c3a2ffad17bd9f1fd38b72694d7
SHA25642e68eead41b1bc591f98be38533bbe46211bae90e5be5111324d072e659ce08
SHA51224d8a2a6bd8a165bc1532baaefb1684f7c0096438d3337b97d2ef009c3c62584650323d25dfe03c6648a035ce5acece7eea8feb4ba0a7d6886e10fd17e127711
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563b1c0f20f2b4f0ada255c580254ac14
SHA1c112e4be4289872ea8746ea2ea7d987111206b1f
SHA2560d5eeb2f4b4bd11f73fb56caea26f7d9dfe17be92fdaa6e6895ef029546c7a30
SHA51234e99783413c2e2e9a77d4853e4fae54136007a237f40a834a22e12c73f23f423dd49106de6909175bcf909a370b9cfaceb57312ceda79eb2e9e38b2af79c845
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7af9ac20aee4a190c843cda30f69f98
SHA1e8e806926941476542011bf35020de1f0ca34d5e
SHA256b38c592f92ca97d99ae25150f3b5f240c383bbc9ec3b7257f30ac2a4b2204d0a
SHA5125f79706a46075849e15fb21929548205659ceb42b23f4ba2fd54f7bba1fb8ed1ee66c2fdbbd72f48ca0fd8189bd4478a8b160801ef3a32f0407389e2302d0f6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf232e88e20cb98f94fa6a0fe98b9f42
SHA19205de5b1054311c66d4419b8acc1add4bd9b957
SHA25672d781275223236d0e12ff222e1b255650e77666ef7b38ae149a934e6a4baedc
SHA512db31ee45adf8a3048f706f24867fa2cb6b8b7ff0439b00567a038a475c74741a258766ee1224729424abf18a775e5b2e263e8fa71401c20b2c6c52a10838d234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592865a132e7e50476250a91f0a3c69cc
SHA180e13f644a9ecfa6b194c30ea669d6ef86385951
SHA256bedcf6683c68b45f935c233f6bce8ee3fb43e03c281d45e002db39ad8bba6736
SHA51207e7ce47712b5c9bc1a05f8a695b994d90c744200569c233277218002dd5f53cf5c166bc82652526c9887be02fc0fa4b610d28c44e969028a3ac0008c38471b0
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06