Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
186s -
max time network
209s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 15:38
Static task
static1
Behavioral task
behavioral1
Sample
0415788e17a8ff5a89cb305a8fbdbb1d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0415788e17a8ff5a89cb305a8fbdbb1d.html
Resource
win10v2004-20231215-en
General
-
Target
0415788e17a8ff5a89cb305a8fbdbb1d.html
-
Size
57KB
-
MD5
0415788e17a8ff5a89cb305a8fbdbb1d
-
SHA1
32f69941c36445e893280526db9f297e89353105
-
SHA256
e868dea2eb5c9304b0d04a22485d328076b1f6c2b3d8fc285b0001202d13151c
-
SHA512
e0f0bd443431be381e9e5612ec1e897018fff210a279f6b7e2ddb0ae50272dda4141f2626739c505109d06c148b89eb820a72d073f73096bb2947b3038ba184f
-
SSDEEP
1536:ijEQvK8OPHdVA9o2vgyHJv0owbd6zKD6CDK2RVroL0wpDK2RVy:ijnOPHdVL2vgyHJutDK2RVroL0wpDK2m
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05658ad8c36da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000045ffe9d7e18edfcda845f7b39ec2e340f9326e79fc39702f7ca855eeb50c9fc5000000000e8000000002000020000000b7274079337b46c6d2afd7a7a2381ef7b60879da2bac538d60024e7f0704fb7020000000c99dd5013245afdb829b3498c877f8f94955eff3d9df6fbbca982fb1e60b532a40000000cd48c91791a27818e0f460f19b6a588d20834b83bde3a7858acabd91e7a6f7f8074600076dcaa5dab76a825867230f13d4adcc68347011b95821795f5e8281fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409599869" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B032C680-A27F-11EE-B160-56B3956C75C7} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000001359a15c01090d8e537415df2088432f70ef3d41a9764560438187bfa10acbb2000000000e8000000002000020000000564355ffc54467d57629768a1a761f0cb1d4cce72fe6e548f8ad5d712f25ac499000000030c6747b9f65ff9d9765fcac93e890974ba66b3c5242f2a2cb729a64381441de0f864c4082c0574090ed9a2f573c9c4c77cc48857bafeac20f5cb1ce3e5177b5693f22f1fb2683ec1d13ba20a34cee067c34138447918a176ac6797f8a069bd1aef098d1bbef69ede0356d3af790b17a1faa0e2869fd78f4f8e68c5dced83239dcdccbb33c6f3b4dd15ca7404ce030c140000000b5f66414d72e0fb35cb8b560fd51abeaf060e20f8f8ce0e6fe46dbf59b6eced9b1673757762454b6b7577e177cd072d9dfdc4cb5c3239efd4575c86ee9899e80 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2668 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2668 iexplore.exe 2668 iexplore.exe 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE 2552 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2668 wrote to memory of 2552 2668 iexplore.exe 30 PID 2668 wrote to memory of 2552 2668 iexplore.exe 30 PID 2668 wrote to memory of 2552 2668 iexplore.exe 30 PID 2668 wrote to memory of 2552 2668 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0415788e17a8ff5a89cb305a8fbdbb1d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de22ab64e7223cba41b3c6a0b04ec5ac
SHA10c39172dd64b79b85bb4d543cca2ae087c34dcad
SHA2563c131b99a73c4178f288a46ae999578cbc4b6c554bb4c24482f6d45c8b884c53
SHA512960061c1994aad03bf26e7257daaddb81c916baabd603dfc2a1b8744a1793b9417caddd450d1490d9f9f0c1ee8c701f556e9d43eac187f3b3bb9139ccf080200
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d414366e658117ac023ee774c79aeb9
SHA1e1b548b3f07046fba5722e6475262a39a996371a
SHA256531dfaeba2142af04b363ef101770f8aba89b56fab46a24c634bbfebb4357bda
SHA5123c50d22359879653e3a9c7a6cd5b3ee620b25cc9d770c9667a8ce556504ef1f1ccc2378d5c52c6ce241ac5e339c2a9d8fbdc6bb64ee2154599bf9d7383ec10f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535cd958d38d84af56877000875e2b4e2
SHA12ac26147c31089d1e59d3af0e53bab8f36d46404
SHA2567b38676569dc6e6a3a8f0fc37d0570fd036152148c1e85b023f0ab5b5b30eb99
SHA512c192f5c1bba035a147f61417cbba59b78996c16186e10b691eff73aa94a99f988f2c48404c01a3fe4bb9ed86fa5ddcae99e518daec0ca1e11e0611a8ea4cdd02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f91b70ae2841e359b4b6eaaf099f3a8a
SHA12e73c3a73e1c39726a68ff75841d4575332490d0
SHA256323f595b886c350cf10abae069ddb6963b1f5274d7d648a1b20cb63bc723c6b8
SHA51204a986f97aebd3b9d404ce481062355f9ccd99f05212ad515cde460c3eaa98b53999d4247be98606c3a0d9cd981146dc8dd4321f8b2f1ee7f7833db557484216
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5671877923488b20a2167cfbdbc55071c
SHA1acb920de3c0bacf6b56ad829c74e6a2c35cc7945
SHA2562c02074cec7ffe1e8786a8544b51c5c58e9c661e81208718d2ed6a8434d669ec
SHA51210a15ba81e3937ee3553fa514c2646ef6465d7b0b5c67711e8079c326cd43de3796569005171711344ad0a4c802683cb3337f20ab9c74e3d18598dd1402421bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ea8c8d804f85cdf6fa3ea685ee7711f
SHA15b5cc08696f866f9ec2548a71efe4de2ba3d1f97
SHA25692fe0fcb7d835a9917fdf05b65b081a44b0db358d63f91fa889fecc5e56714ec
SHA512060e48bdb2630ad4cde581678822e3ca9d16352720b1cfa5ec2cb93444bc5c3147f3847e13acba4e6cd124d30c4e41044405b802b55f7c210f4eb55baf67ac76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b567800006ff8291f271b37b509afe23
SHA130c23bfd8ab9dba162c873c9463118e3d912c2db
SHA256cd65f50f3cc6627d892aec6e60aca5d7638746954da0e48551c2352775d2d865
SHA512069c49b73cd9fb6b698c8a09905ef5187c87698dec99fd8f053fa64d22283d6dc6a7a82f87634bbc0c8710553ba5793feb84cb09531f6b2c3479e2959a0f2672
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f8e9c08a9828bdc18effa33ef5b473c
SHA11f392578da5ed3342b276e3a5b2f43e589e366ed
SHA2561baf394d40c2a1c28dd583d01c6dabfc5b371e2562c29ae9075ee311d268e6d7
SHA512421290566a89258aa22eaa315da2d2f7f501f0881bf863241488d1e330836dec034ce9473c67e1e89efac6b48e1c20285a84c9736f5a3352eb10353c15926619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524e850a3f129616a6228455ebcb78e60
SHA13e617635dc0331753b140d3fa1fe1ff6635ec58a
SHA256eec99a9dfaf9384e2e12bcac7c6d10a0f3485d9022f9f6b3540b20ea9c5b4048
SHA5129c49a5c982d5b1e3b0b33d3b967c172d36331f84b120feab402f2cee5da2a079e6de2ffef7dfee9303abaebf2d203f84e66482df5a0c5e465beb3b54ff4e3e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d6216f0169b106b1a3d46a1e576e2e7
SHA11d72a785d1bbadba1ac5bff1cb06d9b200bd75e6
SHA256e69667c40197efa3be93af84a6688d9f0eed38e925d1bf9274deabb6918b9a0c
SHA512581f3e4028ebce32de39430bed398d64e68ee551dc872c94d477f053bde7ea2052468acd4cbefef9da1bfd69e4075024ca6c8fe964b38716596d7d52107c1059
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b875682a40a683aff88afe86955645c9
SHA154e980c7b3fd92f2ad4fbbf0b34213397204f39d
SHA256ef0bc94469ded994e802d6723c8fd633c863950cc9d7441f9ce8e3f7036797e7
SHA5129ff1a022d0c999aec358cf09cfc53375764aabe39353c56b6210bd5014b582829e71ea433e59efe9eabbeda46accdcfdbb508fc68266287e1b3816dc89f33223
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504f295e6c4e4a78208fc66bc9760bc21
SHA1f123665cc21d29df765e650c55c9bcaa7438778b
SHA2565aaca985d1a3847d0002a80bd1bfc214f2ee04b13234ca104c8dfdabf584b291
SHA512002daae605d842c7fbbcb9f931ebf6635aa5dde1862f708864aa8774d8dba92db00667d20a48ae07fa82d4d768ac575c75d345a01dd303e831c4b049c1664b9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a582af09fedf14cd3e69dbb8298dc22
SHA1a3660993bb7f4e26851f975a48b4af363280bcb8
SHA25613e898505e0205b5dad04d4933d6edab30046e89e619866c5f50f0f4f0b02547
SHA5123de454414e7298ed22b3880784e98ad9579daefd4f42e231816d3bb3a60eaaabc9e3a356db72600835cf747d8f4cfb44e7fec5598fb173a1db262ce0e01e20cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e78d9b5c813bdcc53c0136712de098f7
SHA1be4f84853133afe7d37fc3dc63f0488c96cb8cac
SHA256b923ed683dee547522126790fe3bffe6834a1291008889c4c8c1995508ea2f47
SHA512f968ece71b7cf05dfdcc8bed6cfb38da4c814bcc6770f627282456fda9f8b22e06581ad432e437546a009fdbc23e0a91d87faddd7d5cabe949652397efe5f63c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac5b557c9eba47ee23200425238f68b6
SHA15d8f117b604be2e9bb48c48820197e0c07af6815
SHA256a1cc7854d00b1a041f203d4192680333550fc9e0db2d002ad85d5cc91689e964
SHA512d40c11e6e5c56a56c185e682b047b75fabc398590c9aa181307ec2a83e4bdb3c5af047193778534279b372be1440559331750def5965f3989802db03129129a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53180ef4e77f416065f6e9c6d3904d416
SHA1b5600dd93e19b052b0c20387b150dd1feb7856f6
SHA256d89aba290f56846ae0a4d152a75b34b283b5ef7a9d0fc461ba30a30a5d45f952
SHA512fecdef9168e4017382e0de1e8076e2a8ab14f38a34d66e751975d9fff1d7b56e36215235b4c61210b86655e96c8113ad4768212a9e436e342a4a1562e4a4fd0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\f[1].txt
Filesize34KB
MD5d854bbb2246d993bd1f8687e79493f60
SHA128fbae93bc5e4e99a6c905fdda488be72057c307
SHA256707248d75606cc53aad966797dc2cc86997d1ea1a74b1c99b9191716600c74e3
SHA512ba4e7ef0a590c84310fb36ea64202cf821058eb7bd52ada1cc9fefff544b7500bf54a8ee43ce80b6cf8989071b0deaf2bf9a50c8063c192f24063f318585c3f2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06