Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
055438fe5ddbd192ebd5a65ad1e47d8b.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
055438fe5ddbd192ebd5a65ad1e47d8b.html
Resource
win10v2004-20231215-en
General
-
Target
055438fe5ddbd192ebd5a65ad1e47d8b.html
-
Size
26KB
-
MD5
055438fe5ddbd192ebd5a65ad1e47d8b
-
SHA1
882978e5ea294b62df81b881c0cd01c59f8adefb
-
SHA256
498ff543d9ce58b3f548d5bda4812ca25f97315ce1a376d6063741685742563a
-
SHA512
6ad10bf64b16b074ee7ad2f6527acfea363ef8750ac79a72b3de3f0789e3b05704f6e49fe35d96dffa593f8cbba5dafed039effe97a22a90f8606cb55a39e749
-
SSDEEP
384:3rRozIXVsdjqDcgxMu0VGxyNFdR5hxCScKKOZgKSTBQQCTB6VLC:3PYuYgxMwWRZgKQCMVLC
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BB58D5B1-A287-11EE-B309-FE29290FA5F9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2416 iexplore.exe 2416 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2620 2416 iexplore.exe 16 PID 2416 wrote to memory of 2620 2416 iexplore.exe 16 PID 2416 wrote to memory of 2620 2416 iexplore.exe 16 PID 2416 wrote to memory of 2620 2416 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\055438fe5ddbd192ebd5a65ad1e47d8b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
PID:2620
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5dc8568450312bfa3cbb0ec43b4bc1498
SHA1cb5f7deb9c220593f9e06c0fe33b12b3332da2bf
SHA2561c5a2573079424a299d042547ddb8ce898c05cd741509e1c677a654916190e5e
SHA512bfff05e58962402f8da8c4f8f907087af716c8069fec76cd19b136f3926ff55ca546ad65cf1b1bfad29af792fbd620d2b57c54e9fa51b1a540220be981863601
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD56fb5d00ddea00be6819a7180b35782c5
SHA161fbcaaaa51794846b5890e84f6f4b124c4f64fc
SHA256ce60b00c691fee945d2db6130f30ae5d22c4dea634347f972d013647fa343aa1
SHA512699999f10941e21d1f9b11a5ba354da51aad805e624e122ae6a5c140ff9ca82c10e3aba5c0c8e5b76f15c31e6b63ec3aef6d42b0a41aac017413d13ca25860d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2847f1346d4bf4c7011be99b0b6cd61
SHA1ecbf1abc05f8ef1a92f0db37d90e44e3919f99e0
SHA256a85753f9c5d8cc7a09c5060e9a1b7921e0a8f4a9887f734d486bbc3b0c99c288
SHA51238bd2e515981d8b4007bc011e1ab428eeaab7a6c8ce0e4751783e62cd88e652c8762bad3dc1e1c86e51c86bf474c4aa6571e0e80faada8e04174ae4775dfc6c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597f0cb24be930666de4a92e8db53f0b2
SHA1d72c3e0f7b25c31e702583f7654fa202177460d4
SHA2563168fcb08771101aa895f57f5bb345c3187de8f29677e8d73a643a28bb1fb19b
SHA512b86381c9b71b8754d9c80c9f7643856811d40507d91bb0aca75b568b6f0acdb9cd1dba4ae0f748b8a7cce14f7031d4ef2e6a10c548f9ec1670cb624f332ff46b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd6ed23161e31b4c5cc2629727a3e678
SHA19b390051bc46e59268940c6d569790c55074c55b
SHA2569e3ee878ae506abf0979c632d3a55a4edb744d5df10c7483d08acbc2f8083bec
SHA51295a81c315f49b395059cbb1592d1347a52880bec52f3b8aecba0f8736f82b549383861efc18624f9232aa7c6c6d08ace0c4de11bbca8065317b3a1416cbb4951
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db7e2271dcf988cade3d3b05827ba0b0
SHA1501337b51f1d2683f9c50299506bcbd6824e07de
SHA256b7bb1cf0e6033de02382dcd828b68c9474b23b7c1e5c59f018ee97edbf00dd1e
SHA512c5ed3ddb569841e6bb264d81eba9b1274fa33d7443a69bb7e1ec6018075315a02953d5748295b2582cf868190f69e6765d83f1efb894de87d00c44fc2039e42a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e58c297de1ee445ec42f5a6093671c28
SHA16907153eb5a54042129f208f9dabb0af43d9bd4f
SHA2562dfb19d45715b70367890dfabea48c85166f95ae1cebc9a0998b1ebd8ded4f51
SHA5123fd139998d9c2e129b642074b15b6441c555a46e80872e74666e14040d8add26bc1500091ce16e4c2985a4e24a9ce40b1b3af03a0e3552f0762fed6336d22c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57767392a1d6a1d8c6deb6c25a66a7de6
SHA1c576eaf499ceaf9767e9542c28cf2a586de9fc9d
SHA256948e0ad5e6ac9414c708e56f685f64989796934683b67feda4c4885f3b357f5d
SHA5128c8cd6090a2b77bf8f0b835163c27014e9f34689f0e481fff5d25b67b8382725a78ae1be4fb5961fd3304ba06c6a524fc313c23bad722e2031de456a4144a517
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fb503a9e5855ce07a0e5892fbf20ef3
SHA1aed5b55b5c5edbaf438b034dad522c0a25c4318a
SHA2565ffb968297de51031a6fb198718c0b33586864ad6d8fc24f6e6e08f855347af8
SHA5128408e7be46e9704562e0470e978759b297972198235cae580e9b36754f36de3ed3d42d04c0036f3386b80b77d98d75de8c7a1fd85655a5b726741d4533ee0ded
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562a962c1b479e1d65c8bf8abd54285f1
SHA1e8316a53cb9aef7b259f88b81ce5b096261ad901
SHA256727c42eb983a5426dfcb412cf9e81d0b9e4b413a8d80315649a1f5adf447c286
SHA512b642e89fdbb8157dba5ff287d5d06d45d46dfae540ff284d3e78f402d135f99ea84dab31bd02f7773c236e6740159d345217db8dbd39e80c1538f7ae226dad52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b49cffb69aef0a7ffa93727ce2109740
SHA19447c8012fcd645484ab8c60432e2cb61c3deca4
SHA256e2758d69afba0cab52c9cfff02da8884fd540cf00f15f325ffa98f8b97183798
SHA512f5a2b949cd5222b9b4bc0544fddeb06796cb6f23c77ea06b7b4d313d1fdc7546a4cec324f83bb07bc3fe16f751a07d0d54d7ce12cdb411b6aecbb6913c6c4e18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5aff1d717c1c737d7f68e424fb2cf982b
SHA1895ec13b79d0f9d33dfb3498c86896762a8ecfcc
SHA256c7e7a1a05904ac40bf4a6b39e4400610fff8bc603806635b63e99f02c9a829ff
SHA512efbdb7401d82848afbf371cefcb831d1c15468f538a3ab5b8727b7c7787113e93a35aa09350fd279e7c97ff5f897599806aafa81c4fcdaf7cf6b9f3fe8bf2bbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize1KB
MD57125f45e2b64561340f80f2df51ebda9
SHA182f3193a53474a5d83b4ba627d61ec0197cfccfa
SHA25631054f95f3353639a6564567278cb431718fbe3c9bbf1df6a015ce5b0626c31b
SHA512becfa9c67a6b9dee5f30aaf8b4a8699b2ff4af652e86fa80e55136f7844863bcde12249f8531ac8aca085538d568ee96d15223c8d332ad2edd9dc8902c1a6a2f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCUNUS09\KeOk1LZxPm7[1].css
Filesize19KB
MD5c8591f773bc412fd307163175a64843b
SHA1bfc8af52445868cc7a6cacb3513ea21286f147e5
SHA256607ba88e1360e4b75ce0595f8359f73f7fb8bb31a04c9093f1ab1b13e4a53bdb
SHA512d2851f537fb8ae7874ea20cd89813b5ed8678cd3d88dadd21167cc70eba375d4cf15a64cbaa355bf1e9772d9b22b1c2285544f53fe338c6e6b959d6b07d06d98
-
Filesize
22KB
MD50229875856c8082f8399a2119168bc44
SHA19a50719852886b0eb6810ffeba6a7f8777aad86f
SHA2565909ac9cc163d6be02ab3296b38f332d2139512d089799f0ea9160bd2851535c
SHA512738d33cb7b9611b7cc3311520629e4f645a75a2b0b91dfe0e7b06e3b9a66063972c8c1db511f8100a4627660443b4c1a47c0c34c2998dd91b33a2f36a8b39490