Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 17:13
Static task
static1
Behavioral task
behavioral1
Sample
07c8204116253a1228ed8df27596bf95.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
07c8204116253a1228ed8df27596bf95.html
Resource
win10v2004-20231215-en
General
-
Target
07c8204116253a1228ed8df27596bf95.html
-
Size
6KB
-
MD5
07c8204116253a1228ed8df27596bf95
-
SHA1
312b23f2ca930bd690683465b8f59d1ea9780cb0
-
SHA256
e1961c1792fca9d5b34a1d16e0840e909e12efe801a49b90e3825c67397f9a05
-
SHA512
d1ed4c3504e67db3762ed7721150a878ed8c69ff3e412127f5e1cf0eb34439f340f7e8ba0c12a9009b8281086676ce3977f3dd0630f238925bdd68a0586277be
-
SSDEEP
96:uzVs+ux70rXLLY1k9o84d12ef7CSTUs7cEZ7ru7f:csz70DAYS/Rb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005d41e36576c1ef85d4a01f10c1e893fca2a6e2030295ebea17c02dfa68e4b758000000000e8000000002000020000000cf348f43a61ee855fd9c8c2f1340cf03726e8693f23ef368a592e2bb8f26ef5e2000000096005bd2a622a4862ef2f29390f2aca98a24f4e031fd51a1c933a43ab231837e40000000ef71bb3f2f48b000235a7aa915cbea1567212d38e5ad035c828a743651f80db78b9dce313d6ab9bf808885d7547fbc69aaffa859bafe8f8313cd074fe6494aad iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{48EAAC71-A295-11EE-9776-EE9A2FAC8CC3} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000059c3be537dfb591563eb171089bd62ee88b54a8aac594769380397fe5a84057c000000000e800000000200002000000006c0b726ee121640294c2cb9d503ca3dacac79a3cefa7f5d44070fa4e9f54aac9000000031b281b2fcafee5ba55068fcaa8f19cd0241cf482fb73836ec289b2624a2949e3856030b7ae5cd4fc84af337de7946c52bc0cf9f96b4f03c3d22dd197bd6997ad0f8cbde4cc75d9e632bf67307447a0ede105410f5b9ed38fef9e408f3422800e9af457e228bb0b0078201c99b1841ca9d2d43e581233f77f06f15c421df25404b08683f06fc86557830b5d600f93f2c400000007a8f6b015db10c4e3e3695f1bb9414e7015fa99b652085309a00296ecc6187b427ac25579eba04332e6551c886111c275216664857308d5eab705d8c2158c59b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409609128" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7035cd28a236da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1200 iexplore.exe 1200 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1200 wrote to memory of 2696 1200 iexplore.exe 23 PID 1200 wrote to memory of 2696 1200 iexplore.exe 23 PID 1200 wrote to memory of 2696 1200 iexplore.exe 23 PID 1200 wrote to memory of 2696 1200 iexplore.exe 23
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\07c8204116253a1228ed8df27596bf95.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c8987ce434a00b28be69d0c15e8f038
SHA1327ec5766fa937c2828dec6151aee4026bc402d3
SHA25626c414886a2a61ebe7f8adfc7287bef8110c31e97250f9ddde2a4b1b198cfba1
SHA512eea9ab6746992f195221d6ad3f95b6b7673cdd2a4b155fb24eb37e5ee9198508a194ea80c2cab5d68b9482fd8f763ecfa3ce38cc39cb34a0e79e8ab5d6c38482
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e81f91375bf2dea5ec324780a056bfad
SHA182d9df4037dab35af9c118c7c1402068b67f4eca
SHA2560c526b952c690e63374a5df9e1e78b60bc762c0370315b73f8b1b3559a8e21d2
SHA51287d9de21e52381338c1c00de64f8681854d422287462cc838245364fe5ed21bb59ad3fb7cac3269ad44599cd603459eb31fcd41e6d14bc7bd60fb03fd15e1dd4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbc721dff6441cf8b7cd408962949762
SHA1f52aa578d23992f522c8e68aa82af327eac13a20
SHA2569328f96f008f0c2ffecd411a4083980fb73d45e3ad19b6e38c03bf35b3cfa2be
SHA512331f76b6cddef17953359d0fb6c17f191960d7dba58e52c2d7beb447328d987481c3d3f39a8569d57782d74b5746cb357802de40af8320872862297cac1bcd30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5655e25f17211b5714e172eea3d322726
SHA178f57653f18f6331645409feb2e0a068cd9e8606
SHA256fe4889711437ad54ab5c2c0e7339cf1419e8042e049919534cb2d728106c7bfd
SHA512de57f9f640f30d58111a79817e8f77d76e57aadc52264a779760f39edcd8eb6b48cede01cc5938e3634c3efb52504b9fca48e260866f204c7655cc7be6f014fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab4d623320e798e66000097200db0fb8
SHA12b3296099a77c11b3a1afd2f12b5b732a42a7dfa
SHA25617dac490d8d6b0a2bf8e5646647b06f480a7556f444018dc1efda7c9ff85778b
SHA5122f3cd8102433917b395248c0df80c2003d07cbf47370bf2141aef35116b42c81d74e867bc1cf24b840d0cd2a768ebf20363e2fea21a699ba3d9a685a7e67900b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517f609fa57cb770b33cddf1ed689e23b
SHA13e7002571c8251ca7902174d4ada674bf1e8877f
SHA256c3a62e9bd1fda9b8319609b22e45cd4d0732f1898c64817b965c4cb95e4a20ef
SHA512214b65b6fea3301078f7cc9ccdf0fd357bb11d49d796fdcf9ebf53b684229da89289d7c5719cbf779bb780666afa9b6b7a27cdcc2827115b614a68558e0c242a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06