Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 17:25
Static task
static1
Behavioral task
behavioral1
Sample
0863defa6c9215f7f0edf11f5c7b84cf.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0863defa6c9215f7f0edf11f5c7b84cf.html
Resource
win10v2004-20231215-en
General
-
Target
0863defa6c9215f7f0edf11f5c7b84cf.html
-
Size
25KB
-
MD5
0863defa6c9215f7f0edf11f5c7b84cf
-
SHA1
9654e9c3f468499e30896b71e361b5a61cc7e4b8
-
SHA256
e1376453bce1188ab6618c9524a024568401e0aef93b5972ed32326ddc195c72
-
SHA512
a46a28ca058199aafd5e1a40e24fb2ee43ae0ce2e749bd054c2d8026e887a11b9b0abf4b53b32d9dfffb974eb62b29e77ec086de63bd902e0c520f8c001d298b
-
SSDEEP
384:Sdg2H8olIGwPAUYOUtxKTeBfKTp73CWiYGgXLgWQQ/U4yhoy7jfIWrYc51IlSAuI:8g2HllkYltITe0dyBwXNG9p6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000006e363230a8a28223e0bb533f636e9e1fcffbe5cb961ed8cddc05ec1fb645e48f000000000e80000000020000200000007f5e64a4840a7319a3aebf805019c6a7a8cac91c5965c368cc6cb3383088b6f9200000003c4ad682bb18d4e4b1b5eba09c30a6f33085d6632770d1c796d893f1bf7c3f9c4000000014b4e239c7a9a28b725a2fd53cf1f71a0be31aa9ae7bb8e1736d0cbfd89479459f5c17e13429e61672fb084e43cfee53031f018c438ab4f14fa01df093edb403 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{094D59B1-A2D5-11EE-BE0E-D6882E0F4692} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409636518" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000002f3081ecef48aac0cd60739aba755d9f8a47cdf18e1e65ab99e2e2158941e10b000000000e800000000200002000000086e54b04f9ac156bea3113fa2644ccedfb9749bc15f28c104617756bee3ca373900000005fbd48a96e9fedd4140fc47b204f40334431f1b005a1ecf6d304f50943e309c8958e29c956ebfc349e26ea8db8bf93406b591b62faadb2bc16eef0185708928967271c37aa6ad5cc3d0044b6421b649ee9744d56b668521921b09813aedf428528423288a2524001e14e7b8193aae5337a2cc9006183021aad4ae0e88103e2609f022c61b0d9cb002463b3313da7ae7f40000000cd6b256c357254317ee70c448bcc83d512be5a49e710e41f5438061661f733329ba57e3d8db59da2ba96988f6c1fad296cce8001e2466d6fc727dd49b4b6313f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d021b9dde136da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2248 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2248 iexplore.exe 2248 iexplore.exe 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2932 2248 iexplore.exe 28 PID 2248 wrote to memory of 2932 2248 iexplore.exe 28 PID 2248 wrote to memory of 2932 2248 iexplore.exe 28 PID 2248 wrote to memory of 2932 2248 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0863defa6c9215f7f0edf11f5c7b84cf.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c44f6412d68d5e85c93c62509d3f9a75
SHA117b9149fefc8a63041e42d641a387abd809a635f
SHA25688a334ceb9c2f90517a74e5bd2648907f411efe27491248be220d35d8d201ca1
SHA512ba7796b18d3867be09e3f6dca025f4cad2a2154cbf100d6332b34522442c25fd2cb2724a74fee95408faf387f9e7a3e0af77ee5184d6516ab8523b8ab5b8cbb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d69311cc8bb96752bbb45eade2e72e0
SHA126fc739c890658f490c77c780fd584c006b01c10
SHA256685f37e53db411e420ba80c6b9f5e250324f67ce86b36876143f7b990e886156
SHA51298d04c4e951c64717a6921edc235ca6c44370aa73276707fa70df2e77a34bb9a363dec74ddae7e1e5adac4acdd5dcfdb285733a3b0137b8806e515b21dbb95fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523b615d26349fd3f4a72351db8dd4b80
SHA172f5f01497d7f758d126a21e8ed3d627240f4fde
SHA2568973592a35ef56e981901fe6b395c2ee4e84b6e935adb2716c4833962278579b
SHA512aec1c7e6e36737a53ffab2f40f18b12a17003e1b333c5ddd8a8d62e185ea98ff5ad0fdd320de5b9ee2f8c508f4c9ad27550a4fd8290bbb743e2855a715c2b853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f641cc2733145e64fec3abd6126b56e7
SHA1db5f63de095d146842c278be59b82088524ef053
SHA2568714d6423e0bdcbcaf5350ab7df11052c01656531b584bf46f3b30989132a790
SHA512046f47d40835558746faab1104b8fc4286c6c1aaf39f6e16796e9dec55ac4ee87ef222f457436e8cfd3d68bcf219410987c52dd014ea394150147752ea171b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588fd113961925d84d86ccbd3b5078365
SHA1086acc645d79b9213ecbfa858b4a6565fc5b0ab3
SHA256ca4fc7d552eea59e7b652462bcf6bf6ea58ea7b4d6030348182004e5402336e2
SHA512cf4ad7ea9172f909e881692f90b1e027342f48ba30bd28bd90dad963e81c6b9a174ce54ec65344d3786f6bf016e7b614eb83f9de2fe73ecfe9c88d5ee9243a6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8e4bbfc2a444f77140e7f9757ae4587
SHA12b0c76e3745eccd877247be95ad4f1d60d8cf5b8
SHA256d872333d7e65b6769a72146afde2de28dd7f4f11125dd2c7a2d4b99981e4c6cd
SHA5126f1348d181b86564a84d17367881d3779acb7f3c547d4b0977d1596b35797df97a921544fa83625d983fdec65e4378017919446cb3c9799176aaf8645a8a7c99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567a2e65f36392dea8f6ae28eebef5230
SHA1c31bd0a5f9ae46957566ce8a213cc814863c1c32
SHA2565c3cbd287e4bc891f3670c76b83cff8c6675e097f9e284ef48cf276fc3963b01
SHA512a012925655861fda70449da04cf623d240001b303a5dff364ee19b86ee3a6c0ff1f811290b642f0c7e090e0019a79a222322f111d83790be2a9f22a7bad90a28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a88a03b76afb5b42000019914490b4e1
SHA1324f29a4e54c4ccd4ae8ef4757e355ead58b85b4
SHA256059197a007af0be3359f16c4a036d4c3d79264be1f28e2dbc5581de1d334ae8b
SHA512d8fc8f16a6c014f4460c639bb54cfb057deae7d63e2da029deeadbcb600d946dfd25b919dcb2cec8e0853824e0ccae5c883cab90472a2675af2ab197cc1e7674
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5312c09701e26d8a94f19a8d0967fbcef
SHA12f848aceabfe8ed7692351c63ba20f154a92602d
SHA25612209bc9a3fad4bb9cd1af650573185fced80cde7932fc8a5f49fef19e0a5bb3
SHA51264b63b582fa8bbd2f7393d79690b2304f1839919b9b813749f8734a1e23b20d292a84a5d71d2bb3dd7565553ec5946b841aa62f490152ea89f65cb332c5d7159
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589da47e346de3bc718d6232a6ba6ef27
SHA1ff0e4b35e5f292c8903a67856bf4323e3d168cb4
SHA256e08cde2404a52e980787f99ec24417d661365568e8c239e6f1645ee5b8e9aa68
SHA5122cfa6d3cb6e66cd357fd559a335caa537aa1a2628e939913f5ce32c605d77176a23d48c5c6f87381bd7c612901f2494c884b396fb29aa9e86a644ee437af739f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7d480ad43a0feae82439f411e59d475
SHA1080203dee625a2bab6978845141f8109e1e03a2e
SHA2561b69f2ae8284b2af50ba5fd471ccec03a7d087ba8c85cb4bcf16cc308e9dde8e
SHA512a6f1abb91c03dd3de5b6923dff4876e139929d5fc1cfd4d9a903fd549b8a3f5bc4eb249a3cea623deb4302d60eade4f8a04d46c419477d09ad94855a130f0670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556eef5a9bc7ff490ce2656019b4f000d
SHA16c987998c01c9f2cb4adb41b5e7cea13169d349d
SHA256f8ae383e44e4ebb8295ba87c3d9f8c4d0f73f4bcc4a6a2e4936cbf055a02fc46
SHA5123751e42e95d4a9db8926a461993512cd6acf279a8e74f2a6519b3451708ded7f5075c2db096299b4a88980373aa78686a41d753eda6acad8bada95e41d20e457
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af37a27b286763a027f5452de6ca205c
SHA10e84e5c0a5f222fca64eec9c1e2edb8c40da4476
SHA256e46df864f2c35f21e3548aac98c327c2843ac6749141c4c684ff83993201de34
SHA5125e92e8269908ded4707cdf93458824e14996a6ba90fa490fcce1417d28d0f67c74272409debeb6360034be047c89e9056b90a9b7e0b033e81c651ba68f7d31cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc7a54446a0fa4012a410d3f62a70c1f
SHA1954e1c6d00b320df6f14bec5a3ad31b71af2730e
SHA25673f627c9a93900d22143874258e4b5efdc4f8e25395457984ccb65bab5e3a8f3
SHA512de82b2b23ee02a36b7bd6d74431b51fcf429803d553cb526a5797a6977a46d33d923b0d82c76a00a8fdc3513b47d354259f1e618c392d4aa62cbd0b63e43a061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cd0f008c5b4fa6d290cedaaa46473a2
SHA184fd364cb0c0333fa415bf568aaf340f152d388a
SHA256ec86d45632da8f425dd436f44815535f0b7e1999bfbc6b4c59b9208897b57102
SHA5122d8081b02d29844ee1ee5b01c1ce88c0871c8f1f2f027451c73719a20dcdc3a7e2d67a0bb7bc5f3d628f3af5eccad8e50222ae776e298f732e98b13430612a12
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06