Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
0b910a30a0dfc4c78a4e778f9675ed31.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0b910a30a0dfc4c78a4e778f9675ed31.html
Resource
win10v2004-20231215-en
General
-
Target
0b910a30a0dfc4c78a4e778f9675ed31.html
-
Size
30KB
-
MD5
0b910a30a0dfc4c78a4e778f9675ed31
-
SHA1
3230fd4439c45d7548aa123ed3724df21cf9c74f
-
SHA256
382cc657fdee61138db74236a7f649d90a7b91fac424a260e0a517c4ba6f393a
-
SHA512
e4a9275c2a1820d2189c01b1d801c3b74db554a3123671a40c9baabdd3778bf268618874a6f4cee266d2e2a52e920da1e05198aeeb59d81ab46aaea139d950ac
-
SSDEEP
384:FedHYaaaA7KMrr4rz0kCUirgE6TY2znYhKJjzeL8/KJejQ:FkYYrz4gE32TXU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000004bf64bd64be83158493a821acd03ba5fffea5dffb16ba7a1a058dd6bd32b01a5000000000e800000000200002000000003897f6a6ba8f16967833d40c898bd3e412d22507ba28c144c35da2eb76fed6e20000000a48cb96b034b41c44c86e4204c933617b0e6068a1f6edeb93105a7e7a9ec4ae7400000000e5215cd4fff724bc99613582e57a41e66df53ca56c11b163cc7547cf56a27c640dc563d977ceade6a4ae34d979ad3ebf5e5332a4e7f7f9e355df5e2289cc4b0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409650745" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{25204B41-A2F6-11EE-A371-5E688C03EF37} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a2d9fa0237da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001c6639d9e741cbada8280c4afa85c80f0abc51d4d304673bf1a513413bf3a614000000000e80000000020000200000006371450e4524f3a680566dfba3f51f3f1ab40536ebd3952e827c369cb3c468da9000000066a08f1de69098f388e47f14be09490fea4bd8f4699b9c528bf5407e629353af1e6639de16e99ff0aa05952d2e45c3fbf54537393b10c514a8ae31fe8b940654c6272a0d3b6d5eef161d05c899a20805ced7606ed501a0fcf14455a318a975bc2613cb042ac90d4377c249b09d7669382a4fbc981c4c93b5f5415384849b55675e2496e5aa6e563134c7264abc38a4aa400000000374f1fe2a77700bd8261dbb258c0c101010ddd3eb4489d06a9ba4ea0dba260f659b17d87995240e7d43598c09da2f6112884b2a2477ba894a06bde21a1a729b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2664 2028 iexplore.exe 28 PID 2028 wrote to memory of 2664 2028 iexplore.exe 28 PID 2028 wrote to memory of 2664 2028 iexplore.exe 28 PID 2028 wrote to memory of 2664 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0b910a30a0dfc4c78a4e778f9675ed31.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a531824c018ad58fc28158c17dd0e89f
SHA174f8bf5b46e2e7d5bdbfd4213240d8be147fe563
SHA256e03d5c62ecfe80efe152894f2a5ac51db26318a156f1e6a3b8e71a51756ce924
SHA51211cf4c8038740b7f848f11c83b05050fd1b59548f1c61e3e69250829480c97e6f7c740a18e82f9feb2d2c65e85d3fec60af0f33136bea51e9c342deaa35ba338
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b953ae1a58ba10a727ae99c67336bf27
SHA1d51c5af4498f6ba15b8d5ab30cc173cfe3c47177
SHA2564cbb0f96b01b0d0ea3e0f450d059a5c30e6abf9cb74e5567e39724db9952b885
SHA51275ac92d2eca92a10592776010354b3a5c3d50650fc7917facc30d4ff7564a2b145478760f1bccc350a5dba4552e78712367503a551e27de44c360b27605fdbba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5336f8fbba16085465da5746e5e99c70b
SHA12ea494dd626e5ceab3c3f6a4436fa8b899f37364
SHA256080e4bb89283a9236ec71d7575c5b6835109544e1a3f89192fde43faa08dc407
SHA512589b5b213e7b5b61bcf25cdee0c6c5857da70330b04723110d3464369ec84ce27c8b5135833050df5a26bfd1ee2d5536121723cfd2f698fdeb3ad28335faac63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bd8a4b73a59a5aee675336655c6cb45
SHA1553f1992f0bfb54c377bb58687d3432f0bec8e9a
SHA2568a24d52a515f72d8bc61b51f8c3864f1004b36561f8df713b9315217ff4d6160
SHA51206aec8e11e15652d7eecdd5d7c7477428dda91f93efd34e5b9f01849728a26aea294cf0674fe31495b4de8d443934d33efbd31dbd793a0d206a9a159e80ea90a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db18ff43562c12847228cff3b0ed227f
SHA123847eae1767dabc63b312eddd7eac5316aea1d3
SHA25668f9502922dbe46342ca6044de6e6a21479eb3082e946b2f9e1f6b0e5f56fdd5
SHA512ea768c56234bd98b22b297f7c9ff799d5e9efd3100da11bdb2fa59bebe3c34f167c8d2f44a6187937bcd8f7e05950f262c2f34bac93bb2ccfc0cd7f657a9f454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0cfee89fdafc5ecd447044f2e692530
SHA1d15d8226bb3b7ab44ae3f05a3fd0c09ca9027f53
SHA2566afd1eb04ede4b9fd7f0ec4c020e1e959bb92de65e4604526cbef591b3a0e9f5
SHA512f709f5e5ae6f5434db4cac25d3fb1a447e2d2d7dc6821138d133a9641682a975f621009488d1e5caa7c87750295affc2ddfe89c39e09fd31c5c72e4ee99df4f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef3974018f08d0d625c7f2b544938be5
SHA1a56997c7a4813d0f39de5785c5e49a7f2c77b006
SHA256459cf0c1d4471a79c90599546a909d5adfae5df213ec52ef6c70344018addcd8
SHA5122e7acbc4b47dca849120ea08701643c0376ac1035b11e7f6c86b069411fe2c2be80a5b7c23a01ff85be2c5a0d7cf26e97eb6623ae0e56c87d1a7dcdbdafdb73d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5324cffad47978cce1f7557a7feb365dd
SHA17a495a268cd79044ada310e41148eea7f8340a9b
SHA2566fe51ca56b545b06ca222ccf8da0da3303c1d698ccb2b7920dd26702c3afea88
SHA512021a328a504b5520f25cc322f9211a5c7fdcc635483d36eb068d00bf09351d6ebb93063abee4cb63a1fc8ef2ef4ef5e12eb0cb7d97057b84b02e8ef31f179d3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1a366b2475fe609c13bde1c52b4be3b
SHA19337d94dfcffc5bf7a6178b0d9bd488b4aaf1f3e
SHA256db818c5f8a86465a438ba045870cca0c03b7202cefad17802fc5657f3c73a657
SHA51239bf2fe3dc52286f4c19b342924e2a4664d5ab6ecdcabb3a982f79fedc154015596fd718f34639574ed5b8b05fe3f7db13bbab45e8bf117760e77b33f3a85010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c7c0a63a69efb988795b65068d94e98
SHA1d52e93cdf774b2263745da2e0c1818ceb0af1583
SHA25602c4a0250f17253fe729ae9215bacf2815587869b542073d00d63d2e56628b91
SHA51276b3b6a3d938b547ed07b955b82393b32df6f76ed7126eec6eddaea62ced6f3acd34f8cd733a2354b51b32e684abd3674694ecb97be1bc4bad5bb25674d24ed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5261b94bf73197917fdbba98582267334
SHA19beaef3153ce64f1fc7d22f996e4e2572f7fd5f3
SHA256ebe037278583720b4c1638db47aa00f05e38098d618337b8bc4852e3f7ca7b59
SHA5128321ff915eb8b3a878e5542927bd5db49284c600e89c89a5618006e315f9f1e3b26625136c1f3acabff12dcc9a94205cd5d194aef7fec7ae3857c91680db0f71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b147a3d36fd3fcc13ff6d58cd49f866
SHA1b5be9546b08475f38ec4c63a23eeced7d7e3fb6c
SHA256351acbdae5836fc911f306f1d6792c75081130e10814cfc94d6442b3ed58af0c
SHA5124115203353ea0d1214d1d04e51567cb847ae89ce785e0b75a2fb0b030814996d12473400eba63ad3a7a1c18dc6edda4a70799674242224469ffe5707660c3794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f537def81fa0eba310293b361894166a
SHA131c68188ffca6492c3c6e6dde82a52917f502b5d
SHA25670aea17477f37c315fdbc36dd515d732b4e11c4431b2468d2ee5cb332cc9b553
SHA51266e674cbbe2d4bb13d37d32b1f26cfce9c8e4efaa33e92dbaad33626e339308ba756c318979245cb0ace27b2769b5b7fd90cd8af53fbc30714454ea874c97a8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0694f33d746f36f91325fd442529bcf
SHA1ce0d827e908c30d4f441952ec01419f7260dca63
SHA256af38f1dcb67a54c928c7876e698c80518e55de4f9afef75473de392ea6fa106c
SHA51239731c0dbebaf6901f60d8b6a0d97490b4c6a2ea8deea5f85a7fb82e9c26b337dd2da7390587afcd22ea83844a5738f46113ed4399d747edce91c54bc6a5484f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560bf9cfbf2423cb0980d5aa849380511
SHA160616375191a3120f4668918be40076c796351f2
SHA2560114f97b6095cc09100f3a12fc9a6876986eb7efcbc39df2e856b9fd4aa0d505
SHA512d22ab9c52cac5e074208f3b2c0552019bf1b8c4c0b4b58e2a1c2912e15683e7d51c5839d768c8ad306a0dcafe822f05aa077c9a085db7dc3adeb5287b84688d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522e72dfb700e0ba1eee9af657da578b8
SHA123438dada4f163d5537fc03afd89ec1c98521c6f
SHA256138cf9695b0bb70103981a70078892cebaab491c3b1a8c5dbfec2a7a080f00bd
SHA5123db72d09876de5de455ab90edc46240ffe30e71d1f2198022f7ad9978bc6d95455783637b710e9c9ed0872335a88ab59caa1f0a1bb59007621d371172e360d75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b2905b91d4b81fe6d9238a9a76483ab
SHA1b927b52d70ffac3a89f2b4ca187942218371364d
SHA25609170f714c9c6d925672d7ceddec73ddcb6122e53e4b0cb364198096d108c866
SHA5122ecbd00e459af72dcff2bcc654656c117e339919eee53d4a777de2229d00e751d1cb453f1105d7ab723cd3b96ae81237bdecdf67be2ad3167216ce5ea776cc56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562216afadc91ab816628599cc76967d0
SHA1bc0f602f3bd888cbe94fefc1f6b33c745a942449
SHA2562bd9ec1f9ab15d2c8c0a890cedb8baf89c4fdde8eb88f9366794e9af1357f9fc
SHA5123c4468b5abf2c5f34ef31f101e02b388ce0adef9d2681b5be9c4f623e8e7e0820a70c1bfc303e1b0b2dfc050d7813f81144831e492c54342041aee8adf4b6529
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06