Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
58s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 18:36
Static task
static1
Behavioral task
behavioral1
Sample
0c561b0760462c85244ff523e8c8f4eb.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c561b0760462c85244ff523e8c8f4eb.html
Resource
win10v2004-20231215-en
General
-
Target
0c561b0760462c85244ff523e8c8f4eb.html
-
Size
3.5MB
-
MD5
0c561b0760462c85244ff523e8c8f4eb
-
SHA1
64fe7d35a715a21100fd1b09e1ab6016583497ea
-
SHA256
45b1576eedaea93b60bdd94de8df3efe2ecbc454f5b016f18cbdc1e63f459a4f
-
SHA512
3b5abda8a6c5a38f415b272655e029d6b3b3dbd944023ab7a7f4b5c5dbeb54364ea22f30f0f53a9fba306a58f6d0bdfbb3d82dbb1b76e542af9fc8767d05d9a0
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NGy:jvpjte4tT6Qy
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EFBEDA1-A2FE-11EE-B092-D2016227024C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2216 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2216 iexplore.exe 2216 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2704 2216 iexplore.exe 18 PID 2216 wrote to memory of 2704 2216 iexplore.exe 18 PID 2216 wrote to memory of 2704 2216 iexplore.exe 18 PID 2216 wrote to memory of 2704 2216 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c561b0760462c85244ff523e8c8f4eb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5998d096341e6a0b37ff46ef524b2e8b4
SHA13a4368a93d76dc354e65a45d93a074a8275045be
SHA256020469af8aaaa53f197f522a7e0cf3c7ec013b9f4dfd7628d45e1c1612c119d8
SHA51259e4d4850e59f9196bb950c7623065a4ff4910e56117004add99529b0a560f3fab9f22a42c6efb57e2b4010ef10a5b4964f15c3dfed5989ce78225c34c64e79a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b850351d37ae52f8d383c3d505826a6
SHA115d1b20d3122ed723ce843feee9c1497b5fc5f34
SHA256156c20efa7973bc17d076757b25b03120bf205e8196c6844d6aac55f65da6616
SHA512516e6d366b42e55d8cd0b719084596dfa8d8d8c2ffb2e6bbdf39d4458cb0dccad93f366885f3cadf9f21a7f3d48acc7eee666456ffecc1b2b3b73f6c70616c48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5844d1088c90e01eb9a68a9b9cbe99dff
SHA1e30358dacd9b3211506cd6266e43c04e729f951e
SHA256d2112ab4ba8d64dd72572e058870cad13289869bb5a8837279d06b88ef731a6d
SHA51294ee73ef81048a54e8e8350a0923d554620e02d21260859971f78e4a4542a007c03a8c4749dc167cc86de929380c294c76abed86f2988658b8cfbffe10ba287d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a33082ca6b557ea43945cf4275947e3
SHA19963c7c65b700ee9b2491df670a4104df8366c3c
SHA2564dc9d89b40b0bf3473159553a55b80dbbacd51fc69ee61e761689e0ad07dd400
SHA512c44cbcca1b4ad89a86786c4b0a1946594b6491f704ca913435e4230ce2bc38d740d05f70fa691d703c985456a7a051a65ca9f9e5c84a14c2aab777ae93dd5b42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558f059ffb2731b1803fe4646a593fc71
SHA1f2999cab62a78b5ebbe68d1bf54cc02cd84d7481
SHA2564bfb533caf85a94de4518c32ab8b4b0118081ac0a814d2dfeb5c43ae1043feef
SHA5125329ccbe01cefac4c6e121c4c664baf49bb117a7cefa571f3c1b365458a763603d28f00726f96393dc8e879b2ec1b0427375492efe8b9fadad4793046c927ef3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58466a3bd9bd372b933c51d2fc2f55727
SHA1d10e3ee6cfcf84f6190872ed1d5ac0db1a93a91f
SHA256fcc7679208f57ca92bd02ccdb9daafd7758ef4d6ef6c9bf4fee1c8d5aadd752c
SHA512e91772bca8a873d21aafd7811eedcf689525b86e8eac4e9bca0351a8daa20a8e64a117d7fba679d58ac7100c08a95c18efc97c32b43e5369b4d3970cf936f67b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582e3f885c4f9d04f475e42dfc2c128ab
SHA15c9c2d8641c6cb9a5926dbd7fc1803395c1baf52
SHA2568a2d75c170f68af41440fb6b6518668881cc9d959af01f33857ff0b280bc0bad
SHA512605e1e86cb4ab923ba699033e11e28a6528234ed16879d4dc5d0cbcf83944e847dff01f92c9df022080f79a953bf26f96d6e577046e7a7e7528230ef1191d9ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec657d1d5de74f8cdce1ded8ff2808b3
SHA1facc05f43f5f63b7d5273272be46275d36b21988
SHA256ae6ab0d5ba5788ce9ac7f7f2fb0ebd273cfffaa31123a207bda1f9699f5dab0e
SHA512a752b037feb5e35121a7c8ab94dde7670489ee70f98f971cd72699b9723bcbfbe2440ee0dca01357b2f7c997e5139f03cc875a4f60ba5b5540efbfadd9f35e35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558931c03cd293c95e8eb397ff33b2b74
SHA178086bbccaaaed91efe9968ff40b3fc2184dcec0
SHA2560db3acf0d23fa4ac3159ec7eb1c1e5b100c6b67d87104ea5a3cb49e23be549f9
SHA5128796a469ba7d5ddd743b5050d8e84ba1a3b212f4bafd8cc287d2c07e0bbc9f98e6625583afb645b65fb2f55c7387e8779cae6f1208c4b15d604d3e2ac0d9547c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f61420e93dfd2e3027d452cef5abd609
SHA12c8201a743f13d97f3c1cd8a7de22e1f925b2a0e
SHA25618dcb2410997680b7f792d9c71468b1be0ae25b9372c50cfb92f351254f9c7e4
SHA512721ea01ddd6f6d9c8ac387e2666b75b5416df17d03551da3b6a4650f0005a0620ec56b94e72c6410c77a6c169ec95a3a94495f21a520befba9d1c4f90fc50eca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec1e7b65e8225790117a4873a2ea1491
SHA10a72a9dd2217a5ed9f4701990e8cbcdca5b5be75
SHA256203c96a9a080d21148a620a05290e515b62281c688daa76b9da7417511322b4c
SHA51249ab0cdcc17afaf990188bd71f53e4546ff6d94f5c29419ed081f65dea90976f0b86d1949825c54dc4015ce4deadb35fe61af01f1fc322387e1e9de5341ec83c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51950e3663189d2f98b3a66b3a0476dd2
SHA1e46fe6f2a7842b4c8471e916f3467c52577e0306
SHA256ee5f0cdf876b8293b00ac72155c03d45a9ec011a2d9d931f0005c7646726cbdf
SHA512f75fca790aaddc188b3cb9a5f49ad2a4d40c7644b7897101da038c41e8a7c45c70aea911e746893836d73fad4ad4cb6d34ece8d723d2b29deb6725fbb171c246
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ae33c72d0f864600941506bcc76c0a1
SHA1a73dffe7bc2dc5cd763f41e842afeb02cbe06460
SHA25622ade7de0808d17a68f9cdd61c28855083e8a22dab7677437bf8f2ca68854d40
SHA512b51f42b43b4e630d91cf8cc1e397d0b568f3356ba8a4ad419169cc7c986b4abdbe79b8e579151d7b8bd48e2bbb888bb156e0cfc562b97df330a2e251f9c3619c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f630f824997ba6412bae34fbd164fbb
SHA164d4b75e73809d3b4ef77ef86fe61392104de1be
SHA2565be2dd59ad76472ff498a4007da848d9cb6f7899da548566ae9eb05cfc4bc224
SHA512675d847304dfb6c22de65c9b129ef2f3ef04f57b5762e08b89d370122d9abebd6f714ba03230ef9b6bd678f2b510e6dbf8e33abe53ee6f11dfd8c2ca38b9d4ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd8ce088a98d2c581690d1f37fc737a2
SHA1ecb396d32a9074434663c8c346061e77d38bcc00
SHA25689a89ab1081b62b988a5cc48fa8b671894b31cfd6679fc454dd548f0b5e3787b
SHA512adb9e415769e14a1ed6cf8f12f1306c724d327469e8c4df639cd12a541a01c9f8095caef3330b617b95fd40c5c31d6ae202a5fa4089c7905368ef65b9e664780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5898b424c82f6a02166476f65ecbc3b98
SHA1aba5a6a1e942a00abd6c0f6410b054e57d68a70a
SHA25655f8fdfde9b1e90d7abdd7ad1672733801eede740a24f710f49cc8b2bafa7fca
SHA512789fde1b541d394f050e9fd0bb8619c62c12faa94bd16c91adf916db08efe66c75b5d617327e19a6f59510c2b575f754a8d675a004e96a2cd32c355dbaddef2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f52ea2adac73ce71dc973cf5886d47b6
SHA1760c83557e0647d4e91cf88664e255ac4bb6dc2b
SHA2564769bb66b6c8899190f0c768ce1230a7e10204c7af0df9a942f25be825db025a
SHA512495c11abeb8556a6c3033b5d9ba5e6ccb3c0acf2d8ad6f69ffdbdaf9c602b40945cd3647fa2b6c53b1fb4541892d23c4981b0f09109e56ca767b8fa406fc395e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e46d7699e1fc6b42b760ab71bda1d207
SHA160c3962e04957fd3d66a6eb4c29fdbebaaa4203b
SHA25663c05636f33e1c17c50287e7fde7df7ae4f33b14b4c98d65ef2ebf9ccd7cd025
SHA512a4804f46678379e6df14c51a6231df11b25331e12e40ea5ee74566261716902caef143eb8a3fe76d0301994e32c938e2b22f78946c8d171fc9dc8edd05da1490
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7572bee342a96a50e4caff767d82779
SHA12b41df3b1cfc1ea9defc6b688f9cc3fa2c989f8e
SHA256d1dbbd617e824fea42409a880d0df7373c44ce8d21216d235fd192c0c7c9e262
SHA512ff90cdc7cef4248d884be087ca920a42a23c8e55b37a3525a018014c6a7cbd1b67cdd6d249b874be86ccb4d6440542bdedc8238fb88c67923adbad0a8bda68d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a44b8b66244ad4827b2eaaaf84f108f7
SHA1fe4b025f8a5f8f22f88872edd597da4703422439
SHA2561b669192a0cdf18bd702b5c7241eaa692215487bbc4989da2ab4dc0b62fab7d4
SHA5126a7cd8768410b55acd5bc85c90c0b39af8d68e0e4da14ce867546e7fd3af951aa9ca7cfce73e937a6ff2734e6eb7cf5c4ba00fd91af544736db38adb20a39349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c1502a5eca7331cc045c585be790bdd
SHA11cf381763f4e4c81c9161752648bead67f068194
SHA256227fe5691aa3d9ddcb36af9aee1c55604d0f2a3d256f7919925dd2922f3abe12
SHA51280dc5fedc0573d150cc10c536feb420e275130cd4ac0d565cd72a04b92846a42dcf44be309b534b340c7a49e9f5520b517c5d2728468e6f659843ba59c5828b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580bd7c39a577582e24cac629c676c123
SHA1639b66200a33f6e51547528f698eaa13a64bbc58
SHA256081410a1c12273aaddd8899ec99dcfa353140cb17f585621aee65336409804e0
SHA51207ae99d7836fe0c96507e3c7689d1f1dcc762b496d3f58909f10a7523345d31a3189c3502d1b7eb8cd8a17c4a9bacb4a004a046a4af7bf88a15a64e32cadb7a0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UOO61SKS\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
129KB
MD5d224a3af87e8df968db601349d122a1e
SHA1b0d788b9d372cb4ddc7833fac732e9d7d441b083
SHA25672243409adb0318e082a194672bcfc31382a2225c2cd0053fd93b81b96d292d4
SHA5125d072dda607f1f1656c3cb456cb21d449bc2a41d4cd0cd179cbc621f8e450a06424563288b4ef438fa91b3ab5728715d2789f707b8a6adbee138f8c9471d00c7