Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
1089514c7c4c08c4d241b30301ff0189.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1089514c7c4c08c4d241b30301ff0189.html
Resource
win10v2004-20231215-en
General
-
Target
1089514c7c4c08c4d241b30301ff0189.html
-
Size
53KB
-
MD5
1089514c7c4c08c4d241b30301ff0189
-
SHA1
ffe3fb327bef199a49a05f91a09ec0dcfe9ca3da
-
SHA256
e55e2838b41662b6cb603ea8b9147337ec0e0286f22f0fef10a8ad6bbde03fd2
-
SHA512
ad0105577b81482ebb97b16508ae51562eb9c36eb10d7c98016c9f545a9dc1ec6b53e36afad1b93da65205ea9a096ae18a622f1893e769b6f1fe0b5de523b622
-
SSDEEP
1536:CkgUiIakTqGivi+PyUjrunlY6o63Nj+q5Vy0R0w2AzTICbbtob8/t9M/dNwIUTD9:CkgUiIakTqGivi+PyUjrunlY6o63Nj+u
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409678454" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1EA5D01-A336-11EE-9AB8-F6F8CE09FCD4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000e40979bbc7b31c73e4bfc674e201eda1eea560afd1b16fce2bf5e3bbb0b79215000000000e80000000020000200000009022fcf339447858d61b9d079a2a12695901a8db3f4aeb3efc623799b1c62ae620000000288f7f6914ded26d57ed5c5603e83ef3c10b1fc73e1227433403a1d321679a2b4000000075accecb5b59c89a8a8035c65bd3b104f4a8316e167daf4b29b3c132cbce9eacc8608f9d5960844c6d470c7f95bf0ce6c9dbecb2e0c4b786b6c0db83f2eb682c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10ae8b9b4337da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000275c44e58a9fbf609be0b43c6e9c476cba83c58f642f124a9daebb7115dc7b3e000000000e80000000020000200000009212a72b624dcb1a8df6a3198c31dc9d55b38e2535524009909442472625b3029000000086588a7be3f4417251875def56364acdb8476854e399a0084d4ec3d567e48fbbb138cb9cd67a71a676d1deecfc73b0a884363222a8dba37a2a3a5b5abf4496e466292844f285df6299e8f226427a71fcc5a4a0a0a96870aae27e0690fb6649509264bdce460ed6955244d90e943bd9b2d5ea61789ff5b5dd161789529e5657915a1f37076241ae85b0adc74fcd11fdc34000000099e492a02f88d4ac91acb478f71876ae3ad5731a7c4bd2452f986e4384f57bd46d4d565a226cedda58764c274c0bb93a62b19404036d59f2404c1dd51c624807 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2448 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2448 iexplore.exe 2448 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2440 2448 iexplore.exe 28 PID 2448 wrote to memory of 2440 2448 iexplore.exe 28 PID 2448 wrote to memory of 2440 2448 iexplore.exe 28 PID 2448 wrote to memory of 2440 2448 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1089514c7c4c08c4d241b30301ff0189.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52571c758e8d0f0bf8f5d67bff298f8c5
SHA103e5f32b1df3192c03c3a7bb5835bcd25a910ae4
SHA2568f1b567df7f2ef7db49c820b902aad11b432d3a0674ec4f09c41483c578fa1b1
SHA512f2d563dbc953785160f01215a9739686ddf4f410121e06064e7c4473a75eb43c2be20e24dfa7c6fb723f68c33c71424b153dbbdb67083288ad8d2503b9b5b2ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf20d1fc2a5ac43feafbbf29dbfa76f3
SHA1417d84a44a04ae808f41769453ad5c5523fd1a02
SHA256d162ea5b33d249d442af006cb3c4348d47581fd1c0042e54a61e61be27e603a8
SHA51252d0c57c6a36e4ca8e562dfec7fd4dfb90a96c8c1c1aca3c770353aa5e215d335b6ce8eabf50a2175f752cafe390a8da91d26bb029a3c0cb12bcf070e76e873e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532509733439c4f31d8e27cde2bacb262
SHA1ca0b6c52ae824308852cacc42c5209577851d48c
SHA2566d32e269e69aa51c8dd39dfd651d4d4454aa26cda05a8173feac3acbd6f7912b
SHA512edf8b2508f4cf404bc08ba1181cd6ecd3ea7162f0a71556df7f27b78bd45cd3799370e7ca4d5818e9ba6d6a29fe1967f68564db0d5a0253251aa34a4c62ead61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5656f5c8582f33f52b488e32501cbf975
SHA1c8a6cff6ace6ed7a1b7bd45602ac647b3aac29d8
SHA25667852e5c41ee1a196e103509437eb516fdc7cfaff2cc648b897ceb16eb5063ae
SHA5129125735b8d8b2502fa6305531d81954f4075757354c71cbf7290592deedc73bc93a988686371328712fd526379385ddd20f5d584a95af826f022d2c1e23f9a10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb669b2786c3a281545d5d2aec4513a1
SHA1b0d626e7eb0c86c77c392fbd95e2247f48665476
SHA25699411a4553038c201101c3f48bf5b6878518f8aaa5f48a12082f8529a7c33920
SHA512f5ced019217627c516150dac68c1bd0aced70ae648352f1f897183744c4aa77ab23b89c23669240a6f2a79bd039ebebb3760869b50b4c34a8d23e29de79db22a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580cdf5b24f1d999a3408c2ab1cf8b0fa
SHA1cc132515af7a2c3e7668229fcf7bd2e8863ddaf0
SHA25648506a8638d60232ecbb005c3613cc7b17981ae61292b1fb75add73e81f48837
SHA5122d2052b3a51ae254f77fd2a25c4a5271c0c63f188b1f7d6fdd44279d276f4fb10165b9de2cdc3363a6dcc3628c84f4fd456aa5b7536affb77a094e79006af218
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57deaf9a7ac5019f66ad594befc3b027f
SHA1cec28eef2128cc7537b7ae3133b5e39474989362
SHA256b4b84e76af418f5fab79fe46c3eb4685991d6d32adf7db363e381424afde3e20
SHA512d7724b15c8c4f8ab3b5fd3bcd5a4dcc76e48b3eb461c0c14a102e53b0bae4de3df850f62d94808fbabfb2c81020c0ba87e5c79dae8f5283f4ee369674b3b68a9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53424554be4f821fb9122bcb0389fb61e
SHA158d3067e853818d373cde2345b63b8716ecf9bf3
SHA256cedbb5ce52b6895644a012b99a22ab7f5f839722efe0e57d0a66608100e8cc5d
SHA5122a9d0aecd9b1cace7bb1bff21ef78b78e72d37785becb27fdf40c1c315f1e8222bfac656d9f19ff4ebfed12831ee7918d8df09bb3e5772656dc4b6e8ff12eebc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57961a0cb811ff163dadc6c8ea478fbfc
SHA1ad06bd07005002b02cef5fafb47b71918bdbb1d5
SHA25643cf88beca5a277bbd4783bcd8a8e167a53c35f1306be47cb4da1f801d299299
SHA512f890f53278bb0bcac370a35b7f5b0b3e6c6cfe1a6ce5e915dca1d2fc4d824ee64ac7e058c4a29c29e5afa15d27e99b6c00776647fdffd2618ebfd27aa55933a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58cf78440b00166933a970634180296e2
SHA1f8f6a23652b2c836934fe05104da872261c1a196
SHA256ead8a3e7a4110846fab741b14a0e560eeb5b4ba6264d0fb2935c51140d10d6eb
SHA51286dc5c0df633af9379197ba537ff0cc993bf5a8d1a290553de70b9642a2917d58098ce35a8fd41c1e1966fe1f8d79b607ac61034210254fb8849800dc02e1d52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57a1ac651ea38d38255c26e46147c678d
SHA126671d320109bdc7131ec0c40302c9ba7a81b20c
SHA256a9f812e4e577f35fc17d4e86bcd1b0733442a86ef9853caf10ce0534f2d25ac6
SHA5128a33a01cd04643a55252f81fdfdddef523646128de436a14023f09957997c9443d8b06ffcaf3a7ec3109b4cfbfe1ecd0be243ca91ed899ebcbaa53013123ffca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SO68H922\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06