Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
3dc4aaf4013c8085e74a2cbd43bd3293.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3dc4aaf4013c8085e74a2cbd43bd3293.html
Resource
win10v2004-20231215-en
General
-
Target
3dc4aaf4013c8085e74a2cbd43bd3293.html
-
Size
3.5MB
-
MD5
3dc4aaf4013c8085e74a2cbd43bd3293
-
SHA1
ead6db5f8ea3dab03a848f5498791ea1844e7f41
-
SHA256
388377a372e8f0064530ed3f4f1fb4fca1596cb7cf237cdfed1a3fc99f6c813a
-
SHA512
b1136b9425f8f516a4c4fe8b16e17c9975c2f2493b57944906750cc50ca0d44fb6762f3b5ee771ebd058acffbd66e809f4e11c46f21c2d3047496ce3d0f1303c
-
SSDEEP
12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfp:ovpjte4tT6Np
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{840CEA71-A655-11EE-B55C-66F723737CE2} = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2116 iexplore.exe 2116 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2116 wrote to memory of 2196 2116 iexplore.exe 17 PID 2116 wrote to memory of 2196 2116 iexplore.exe 17 PID 2116 wrote to memory of 2196 2116 iexplore.exe 17 PID 2116 wrote to memory of 2196 2116 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3dc4aaf4013c8085e74a2cbd43bd3293.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2116 CREDAT:275457 /prefetch:22⤵PID:2196
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
31KB
MD5f9cf432cf115ce64da444972fb1e0a31
SHA10ae9f0c37a5932c69bb4f29aa5bbe6763e24557a
SHA2566018b982deab4fa855f933d1dec58332cfedfa28d3bd9300ac197a782f812c81
SHA512d6d005d2eeb68c3626f5c9263ec34f46f64fd37e4869526f60e0287f363eef60746a34cd092ae2ec9620f674a47d11c942b6127c38f4e19aebe3c6ec915816ab
-
Filesize
17KB
MD55d6c92df3cf7334c515531beaf8f0bd9
SHA10f7fef5113c0902b2856788cc300cbbe647dbbb5
SHA2561c17ba891d6ea16dc67a2119f8fd2ca0cddf3b54a086b5edb259514f729c9de3
SHA51296ef490e84f7be3fd4ef9fb78d8ceec57a418d07e016e5156bd111807e5f8475882f4a326931cb9698d89c5e4fd83f7227396a6fa5a2b3feccfbe3f8e11ee7d7
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5e00af24b4117e1148a090d13f35566ff
SHA173f07f9275cd4d87d1916a939b91614e1ded91df
SHA25691e35936d4785157c26d229302ee59d306891879be51335347e78571477d206f
SHA5121ec65449d79de625a473f0e199b1f28a20fb200c9c43ab1652298f740748610b9bb96c7040cc7f5b36d3612af6de5485653bb0062a63d2e7fdfe76db88cbc538
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fab20bc0a5feca3681d05e11fe423c09
SHA12eef73a5757f6a46827b039fcbe0d5208b12aaa6
SHA2562b2337133602906af85fbe9da26b59e5b9cff12b6e39f9973b31b21d0168d25c
SHA512417d17bbca8646703daa4df959ac5178b58103e718f573f5aaeb3e80dc855d2cd7898d4d18937fb01eb165104bfcd7a5c14418181b18af8caae1b7f660ad0c85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500ced07c4c64d70c003bfb947e10c352
SHA1a2a95f23a3a29bec9d3f64c3207dea4002b1bdd2
SHA25651b5a628e957ee1cec6596a6b401882b19c8d0303ebf089c4a8bc5e4b2dabedd
SHA51282cbabef359e6b561b361e16132f5bf10dbc14c9315e40664ef52613d0eefc38d6332a9beca05eef324764ee94483cc7a6274c63041dbd82b2f5a9c0c742bd16
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddd0dcea194e71c409ca5afbea6402c3
SHA1cfa8b275530627dee8a8ddee0d28d2a3a692458b
SHA2563733b02c806c4edc5709715adccd6ba1fcccd68a0fbaef5beb038f567ad7a591
SHA5124c26e32073132543750602799263bb7b678a2184ff6237d0fa8b5ad262f336ff0ef75f2b03e87542b7feee26f821218e3e6ac180777b9d2a4aab2f70fbdc2ced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9c68ab6cf4a8083698bb1ba3de1266e
SHA18326a52cb1b144eef0bb2506cc2c245185d7cbcb
SHA256aa6db610f4fb7c14118c9b2b55e14e3d40bab6bf8e8f918175a194bdfe86e4e6
SHA5127414bd84d1a3680a4c17d168bf27c54a03bcb4330be9415c5e7dfbefe34ccf4c61cbbe828327505956af0fe04f6eb796dc6345a6bbda0a6935ea7b8788b3a126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571af8dd250f311f573a57ca401bfc42d
SHA15fae89e438a8e0caaacb00ebfae8b086651d9fd1
SHA256ac22a62818f1a5b0c5579829a6165f85a506ff0674ed87d699ae750fa9ee2360
SHA5124847dd4a3ef24ca73e5f37717917e01bba6a108a757b15d9ca51b06452b5955b61a1e5cf709f4b7281eb32d672d5e99b19e9881414eae7b190187118fc83bf6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561d544942d4cebfed7884c5fcd56bcb2
SHA1de1107b4a66d95f439de8001f15d6ae110f90501
SHA25687a85279c80a0d80dc771d29138f775945e30f982b557bd8a6414fba488464d8
SHA5120d222a92319c9969e8bd0e2c9fdeebb2f45daa454f26143e6d0fc898c23547d718152c6c1e528ef9e21318e7644fc3b1b575ed6c41ebfcf4cd901710aed29b61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bedccf1cfde245e3b7524d1a61a608a1
SHA173708096ae7b21876293bd2030ff53fe3b84aa05
SHA2567574aeda23ba92aa130b3110b4502ea2d63b910b26ec8e04b25e9a84b936dc28
SHA5128e1980b3dbb1d77b98872cb7b607b7d9d741125a43c286103c903266fcb5fc44b047f8c476112469496c1eed153e69f90f043ca6585f2e0d9c875cf189fb1692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6a2d1a131de671ab70e39d6fa91e87e
SHA1e36fc2d3198d0b352ea274df0ce1ee4b69e9190e
SHA256c11eea7fc458a0f9b00e7748efbb4fd2e899a495d74e497cbee9609ebf7a23be
SHA5123ca806c729ac6f9e3de60bae3b91e23e266c6b6066bcd5c157fdf0f12a80279aeaf74986cc04442522b55f98c80323db5a3d53b329597d391d0f0fabaef81937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c9cfe79bab0cdcf239f6b1bedf44c4b
SHA1cf3fac29d9703da34a2738009ca7a996a67c53d7
SHA256663c3476c7591848c2e73c28da649774fe72cbb7b728c2d53cf1c8c43ea9966b
SHA51243575ae7a4b712b2e6dc45cbe39b4f1fe3123a7d13b67357886357db93bdb1fdfc3b93fa825e0887e73863d56abfe312bef5cf3ab16f237e48bf110dafe52176
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e2409d81b3dcec2c1ec6a79aaf8c417
SHA11c7744cce31c4795e7b73b11a8fdfbfd95ed6adc
SHA2563d358cc115fcb99bc8c81105f4fd6c97e74b0c00cc4095de9fb6a7de8bed73c8
SHA512b51643e37a3170059cf8c2454f7f1b893e9aee18349b8dc07a05d96c7c87b7868e43a5e0e63d2acc3d4161fad5551d2c8b959b4f6438d8782b32c428c89a41c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5450e81846d13068e1710ce49db7179fb
SHA1fe783e3b9ef51ed026ba2a9ab5156327adcda413
SHA256694a59724f4331cddae98564f5712991d6dc30d37b334d34e4707c829c35cdac
SHA512473e2fd3c0dcc6665e4abeaa78c80dbcd2628f6cfe254d26db205593f1e35ceacb620add0041deed1efbf2bd0d54fea96bca1207f59bcd1f77c1baec5bcc584b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580883306d5cd6db13ff3429c8b280a12
SHA101fa828a0d00eac921171389003f0c62d9c97dae
SHA2565bbb82fc5813b9a0d92743bfd90d9683e7d3874584d566c1fc5546db11d3ae5a
SHA512cf77b8672780c44f965806906730e0e6229e2b660be292f5f616cf1ea646e7d065d159426e68e3e9a737ad2f0668626ec3467c8477883e76156aa8029de24aab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fdebfa455a4162ed5c98f3b6effd882a
SHA194e312693285b9013985d5402419c63f4d067af1
SHA2560bdc65cbbd918a5fcd3e4a82d9deadefdb8958c834a64588e9fb181852a46d11
SHA512a5652ba52be0089b557e48e2c7dd1b057f204d1d00767ad075e0965ec3aa7cf52156d558678644264b5fe69fb5dec1a3502f24308b91a120fbb3c1e74b3612aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501a8f8f1bd9e032cae5fe2974f94b9b6
SHA194ccd186d6c8a6c88a37cd76b1e081be673c7d5f
SHA256ed9a38edaf6e7aedb812ed9883b06ee9b263cf6b0759139b588bfbce9c7f663e
SHA512a48e6d8b9e10afdce50b1b5f0f773dd6ab1da40680719c7afbf5a107d5c80f58e5c94154a47bbf84c8c6040b9799b672cc8938cd58039a5d689f4051a7cf3737
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fdf4c5f6e339d48a1b2470627be300f
SHA168e7c6f42fc0bd4bff65fae97ab879ed9399b373
SHA2567d8f22694e7793b195b6556698d071cbc34d68c64402f1bba7662dbe9b9c552d
SHA512dfc8fd3ea36db4652886c44d0bbd2415bcd88886f177faea7dfa6370ccafd27f6169c26636809c3c73dfabc01a1602ed0890246c34686fe74e4ef5f9884e047d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ddfc3b138471c75dedecabc49f68b67
SHA1931967158ebf01f5d4a7bfd35c35226dde7777b4
SHA2566ff86c580cdcb99f38787d376445931ffdba83d1b2f8de600353e1bed4d0326d
SHA51254d601a21a8ed39d8ece9bc05158e0df6f627c5937c087016e0fbda07a2bd300fee12f0801f2f568cd02816e1adf83e0fd1ceac89e64ddfa093587b2770ae31f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d7b8e88da445f355b407a5fa7950fe8
SHA1330624ed0ad53da2f363bcf894a9913afd9dd534
SHA2568e51e1ba9ff1f3f73d6495d2927f4053e5c7ae87d27a3833a72a76131c82ba52
SHA512e3331aa46d83ee3986bca37c166d90edc153c73bb668415f73e236fdbac493d371bb3944a2c204c98565f09640c0afdef6693743e6f8679e45e73e870a5514f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5324b0c2e1f3385c94f5aa40e4dd5c5f3
SHA159605f0390d929ecc2a47e9bee9d0e3da3259243
SHA25645deb61ac19a2072f0fa365fe9d54a9cbae6cfea8d6a0e792307aa226eb4df71
SHA51203436c641aaba634a14d9851d5d34dc8f8f4d8d8bb9f5daafb01c3fb09b6d769f0515197f8c77b3014c29947a1d9dbd48f75ab5a9ff342ef4feb7ec0dd8957e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize1KB
MD5570a07be5e618681fa654bdcd77f860a
SHA126dc12803d15723f3b10ba79a6c9dbe6328b0a53
SHA256e5e7b7600b178514a7d8da23187b04b9ce56bab481649c7ee7ee89822d7d0994
SHA5126f11f50e443e95a763a8e610c77d33d034963d4a70c76e8c90846c736f2d04ee77d48f71f9d06564382aea902f5d6f74af6dc6bc9a0f9ebeb9594ce7c7101e5f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IQ58SQX1\jquery.min[1].js
Filesize1KB
MD5edb1817a52ae1440612e77a918d5c69f
SHA1e57767b570f4d80546a978b2340e48d05f242481
SHA256b1a7624538f9aecafbb205e68de5fa36cddfb8c7421eb8f2bb603daebdfa7490
SHA51286c9eb6e72b46f0de245612bfcf7c6c6d0b60cb53a50e8bc59c4393665a0f57f4e72f7fbcc66057d5a6ce24f9e0e804b56ab334a06d58f150e09d56ef6901f12
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RHD500AQ\beacon.min[1].js
Filesize1KB
MD534fcbf783a28492029355b3b9d531d9a
SHA1248d8cc67cbbeb125879c138431b29512430879e
SHA256024e0725a419096f7405879e795f8bdf64c0c243044d3ae6ebdccd08b0df688e
SHA51259f613886e4a16f6c80ac0a7930892d296a16b4191343dee9e66632ac12f73d8355e6244101f2e1149be946d7d8979c9b48ca04edb163d4a40028fa3d9d0fa9c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UPFVLWY7\jquery-3.1.1.min[1].js
Filesize1KB
MD57c62ecfd5401ab16c0267dfc4ec0c20e
SHA10b6178fdc794500f8f92a282cdef59ce18fc50bc
SHA25667e0c54b1a0e769aa3b99a373d00206b7596623535d6405d7352776081574e00
SHA512c5b76c2c6483895743018da598e8673ca7c3954704e57c1ce2f2a75ff100902239a297bc13d49d3135e22535441aa7b4161472b81cb1aa263eb45ee782fc0f49
-
Filesize
22KB
MD552346416905d72db7830b704ebfacfc8
SHA1b3f3be470742bd356be64db95ef0712dbf7cd50f
SHA2564ad1d6edb8179c03c1981cf73173b20fbeea64484e2bf03120e7bbfc343de0b0
SHA512b59781f6a0353be7152eb32944147cede7105ce264a5c87150cb03392835c993cc83f0ac7b4f710dff494752b56bfca0531c70dd20da7146e4eb7d237f4b370c