Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 00:34
Static task
static1
Behavioral task
behavioral1
Sample
1d4302915b25a8058eab7fe449cd07ab.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1d4302915b25a8058eab7fe449cd07ab.html
Resource
win10v2004-20231222-en
General
-
Target
1d4302915b25a8058eab7fe449cd07ab.html
-
Size
3.5MB
-
MD5
1d4302915b25a8058eab7fe449cd07ab
-
SHA1
e27610cb94cecdb39e8c9008907e38ded8e52e26
-
SHA256
4dee05cbdd830e96a96ab5461e96fa8895a64b57d1a880ced3c0db21bb5abd12
-
SHA512
ce0e388b63d97a73b83c286d5c614b924d26740f901e9ac050d445f0a0d67f9ef5e774d4064cff02f80c103aeb8a45115a3f09822d1750e9c5f298b800ecea58
-
SSDEEP
12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nfo:ovpjte4tT6No
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{376374F1-A3D0-11EE-8EEA-EE2F313809B4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2960 iexplore.exe 2960 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 2800 2960 iexplore.exe 14 PID 2960 wrote to memory of 2800 2960 iexplore.exe 14 PID 2960 wrote to memory of 2800 2960 iexplore.exe 14 PID 2960 wrote to memory of 2800 2960 iexplore.exe 14
Processes
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:21⤵PID:2800
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d4302915b25a8058eab7fe449cd07ab.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
6KB
MD5798a2c1258cddc3e4545a8ab7135a367
SHA11957cedd22783ca4f5a9b4597b40fae2fec7e884
SHA25669b061e237592784cff4805ec64533752781aea3ef45e84aabb7c3fa2f60aa9b
SHA5127765ff92708bb0f0ef5825a356127197ed286525ad81e23bffd3f5bc25c64f79587d731e67aa61b343c62dbe1bf8a8003b1d38eb932ed851da7e1fdf89549e2a
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
Filesize
1KB
MD500dfcede93e66b869f9983f1dad60261
SHA1e5d6162dd717e0b8b1b8390e5ece02c9cd7ac02b
SHA256fb7f68aa89364143d5d56d8dd0b6f47c84f7b8337ff89b7644dcb4ffdea928cf
SHA5128dbd41420290ce018a9f1359b6ead95b1408489ddddcf94c5b5f6fb2fcb81f52a7d1457e900c10efb7b92af5fcc06b6cae308444b79dee1421ddc4a890884f94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5450e2d4d1dcfb0ec3a169ccbe14a8452
SHA1b1d7144478774025f81fa802b2968500f4c2d49c
SHA256ed1c7430f7776426f1bf69ae023073daa67e07d7f47aee43f1f66826af913f54
SHA512a8b32480fb95242b8e2d2d1f621a5c4be00538a1740c22e4c52eb488ac78e98cc147b6b14a20c00028ea5860f923a934b4ce020d01401fd757f558570c1c472b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561145ac79f317f6f1dc64b829ac2f6f2
SHA1d715b5c913b460a0dd35a8db6d684c876913510f
SHA25625244a25a5637c4b64cd2def0f56f412b18ba533e6d775155486bb421c161564
SHA512a7f43b8eef8e349d3fa8f721bc7e324df4485f11bdd289d7459fb7e37966ae4ab1f94be13765d8a5f9cadb635e09e4eee7b9a74787c5623dca329b3c5c9047e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fee35a08659d04a028b3caf461c80152
SHA1e2bdab1e0778a8ffe054697bb3bd4e09845a812a
SHA256aceaae3c10e0ca8235a338fb1aa8e9c9806b3150babc16ee9b7fb1f98d33acb1
SHA512a427162ce42f9fce46780cfcf5902f9af633525fc38095abad5484bf5511fa16fe90241942f0015a96e366b8bb915559c887cfa7468f8d140617c63771fc3d9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587f95b04d815e1bad2c1b5105e52eeb9
SHA18656aaad7655be0cfeecc0a53288fbb5fe0bf203
SHA256ed7e4d1f311a4a1cb0142dc190ac89c9f71df6ed931b4dea5d84b9a5b9ce3be4
SHA51257eeacd194be71f45540cb314253b3ad26bd48dd6f5f7c7751e6c30ba3a75acf0a996c6cba1888c107433b12550ec53305c8682bf1ddfee5e13091dff6000990
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3e8e95ce9a624daa2e10522c5fef4f5
SHA1f06fbe2c22ec0dd9fb68fe982dc955688872a442
SHA2567e429c706dc0920e48903d8a548f841adf9e1051f8c297f4b389f19d081ae382
SHA5129b13d3b24b509a1f4c49f2820c00b0dda50ecad116b9e5dc3b2ba5606da038068dc5e4f6caffb616f9288a74d4aa09b9fc4fb2a2cf859917e52773a403989ba1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fab95082b5e14972bb196a33ced11869
SHA1d6d0b8d5fe5fd43c2f93ef93544d99656c89b567
SHA25666dc093bf86450e55e46089eec2eaaaab1ff65f5b403002ef01cff8ba234a963
SHA512461c12dc6750f209440ba918c6e47617dbc1ee2c54ba35f70d3e5ce62223b9e8f010a8e1e62bd8997408ae1441cd40517a52060d882d7476ad98703b92f87fc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fe030127dd4945babe72b286b6dc18d
SHA186883a567f57d7487a119d187f69ca04fb9663ca
SHA2560f9f875d290975ca06beb348fde528a58d1ddef905cedc357a8d142715497394
SHA512ae35c251afa436a766e9075e2e151cc070181aa181eade8e36291d5459e5e24c13bd790c9fe9cfe4f032b137cab6207506c49e81e733e83562302718dd921df9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527840f08b65c72f36012e7c64fd3bbb6
SHA1e096f3aaf1654b0b45a5f348b8fa2e1ab6ae9fcd
SHA256a14bcaecf86748e6e650516dde46af2085ec815fa6f7a9eb0f44f5e49975dfc1
SHA512f769dd3808f0022b6223647f582dd3c49112e0777500ef0c43d2dd389c92aa0fcb6da488d4e20e9164dfbbc2f7fbaf275c725398d75fab6772372e9f0f81e6ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1a7505cb4e5e212e9713c92a016b6ea
SHA1bf5a7eb59734f15e4f0d5df6ff28dec8a599ed16
SHA256781a585d00d42667230a07f6d45b5b4b3c560274da207d11d21459ab91910411
SHA512f4a935885dcc5ba88c8bdc28e1989a0fc374ce70d3d66486fa5606f9b877e5413d31ef8a076bdef04775f06831eb31807631b596521d8b5dc26583d3486c4590
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55bf444dde56d0994132d2a9a03af3952
SHA19e4f7bfe8bb64354cfbc71cb159f60612d8341d3
SHA256d7286e8adebb0792a5e3dcca904b88d46076ac003509ebafcc645581b745d08c
SHA512f55e215483af87021fcbe5f08122f4c733ab625df5113744bdd1e567d75548c0810067b756cd0da1078fb3f21bbf67beeebf795da64b00b4757b79c64cac2fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd7e88f1231fd73e80bacbf0995a499e
SHA1d4e32e7a9829155963f760b2c0363eec59c9bde7
SHA256cf63e6b8031f8479c6e93a4f3843748ef21112054815189b60cc793acb21049c
SHA51266722395ed08fb877e843ea8c581485be82d3e681c3ca129f42a2799d1255ae40d03b31eb9867686c2382b31d59bd47a4faf6a93e5faa37fe9bdbf4965473d9f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58da8bdaa13bb7647a85bc05e8ebfd136
SHA11a82688d4d17b5b4e12af61fd5523ffd3d221784
SHA2561949cd8161b258bfb0cf403b22a5608439cf9ddd32316969a870be1f770d29ab
SHA5122435901fe87fbb12df2f7bbe5762f437a07fffb57ef71ffb9bb886ca118d414d2ff51acb76b1c5abd0445b5e625e9c429d2fa88464a210f750117f4f36ac8f93
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adce6f2e15f4d6a7c8cfc6b2da11d84d
SHA10cdaa83103e839a73e4535099a8870a34e5c2e2c
SHA256d42c3276b17dbbafc73a6c1a8b1e0165a5dd80a5c2f3563ae8d5d6b3e187d60a
SHA512471bfb8dbda45553300abd9adcb42a53c2f555c5f21d6f79297c0a0f5306bdaa699d9c72e1ae872e23207e7b2570b533f04d8bf06184d15472e43a52f25a621b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525730650bc4b38b0186d3428bb926449
SHA1a7d3373ef03aa5c61613a9748cd247f6450acb12
SHA256d777b4c2598a61df1a7928012b98a9e78da99f38ae89920198ae08d15da20752
SHA51236b00f8f79c8f7f0ba154c26f85b5e50ea920277f7aa991d40ec6de2a15c12dc2f1be903dfd4f1e9c87b9ebff47035765dca47edd5f3d8d388d428477add7320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea9091969c0af1c37ac33788a4a4f83c
SHA1c45d9a76f04c730455f6a1b2bbbdaf5ccc1cc44e
SHA2561adc8f818647f5782baa01f31e7d791d202ea1b986dfe263d476a83c60a29424
SHA51213533ba432e5becaaedf927628171aaa34b1ff1b5ec47181a7535bc7394fdf043670d63f6b47d1b424f50aad2f1b13066b2ae6070da7d643754c2256f3f07688
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e36f701c26440379edd46f5a55ff1a4c
SHA1dc7e0580390dc99a320d618386e2a56f878b4fac
SHA25631e342f4adba8228f94f91640b677f6898a8a0643d6ad63b3047b4d311faf5e8
SHA5125aa1b9c435beef8601034725d2615835ae2b82294c1f8408390977c13854edad70e82829109727b2b0d85505a2fbb8905a615ea04c6da9af6fca36343d090870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506c361cef228a1856c7cc46eb00adcd8
SHA1d01cfaad2a3385698354b33b053eec6bf77800be
SHA256951eb7fa8d474ab4319703682d6c6b0acda9f3c28627d35c4ceb2e0944f58d0d
SHA512330b6e70ea301fc18491aa88ef12c06a2407137396dc68efa644ecde71693c09f980d9ba615800c9666cd36b607bc2c485a6c5669fe9da3e5f4b88b789d4c8d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5977404ad568d301dde06bb2f7398e184
SHA15ed7e0a0f7408a5e56f7f590c53ed0bb8bf7d9df
SHA256344c78e989cf64c401d771842eade26374b4444b611181fe32d882742e4d2418
SHA512de0cd062d93cc0d5a7768eee1d218aeb4b4309c4c945dbe34874851bf97d0c8b2b47d9819b3b020fb9b45c075f77bbd404f618fdbd5c68331be1b0e7025a11e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5a36cbcaeee59d2b75eff1c2dc68f36a8
SHA117264ddefefad825b811299ca4b3cbdd4e1016ae
SHA256d75390e5de30037ccab135a282067c4e71dc43b1f3d470da29d0e7247b3572ef
SHA512d355f493d119adab24fd2aec51bc51766ff13c81f2b5654ec3de16989e4a0e7c1524f008ceeb6d074e592cb36c564d8028cb181d5c074368c00a740f5669c8c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NOKF7ZN4\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NOKF7ZN4\jquery.min[1].js
Filesize39KB
MD5888de80be0e7eb91c919ba0a23e3bc04
SHA1875f859b46118e4a2b138b23a497f9f961b18716
SHA256c4e27926c669767b4702d96d3db0f04426f350c409580ff247d185c6ee4bfeb8
SHA512b5b674b4c4dffcb54030eb56a6fcfddab42fcfd17f360f946ae545d38c7545037ef9fe4989f5343833167e1c0f352aca191e79bf8608585fd030738ab9e8a404
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XMX28T7N\jquery-3.1.1.min[1].js
Filesize50KB
MD5ad24a598a6943f5e5f4da2d9abf2197c
SHA170db44e17d460032ce9a5db135940d68777fb82a
SHA256b5b0c1127f155f17f56ff0b27a7fe32a91699f2723b50c7ed663e5f4fd07f4c9
SHA5127613cd1c041f785daae39cda5b2d8fdda0746cbcf946401317bcf284cb7e68280785bd1f04b97ebbd02375d7e0d1d3b5cf978b8c192ba6f4b822a2b6c8dd5bc9
-
Filesize
102KB
MD55e0cd56d96c2556af31ac0d2c5513c97
SHA126628f3c6cc3208e3f1bd95b11c7b80d3cdf0bbb
SHA2566dd1ed10b21b450a6333d6d86d1954f868616c7f92484b4450ddb77a553dc5bc
SHA512686f432f150f25b1a0b6055ab290be6aa8e8ede2aa82ef7a3053fd437e21a5646f0755d873cd6a603ce75a963e7670110afc388d7e1bff34097941bde0fdd2e8