Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
1e92aa3efc0b842e285d1ec903cbcb0c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1e92aa3efc0b842e285d1ec903cbcb0c.html
Resource
win10v2004-20231215-en
General
-
Target
1e92aa3efc0b842e285d1ec903cbcb0c.html
-
Size
17KB
-
MD5
1e92aa3efc0b842e285d1ec903cbcb0c
-
SHA1
3cb800ded77f0a484be4cdf60bdb39b3255aef03
-
SHA256
e49ca22128b00577742c2ce39de287a17ea31585263f1ffcfadfff44800091c3
-
SHA512
974ed52fcaf2b01903aefb8f42ee302e4b11b98f17570fe14a02b024e5aa34f8f02001fb46629cb3c0125dc11432833b17b5a048e32d911c76e2855c4345fcf0
-
SSDEEP
192:MoglIsrs12wtO4TaGTHEDKcUVELfQ6dc3rVw8k/w1wvqLkw1LB9euBuLbdU8d:vglIc2PtO4TaGTHcLfQe5/gRLB9eguLZ
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{945E6961-A3DC-11EE-BF7B-F2B23B8A8DD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409749697" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2512 iexplore.exe 2512 iexplore.exe 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE 2720 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 2720 2512 iexplore.exe 28 PID 2512 wrote to memory of 2720 2512 iexplore.exe 28 PID 2512 wrote to memory of 2720 2512 iexplore.exe 28 PID 2512 wrote to memory of 2720 2512 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1e92aa3efc0b842e285d1ec903cbcb0c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da114084d799d794a304d79087cf1953
SHA1de5e73d6b1aa746a42c34dad49f00c9a6718f708
SHA2564b0f67f9fa7894e648360da654477bc1e6d363d1c69f4d9795ed89b00cf1e3eb
SHA512af6945045fd42e7a99ba5d9a6b0936c65df10d30ebfae5f37db62bc913cda6dc57cffa4ba5287cf9deb61fe851216817a3faca7549f3a0895ec8e8eb4ea40f97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5504a5ee9ac1162e2eb049993d80cbd74
SHA12fd25970de846b5fbc7c5de95d1bdb50bc0617fe
SHA256e06dc76dada093cd6df6f789c71ef435ae65abb1802693679e33478ec04adeea
SHA512b1dae8a9460b5e4e5046e67281f2ad8cb2d4abb88424df11849d36d09c988da71eeb65a2070d994378bf810e3406326ba568a4f4e75b078796a84d43cad2a6e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56febc9d8d8d86a516c77c9f0c220f33c
SHA1908b9dd80d951704ad126869b0cb86b62d9de75e
SHA256cddbc97394587b3ed4f9444bfbe1c79788c71e7dabf5fd975bd2bde5fa53cf14
SHA512b815971d37204b430d5ab07777a5471ee7d743d26bc5d5272b018eee2b810bc0c6aaac2d363fb4ac59c206fb2ea91f3eb8da544f57e8925163a4f29fdcc66459
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b36e3e89340b0a976309f7f9ec2265d5
SHA1edb691b7204c1a2432febe80c792783611203f40
SHA2562fd1c7622ff2b47c2d85485e6891a10d1f6f3cefbd097a562bb255cfa09911ac
SHA51233b335bda3f34b5b90c8044e1f410d001070a827a043a01f81717a987a91a04db0268900c552337df9c09ca899f63244f31efd4fa7e3172d248fd6e3a09fae91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5447fe9baa6dbf4f80cd0f625dca72a67
SHA10956fd13bcc5ef569d8e6493de31c7bd71017e2e
SHA256bc3949ec40d627d74243f7d71c49728ae166a12063967c5d48fb7ba9e0774e65
SHA51233fda9db619e18660ce4f6720285e234b91cf4c48d57ab9e25205bdd98ffaaf058c72c1a5be85e597dabd6a8b9b107ec90f2c636c3d643918555f15b6ae4b8ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52342bf4acd9667cefcfb2620eb8be95d
SHA1304120f0ce8923dfd818be75dc0755bdfd71b26c
SHA256aaeb5f6d9d3847dc252c1efd745993f4469aa72b25bbc7d40f24766ec51519f7
SHA5122e3fefce06e9f3c58d9fb195d57b93d67527b8f1b7505b0e9abf845a8cd0ba7925d8cbed1f24731a9bf9357e585aa407e3db4982756f26b516d4217c821ff405
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c7a0ee2e92e51b1699c98b95f1331f7
SHA1c501afe3f494efae0e5b31a0d34bf4d2424c3248
SHA25623de7972ad51db5dc7c12fa95c82181f4786f49da82819f4ce8191ef840f6905
SHA512f0389462f7f86e5685b049579fd7210040129adc9f324cf7963b1c01979e05268cb13b12c2450c2529c03f9df0f91b92278ab2137220b112454a915c52af1fc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a28b4f216538b774cb003f70e63b9de
SHA1d82ea17099025652f915a6e42a8e71a09e654c66
SHA256bcc6943ad50a70a76301480ec2c457e9c85aa41d8ba2d1362da4f3bb381e1fcf
SHA5129bc263ad82a4a6208665d1917f7349dfe2ed14c9c203f635b2bb0cac6233d2fbf0355575f01a21adac9b30b704480b20465c1e6472aa51201037624871b8233f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06