Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 03:13
Static task
static1
Behavioral task
behavioral1
Sample
0237e976ea04016db6a6be5a05525fb1.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0237e976ea04016db6a6be5a05525fb1.html
Resource
win10v2004-20231215-en
General
-
Target
0237e976ea04016db6a6be5a05525fb1.html
-
Size
34KB
-
MD5
0237e976ea04016db6a6be5a05525fb1
-
SHA1
9ac0babc03e86f23f0d698d84ae0423dd5bb8cda
-
SHA256
65c6cf5e1176d0a705f5cc04e5a157a57972696515a9e5c19a01980d5d5a75b2
-
SHA512
5f7f61ac54dba78228c75401d99e9d0846a091862fef02712543a48f86967eea80942a49715d6930b1b8c00b702f3d4cda9cb79af159b9971f9c9f54bc358537
-
SSDEEP
768:RnH+Tlmqlih/SBazqvE+lgqVkcqOENRqlix2isq7KV6vqS6c3cLrjBY87lEA:Rn0lmqli9SBsqvEgjkcqOENRqlix2isJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1A4C5AB1-A31E-11EE-8452-CE9B5D0C5DE4} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000004562f6ed7e8e811a7e3c942fb325719204d5b091fb7ea39c74c7f6d8bcc69450000000000e80000000020000200000008acf2fe22e0d31910a3c2a43f406bef127ee6a8bd80aeaac11145b252d222a18900000000e10794d951b49bace2b6507cca570c74dc44431c920f8de524183d914bade1143829bbc939488f320d637a3f8c17db5cde130429c03c2796bd9cec48703463d050e93c5925d88347579860e4221a36c4a592bcf19ae5eb477326bf91a294a82504fc167c4c323db5e43df655c56307ad86f05d09e904a85a70abbcf045a49856439aede6bd7bfd6fb7e9158e5060a3b400000001301bc901283f9cb559302ad5c1de498252fd27bbae35276ae806b3f2323255fe00bb7253a85aa269495b7b9ca32689a1e789afabf2992049735b44e2c953651 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa0000000002000000000010660000000100002000000016f530f9b4bc7e5bf16649b850e522e2ca66b073db22e12422f2625cb3a4c337000000000e80000000020000200000009281bcb8ded7ead94a8c078d098e5fbb42267db07a257ddfffeaf7f2c5d081f72000000055fbf2151bb6d3e3c824c31f9e4a8bf9221ae61cb5c51b9ccfa481830820f04e40000000fb4fe382177fb5cbb322a0fac04c7bbc4b3502a00a4557bb7aaa3b986756b0ac7e406f032d87d1907bff18198325e0ff4b62c05bda299ecf0b75abdedd2ce8e5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7073bcef2a37da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409667919" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1576 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1576 iexplore.exe 1576 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1576 wrote to memory of 2688 1576 iexplore.exe 28 PID 1576 wrote to memory of 2688 1576 iexplore.exe 28 PID 1576 wrote to memory of 2688 1576 iexplore.exe 28 PID 1576 wrote to memory of 2688 1576 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0237e976ea04016db6a6be5a05525fb1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1576 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5482f970abc03aab8e757ce41ce8b660a
SHA1e926b8b0b4421776d0b1a8bd9e47a9c7b4c760d0
SHA256d7f9e5ffe50bd24bd0530f5ac0ad68e5727b1c170fb18c819b8c3b7e4be36f3c
SHA512616fd892fafe1135742ad6a803f53c3a27bdd07ba795fc5334a74ccae0f38f758a52ac464a3a89b2c6b0fa6f5643158531138f01bed5cc317a611b7613b9f8ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575e60da9b40efcb2de5479a88e157a97
SHA17a5c2abbf7559a6bfe33f5ed6981a847f6de7350
SHA2561ce9f9472afade809c1d44ff66140f8020e1e6ae14765aa8eebcf7c93bf83aa0
SHA512bdba4afc6ec9fdf8f3ae4bd65cd4c2267349b31b7040f980ed8757acef707893279f27bd75d7c0f56901b8ab4eae1950fd162035f39818b58b64e961a7f62cd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbc330f2b3eca3f6d443296775acb697
SHA10df9563714a5cd45d340cb7b75a69d3fc124ecb6
SHA2566e8c8c5f23998d3a4a44434d89c7ea7e56b431441c86d4b699d40a56e3979e69
SHA51207cf2e61a52ba68e3fc941ddd65a6a92cdfd8810cabbba2e0c991851676c18b6c0429cbd78c8746532e29f248741c78da80f7ab1df6725829763b1c3d0105bbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed9973d7744f9c3a72141cda6d5e0d09
SHA11849bb008d1b8113ddf6d774339cf0ef12b1a7c7
SHA256c110bb685bfa42db58db39d8e35274908550062bf0139c0dc603ae35f18cffeb
SHA512f32e25fe42e62b8b5e83abe16d77ff438a02bf0144456b5f24da7f8adac3cd58df9f02f5ca1606e327a5f6dffbda2fbf1f21b688cddbf3ea1fb88dcb8b440ade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d51d57142729493dc27081ec6e9f12f1
SHA1d852a01425d89c0c364998d344c60bd8cf0a1340
SHA2565ce99d4ca26d1fa07ee9b493b669756a69cf5ef9ac3d0113969e258031858562
SHA512cf171438f396ae354218079573d1a484079e5f4a36669fa13092d889ad7b0673ba69211b67a105d868bfedb138a109e65231837809e9d05077a93b1d85abb44f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd650cf4491ad7952b623759de6255c7
SHA112a2f2f649bc947b781f78a7c1f917b6cea2db25
SHA256ddfd2d4630ab67a04b92eacff05ce25ce6d2fb48f980bc7275580acc527ae10c
SHA512dabce2d8a869937b31f2009b4cce3537a6cbdfbc917cf361a9b4e45ada697e61c6dd3e152f5dab2931bc0e24ff310ac1f7d4441632025c6f6be374318a90bed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53959d7ee4383e15c9705febd8ea39751
SHA1a279ed5445b868a36662f14ddb391095d98f41ce
SHA256ebfbf138ca5b3ead4295e655d2542528a4094fe3b568695cbdb35f7d1ac96738
SHA512b03e5ad23b7a7c5317a9df6dbc8852372be949a9833c51684b37b802685344d88c1d893e52a0c1007c15e6bde03969f24a82b219b9ebec778f17145dac2e08ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5ae62f28a0b759fef34b806a69bdc87
SHA1fb16bc2c876f7b367f250212b45f634d5a67be1d
SHA2564962c3052e01b75cc863a6cb0d9c051564343c75d11b4bcec3da54b3487a07ea
SHA512d08b3ef5969a789fe638eda057e3f761d8f746a93b4f77f9729fc5266a34adbee5b1eab7ca00276044f4ef30a7683e9c6606f22b45e36245519d4e046b1c391d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acf95cf6633fdd5aaab300c6fa4c5dab
SHA10108679403ff4bbda11cdd54296ff6d5c4ee2d63
SHA2562837188ba0370e812a270db7c5ed985d1476a1951a5ddac7eb9fd456af0329b2
SHA512508b006d33317546c470fc9a41c56fd3a06c6a9f5a06b9d5784cfb36963ee1e9d7f91dc130a5a1feca79cfc0bb4ef0dc6e2a20219d825407a72372d530376efe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5907e466b1becae1524b1e5b1fbf038b5
SHA18fee49d18c1409f646ae6f29d489f506aa0b159b
SHA256fb136a620823a8551cf0ed633fbd9dd7db6c3644e5a8be5af894cf53c727b0e4
SHA51218a0767d57db62576e048e3ff60a54abe66728b27c42fb768cf6857a8f6a0812b7c3e804d2f92297dbcc4101ec298bc1ac550f3e217a12320e655b9f13c17c91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc71f19b7cc9c39ce7d939f7dfaf6604
SHA1309744bdb20f14a80d7dc431b65b998b923c3fe2
SHA256baded2d424274f9640501b0821f9116d4ea49418ad1d2a13338fdf58657a9c39
SHA512e11f3ea2510bf09dc721a9015569ac623007e78fb1a5b582332f558f1e70ecf2ce4e41aae0349134f894b92f16a8db137e012ae1ee88ffb4266c9ace395bbbac
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06