Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 04:15
Static task
static1
Behavioral task
behavioral1
Sample
04b47669db463b0dcdc5d7d7d74f20f9.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
04b47669db463b0dcdc5d7d7d74f20f9.html
Resource
win10v2004-20231222-en
General
-
Target
04b47669db463b0dcdc5d7d7d74f20f9.html
-
Size
13KB
-
MD5
04b47669db463b0dcdc5d7d7d74f20f9
-
SHA1
516b2e6b62b239fd3bcdacd57511e79369bcbcd8
-
SHA256
e0f19ff0b31298e6f4cfb13f79d74188ccd91add6f24e51da4494cfce6ea3055
-
SHA512
39ede008bbcddceb9ada541b0afc4aeb5099cd2ea737a41b4461484ca54347303c407b6d50e82f48211db7a7b34220aa566cc02911bb4f2cfcc2c07033951497
-
SSDEEP
192:JuU5tMEs3ZW6S7ns7g72w6rg+zBv1B//zS8dX/6zUYimYrMK1v51haSvX6dLW:BDsMSLT
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 506d2e505038da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000668e05d8a65ae487e0d4a77c1b5747dad9423eebb71b4397edce03de24f68d58000000000e8000000002000020000000e0c1d9bda0132f66ba5af10c88849622c90b59baa017b60b8356320190fff84390000000b1510fdd8be2660e74e6f19765c1943040c2ad1adb924b3c38e71339e75a8506f475257be931fd4b61decdaf5b80de526aadb02f365228a1573de18a07b630fc0cbf733544c87d08c995ed123ec74caab3086e282f01774295dd586c76eb5580858e7429de23397993c9cc3f3dd32a7758ff65669d849d3622ad280a2f3c4464e71c8ad91977939d79734ea79965fa5640000000b1b233e827ffc132b71e9746a670421909a45cd82035acd898bfdc37ef71fc0c3aef20ee099fe8af67a4f61cb7ee075c49340b71dbcad622d92f43ed8e2f9a4a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409793897" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000003f97029fffda0520f52af18c1f38bab794f2a6d8fa0b08d05c1a6ffaac75a260000000000e80000000020000200000008288d4ef1debb0fd1c7c8add2e223ed2d5753873be0e35f6056ca52dd2ed90c320000000cb67581a6d239953a6805aa88dfde7a010e2d6108ee879575d9a9dd8a9a4d9d7400000005c25fb55cd35d1eb208bb7636500120cfab3f8de6ee5f365a0348d49b749739472ab5e57d4bef5acfe157b31c2a5d3ecd1559d50f6a5094124af3b73a56e9ba1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B5B7EF1-A443-11EE-AC0C-EAAD54D9E991} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2096 iexplore.exe 2096 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2128 2096 iexplore.exe 28 PID 2096 wrote to memory of 2128 2096 iexplore.exe 28 PID 2096 wrote to memory of 2128 2096 iexplore.exe 28 PID 2096 wrote to memory of 2128 2096 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04b47669db463b0dcdc5d7d7d74f20f9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5002fcc5de55aee15967ee142a16ed83a
SHA1c43861020e2034186d6150df45e2a411facac8fa
SHA2563bb88b85237ba90461de7b2c48621cffd7a8c88877e1cb64e1361b8587af888b
SHA5129dde216caa8932d3e8f822ec3fe77d27be33cef2c0e8f0c88fc5ad88c1a8ce37ffa7c6a41bd72292dfa5659d13b0e03a7d1296c47b3853c394a3cab3176e1fe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2a1323e4e34479df266be5bca930a36
SHA117161a82012b519d4900b6a90dd64f6aabdf6803
SHA25699b9ae6d5d4b00c2b305134e0c1be487624cbb4dc70cd10fc3bc834e60523e51
SHA51254970a3b44b8f18fbadd2e432dfc73f1c3850d19424af97b628240111dc1606874ecd2bf1a022a54bda553dc47ed9c4622b4aaefb75021a86f44a8c8669fd643
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee321189c36a125c31f526a0c58d0ab1
SHA1dd8ffd407666afb38ed27585ef82b4eb96c4ac7a
SHA2569b05d76a33d8a0f645ce8e92def70afd274efc9b04b3a45ef65e293ac0e0254e
SHA5128a6b9b5a21d1d35e9f6de4f061c095654ca2a0411f83db269971d303a4ee10f34682aeb4b77778f7b2d810d8037444631223e43b5f8359a36bda5a0822b55dca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527717e218623db15120224cc67cc4402
SHA18f0f837fff694813243f6d30782f2faa0a8c3943
SHA256969ed4ec5ce7a68f011395ff33fa6799c82be5f7ee1786b96a2197fbdfb8ae75
SHA5129122c8da3878eb6cecbacea23572bf512f36ce668f47af8067b0b65cc4db26b817097ecbf904115d3049731faba36547166c6271e4ba2a8370560d5449a91cb3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dab4cf0f9ccea699a8fcf1dc7bc5fdd2
SHA1974cf7fc39f2cdbe4a9437cfa894a9be98e30154
SHA2561e8f8a32c1aaa0eb24765275a554c0d30c56363a16706a53762843a990291267
SHA512ebafa99c5adf4844a6397445e4b3f2e3972013220cdeac4d0339e118fd89a6d38d0bfc5502cddef1d7df6f1beb09e66bc192a28d8e63e0fc1e549696ce3e5b55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdd342751fa8b5326f29d818b4601471
SHA19927de9f156bd4e998fa9084548e5b2773eef06e
SHA256e00eb721543b1ac7f9b8e6fbdf6f3c2958ed854415541e88224df79055987d7f
SHA512e348cb6ba723287a11f0d0f974383c258b82a63af06e27a6039da64e7cb27f407611afa029073818d9201d228abf453c37f0e9cffcf94b28e0fb5cb5f70d5ad7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab57b1f8ae4a6901f2eb31843709ce8d
SHA123af61adca1c55a20e5232643932b4b883433266
SHA25623520ed2335996eb85b5bb74028206dc72a11ba43bb7776b1fbe9731a1a484cf
SHA512df37ece9e6575b401ea06f5f48b654fcb301c10da988d9de3b58193271d84cda81366a7cefd13f2830b5040c221645c603b183a7031e05f62b353cebc047d18b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560c93ee3f4a78cf396a36e3dccab5554
SHA16ef508fa85cf3c430f6b700542636e1d508ae6b8
SHA256f9af363398e802f838eb61d67cbdc3fe7a6e6aa2159e5c89e084ad01da6c15b5
SHA5121c56f1a46553057fdcd2c7ed79909daeb80396d90279ba96d35ab697c8474d7c0586af1b41c366d92b31b68271a3d07601061f30706c88dadd6f2709a6629d6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc968a4f1d13f0b1a2fd224f21f0b223
SHA12d665914313a2ab38841f2b7facb87ab55b89367
SHA2562c8417279377bd452dd6e82895e25eb66e34bc4edeb327416af45de69a32d0d8
SHA512e10adf2e40834a7ac84df3c998c73d50896d3b92397835c75b43690b7db10d49310467a6d0c7524b513f91fb8ec94c717943ee4a0dbfa276b12dd499e3332d2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5361b63f0276ee26ffea37b394ba0df7f
SHA13687f8e418ac7da268cca37756b0c14bff8fbc2c
SHA256e28572130dbe001248779b5ff64321d1fbbb0765bb185511950d33a807c57fbc
SHA51222ddbae0091bf3b2aca26ff1975decb2c06c7f0292f2be134b1e4c73d94f0844f552fe240dc5a5072d17e1126a31899af0d0001018066f37096b2047583580cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6dc34dfe6f092c095e643d4e1f4f900
SHA1892048675e2266e160acf4d835fcf99e00db8c7e
SHA256e646da3c99faf80cda8acd56e364e3a0cde9f146c61821682c3f4a8237e6ecb9
SHA512ed5ae3a53e5d8350ef0d59f78cabaa4f438c40909e957d88b1387ab41f02327adcb0379e4db3cf163acb41b87c46a93a0aa61cfefb1a07456a4cae1a01fb9b23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55abde54adb7d1213f608bed8da671f93
SHA1076ebaf623f9906acf0e6626a9e3ac5867b678ca
SHA2564691c97bec384b73b2137fefcad80045fa17f3405651b0fd0c67aa64526eeac7
SHA512757d7e7a9129586cab142dfd8afd2f8df5f35df4b7ab4c516e8ec6c2ff34f184e905fb77864f86cf08a00d737327bf327421802557de1039903c715b3a59698d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5872e8a9fea8ea0d24f25c90461c3e752
SHA1600c04efc736d84a938ff653c65cbb5f7dd73b72
SHA256e8f637f66531e667a84fbc31ca37ca45d07d916ad2033215089edc61ca6e04a0
SHA512b6124d6cd7a239b20c4aa393481e7d203d7d8eece77ba2e712a9fb74248c7f8e33cd753e22111d87f631be5887ed0132cba67f075d54d68a1e8beca46ffed572
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f41be20da974e048ee313eec543032cd
SHA1ecb61f74159fced424ab10eaa42ff0e5b2210133
SHA256e82b1dd51f6f9a9575b89e9b043fd60deb2bbb033895fd26b080bcf7d665b8a6
SHA5123ed2704cd991772f43f86c6715e1369feba176e182a291701bee71234d2c6d95d5e7f7280f1be758b87655d3c31921f123441067000aecb72574380a5a33dcc6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06