Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 05:57
Static task
static1
Behavioral task
behavioral1
Sample
09cafc618dab1b4c58227348a8544d9c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
09cafc618dab1b4c58227348a8544d9c.html
Resource
win10v2004-20231215-en
General
-
Target
09cafc618dab1b4c58227348a8544d9c.html
-
Size
11KB
-
MD5
09cafc618dab1b4c58227348a8544d9c
-
SHA1
5437cc7c696a9ba29bb8d5b622c4b4341740cea7
-
SHA256
e9558cc6b71dd9f4f940e0f1d599f26e2e34120e7dae2a922be5e4701975b312
-
SHA512
b427cb1b4d6f393fab7789216fd0d58169dd9056688b74758b87b7ff08de7c66eedcb6d3e699825801f8fc6cec4b6972cb6542bebfb5a27fd276ef25e55a549b
-
SSDEEP
96:uzVs+ux7v9LLY1k9o84d12ef7CSTUnGT/k1+pEooYPiTe4nsjuFsrlVHcEZ7ru7f:csz7v9AYS/62nATeau88PHb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d7b779f95b59fd4025d2d80b9771dbc9f90e5bd33549f77c1b78d6f08f76f12b000000000e8000000002000020000000e025399ffce8f3d28853b99c11f0291c92a7843d61e14ca833b81012db56b1a790000000c23d25cb43b85abe8617817ed88fac263d6ca5b68c3dcb1000acfbc907e1edf72f51f959aef0552c2c900e498e0adb7f8ca14518eb5a7f995ab3b6260c9e32df4bb346189c7c6a453decded80cbbcce1dbe880efb1f77e328ae03f836240168582bb0369ae408d006a9d96d98db6221a1a25d17afc9cd7259b6799b8e07cb16797dbb13c070586b0c756384fb51acd404000000018e95a80db2d764253a9cd34ff39bc00fa6a758ea1cf16469996da835e1f6b3177458aa2645350f546f65d3fd4766afdb8745a6036764b57799485bad296d89d iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685361" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000418d3239b561507daebfb70d35fe1f91370f9aa591e276172d2c31f172d557e9000000000e800000000200002000000006b95d8e6dc8c8dc504da83fd7e81435577e68835d39cbb0b226cb00ed877bb42000000025beff7277c470f07afc2e36ef339b744026dc1fbd1c751f754112300244637840000000c584fe68b5bdff775876670c82f21528c332720666b97c8758b0591e5d310315c5ebcd958a08ff50fae5aba025d34a701cd2a2d3e3512b59daebdacf5ebb2c80 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e7da975337da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFCBC9D1-A346-11EE-AC0C-EAAD54D9E991} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2096 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2096 iexplore.exe 2096 iexplore.exe 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE 2476 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2476 2096 iexplore.exe 28 PID 2096 wrote to memory of 2476 2096 iexplore.exe 28 PID 2096 wrote to memory of 2476 2096 iexplore.exe 28 PID 2096 wrote to memory of 2476 2096 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\09cafc618dab1b4c58227348a8544d9c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2476
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57d7cf4ef447e217e32f45bc80513014e
SHA1572dd078ce11c17bbec01571ee107e77d6ef0b7a
SHA2567961d1785471138041fd81ed2b1bc9d1fba780fa0788f4e48899282fba5fcbdb
SHA5126269c51a8d8c50642dc5e6c8d4478cb2f330d0e6d2ff084a7c2005c6d5f550ca5fda5606458db1e8adbf9c1e1f64e9b6fbd195579984e7ec4dfcdf5cf0b75232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579eaf265c5f5b337f171f429bb5c99a1
SHA166c2a46512f785083f11448fa90704625f123373
SHA256b123b32192cea8a5bb09c70eecf828fec064cb5615121b6809a2369da1131cc1
SHA512850562cf954e2795be095734dcbe2de5fb2075e84be113d9d2d95d95bbbc8a7a1c92583d5285d92f6bc0f152ff50a782db714d514a29988ad3b5f426deb7450c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5138b398055b7bafff81e69ccdece8934
SHA1594a8b6e7616dee5084f9e285b0f1ca709a3679a
SHA2563a8f6767f8150560a1edff954910b230308f0cadf2c2e1de36b7d4419f184070
SHA512fcecbde4f55ef63619c67eb05a2ea0a3328791892c1b153942ff420d384ffaf11af4eb124e937a86f9543aa99b0d6f335a1c29814aea78d7991ae3313e0de3a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e15cefd838b2f4e92e26408c4dc83645
SHA1393e927f7a05c1abc3d6b54bed7ccdd2203b899c
SHA256ba6f67453caa47b54acbe66a9c8eef3ec66ebfd92aec6dd343865786a8e43cca
SHA512f97ae0c0e841cdcda9b3d9cefe50ad8e7a78352323a54fdbc997f00b95dfef4622b546a924a951b351e396222836d9db34a08ae704fc93f8e112e4ff4dcb1d51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b6328334c379c3fee0bfabbbe63b2ba
SHA1063cef916f4a4a65e9cee64424b91ff46fdcc090
SHA256e1386f5854fe9f21906febec085babe65ac22e29a6626b12ac426c70d41dc1d4
SHA5124ac5811c96f7e512418317c970b95be661ee6763541e9518112b067f18307022afc09c694dce0ea201b24549f259a599cdc60471a0af18e3eee0dedf51c5ba6e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb9013d56854ad4c1c31648c26b744b3
SHA18bd59d7915054cb8bc71978cd5e3305817d55022
SHA256e383480bce72f27230cd61bb7a3da8b6c95efc2d6d2a79efc6e9d29d7ab40c37
SHA5127f497bebe79c6f2dedac969f87145c91523e34f19f8c675c58f84d7a11d4e913bfba65550536fdaa166687ee77d13778a63be735b3ec1e555347315ac9625068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542e2b2e204e40cffdc2a82c4da24449d
SHA190547a9dd9f2efccacb8beffcf73f1f28849424f
SHA25618e2d299d99ee8ac9ea43e19aaa728f331813256f9e79546e8c5175a7fd312bf
SHA512a529c8dd1c38860025cb8e3dfadd5c8bce34b8d501fdd3b02ac06efd545f7bc2845c8ecd953be50243d8045574c6d5f299b5f17965411833ddcdd7598da31210
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5d95c01f7c56760baa32efa2d4fdb33
SHA14a3393d6a48408c60bcb4b73cf38c9a4b4053bc5
SHA256d001642669afbd120302120cfc14f761399003615bd12902e0249f7fdb71e47b
SHA51271c0cfc647af5337e5b954d9a0f45900b6da97b816f0211a07260fb8128158b9cf4a0e6feb5995a2634eda693fd8c6725dc5ac4cb1769ece8650bca1abf070ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4de4e7b034db7726ec7eabc911a6c4d
SHA194c4c4e8464c485143a7bba90b7a16f799e272a6
SHA2563cdccb2f6c808b44e219aef7b40166610e080b48e77d0eed7b391123ed0ae142
SHA51268c49933f5692742f844108d91979e761a937bcc7a85b517b3f5134b91630c01d1757c240475d48e0b0d27edf030bf6479008f82b6e4c2b70875325c638fd47b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5881b44f140c299a4221e0592ea568d94
SHA119527c7235c7a4f0ef8ddeeea68d50bf744652c5
SHA25665720720a81595bd2b504ea1455a4e2f9f672e606f2360acbf586910b76d7306
SHA512f88e2f9bc0f2c486c8986b8f583141efc26110a517f42faa60fa7cd65870568e032b801c34567322496248280c7ebaf57b452d0eb6f97aecb74fef23e785d484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f31ad5e4ecb40b26bb2c239f0bd15c16
SHA17e579ed79bd0910d4e80db860e4a9b61b4ecaca1
SHA25678eef3d071877f6413b4883c1f3ae932719a7c4218c32be92fa7eace62bebb91
SHA51219bc524aa9cb1bd84e4538660731c8bb605fd64f6419cab25de80e48de94a2137888d9dc26e303e38f9aa69b0d488ce4a743725bda2d3fe692ed2f8b39a54f29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595873e819cc8800d9b4dd031cb80eb1b
SHA11bb2a13ed818e7d52b09f8ed99408a55e1fb2db9
SHA256b1579c9ce146138d3e994f959242dd6cafe8fb38858b976192ef819f869c9292
SHA5121e025d42a6ba49292e436e0e3397ef1233deccc8b3654f9c1ea7b0081a0f99f68996f90e1d4a8101b3a9c6ba22cf4052d3f15ea3ac43ca8e7e895467aeea4875
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ab51e6d20ca90c43a065df005534a2e
SHA1a77091b8b92fc78595e54825688b8da30a4c7d93
SHA2569befd717a1656575c6dcf1f82b8002cef3f7c44f5fe9ab4259459074cf4ed6bd
SHA5121d9e6f4c141cb8db7eb80e67a468d700a2eaebc8103e1cd4789dfec675d29810cb49fd38da946b6098a7d56caf7ea5ae476e80433c893959e8cd62552a3d6b60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538279bd11fe20a33c889a02d7e26773a
SHA1d7b5ad4bcdd7b1f623bb1eceebca6f08fa0ab9d9
SHA256d740d3a66493f02dc24b954351921fe7f1ffe1727c991f0540751db8d22bb010
SHA512d840052bc4abd330c85d1e9b1a4c28b7244156d8d91d9bb208a9a7ef88b91d406ed45a74bb9d153b61871ddf682be4f0e99f7bb6579b60d07f432513ae121c18
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06