Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 09:09
Static task
static1
Behavioral task
behavioral1
Sample
13f99cfd655b9e894cdea800d4b3ebd1.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
13f99cfd655b9e894cdea800d4b3ebd1.html
Resource
win10v2004-20231215-en
General
-
Target
13f99cfd655b9e894cdea800d4b3ebd1.html
-
Size
10KB
-
MD5
13f99cfd655b9e894cdea800d4b3ebd1
-
SHA1
5f91eda4d495f6e2e205c3b1d6d2a4771d758895
-
SHA256
e3531a5f327bf5037aee255e2cd1750ee0bf21b7095ce00a0c3c15abf99c3d87
-
SHA512
3b02730983b8c020316335bd1c942115152d9661cbf0e0402d412b9044f70c395622e9730593825b029c4d929adadd5f565cbaf4addc01f5978a119475abe983
-
SSDEEP
96:uzVs+ux7czLLY1k9o84d12ef7CSTUnGT/kvsHpb4G7Om2RrDLwtlVHcEZ7ru7f:csz7czAYS/6aEldfmPHb76f
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000acb3a50941d5e39e46e9c08417689af594119285c61376504115617bdcae06f6000000000e8000000002000020000000c70228d38c4645dec10ac469d8ba288d6ec2fb57c2bb0b14c5d17a2cf3d4b60e90000000ab032032343568131b7343f967431d0039455d2193e2aa81b4faeec5e61afe4690e2555cb2c650b9e6c89e416c19b1f2675c434321d2aa2a90b6173590d012e77b445e5bb4a3b15bbe5b09796b93af68ce5240d2cf10f3d23ee040eb6b4e77daf7b92876580ac45f4fde4fbcef752bf332b641356ba52ecd160bc4fe2e730460f8eb5353d79e2f8c9d4cee56492d998c400000008c7296607bbd0ee3c7d5cbc52a72edeadb29494620016b72d9ec59483d5cbdab11e94c8e57bd6949fe84754af64f357ee7c7a99fae4c6740ef15e5b95991783a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 609357fdfc38da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000012638985a3d1fd12caea10820eed3a432835226e1be8a870fb3655feefb76324000000000e80000000020000200000002d13fdcb7c07f2807e262592f1aecfe7b11a577c69189474e5c9e66dd9f369e520000000e65d923a5e8cde429cfb2e30a560f21907e29e3c36487205ed864d03b3138f3e400000008a7306d3daaad3d657eaa30d35f053378e0ccbfff374532ed928b3532d53f9b7727ccad4b7dc88dbd568b55924b91647886c8c299a87e1ff6b3206d278ce79fe iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{22882C81-A4F0-11EE-A5B7-EE2F313809B4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409868045" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2336 iexplore.exe 2336 iexplore.exe 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE 1392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2336 wrote to memory of 1392 2336 iexplore.exe 28 PID 2336 wrote to memory of 1392 2336 iexplore.exe 28 PID 2336 wrote to memory of 1392 2336 iexplore.exe 28 PID 2336 wrote to memory of 1392 2336 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\13f99cfd655b9e894cdea800d4b3ebd1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5367bbd265b06c4cb91ca975c3fc7ef9d
SHA133cc732ccc2c7f04dcbef372b5f9e75f26c94765
SHA25612c4d12036f2d66fe7de5e8e2a144f0960efe40522e0db50ac342834aa674f57
SHA512fc350e78cb3d175ffd0e6869ea8e370e10fd20d254a3a4f6c9cb8a63971561793dadf70e0c19099c11ffea5e80c9b35c5208c47aa857c9d47e46d728cf34fb37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3ba3d7d1110b06c8d78174e7d4e3f3f
SHA1cc0174098ffcc842f55b7382f9b65c12a12ef6d6
SHA256d5313c35b9c0f5a53b691066740ec5dc0e64a73eba8ad4e2ffe0a0527901e9b8
SHA512251c784b6cf90bb2396e129b0b0e12f61a9f94eb352a90c7416edf702044d210024a189edad49bd259c06b270515c1dfb6dbfd4b0cc0fb949ce69dd409b030a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efa0e1969a8fa22087aa12e902c99064
SHA161a3a76bc640ed0d8314dc7b9190cac76f658407
SHA256f8513f9d1f8f022eacc012499ddb83fa9b255a70db3745b093bff743bcc3d9fc
SHA512c902b5bf582323382dbf6b571a34e2c1242acf20c71e97f9bda7d1e6d539412cf4a4f0a90d769a0503259947eb0798b0ad0e746ed674dc75ce818eba39f726ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee69d16927f9930d2c5ccd7db903d76a
SHA13927774ecf12870410fb352728e01916429a2a6f
SHA256a47c2c3e736b71439c4401816122bfdeb9fc42b125c80388010ada5a355976d6
SHA51277dd465ca505f8d279c09ac1a758bbb82b737e1bf7005938976d26957008a79346ec284ec62bd56e7c9df15803d39c24a12c2d9168edb605993ff5da12d03a70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542abd720952447b10a9e363a7c0e873b
SHA1048a0a5626deef21c68cd5d980a5466fa505a77a
SHA256a8a6963d92193a684d630d17bb95c9088f8687343a53d3ae1804e380285370c3
SHA512a415cebe7add292bc8ae173339a168a23b1c0d695b527c05ff5273440ba00c4f5c443a9e8215bf3e6e4a52f27706317608e903823801650c6374ce42211924fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fff72844e23b8ca5abd4322071ad05ea
SHA1f1c76051fe029489cca7b7db98d58a8b1bdf1a38
SHA256d563d7aab5b1ab30be03e7e54f58d2708b17494ec1f6b8b612f66b18b7b0ca4e
SHA512a5d8d6887fe513dcc7e89cb7e9b044f58b7302e566aafe0abc871922019ffe1574c109a0695f44f00aae92ee1d171199e92f45a503807d54909651820248d6ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5556a29d0327f78ca7ccd79e936f944fb
SHA1830b35c5bb8ced32e370f5990b9c20c7b3aa2593
SHA256a8f55af6630de502fd4f0aecbbf775365aa46459e896c42b558259bb76b5d6ad
SHA512d552fa18e12c05c3a2562b57e2997ccff1ff3729fbe44917ccb71f3ca7bc74d9fd4c1761af29091053292796f47f3e6276b0231e44633f94d3ef47177f3d4798
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abf5fbf229678321a0732bf3616b474c
SHA1a153463283d66d6359e1162405fe3bce4ec8c0f9
SHA256fb94e5a2043b4095b570b9a11a9865b486e325a032ff2aa3a0f524421f4e7aa8
SHA512f40968c0da2aeb077a1c3339e60fb58fec4e8dd983eb7c6d4bc1f08032a47f099c7695e546886b7a4053e0ee3d35abd1bfd7a167262c9e5bae919c5f165d54c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb29710f0a1defe16d4bd6a23f7ffb19
SHA1ebf05440613e10e111c0693bf1176fbd9a524113
SHA25615215c2dfa7139d8b7866fbcc6a8354aead9069f4159c7a827be7e37b8eaf81c
SHA5129cd8c0a995ee74cdbd6e6ed5a2e888ec3d7a669766c7a9000291bfd56740d657a7e29122157bb946a1818843c3ac1e278446d6694e89c7ded396fe05e4e9b706
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5287baaf29bebde50dc0efd9cd0817150
SHA1e61e4f0fa405c70f1ed84d49395ca42bc493ceb8
SHA2566ca132a7f3e62e7b69a684569563ca2791c60bd450849d59591ea467e1a7589b
SHA5122a8fa0a4000915d67da0b682c4b6aed411bc2a19c4763f946c9f0a230120eae457c1ea54d2f516a626dde2b0c96619abf97ae090c5918f9bbe11497a537deae6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567080c7fcd05b30286784da487c650a3
SHA1f57492988507bcc5a427d71aeb245a15c53a03fe
SHA256ab7e37aa575195143ff7112355c057eba3cdfdccf1bb0a6d9f55e155ac1b6634
SHA512a10d82072fd84e94a2e411116398c848a762690eb7c2647b43203b99ba82b24f6b7256af8927360eb903da81500d585bb2d2732c2e235ea756b917b9d05d45d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5453bde371ccaf1653d8ba077d79fd892
SHA1acc29542a5075f85c4a48a10ec00fc0b03db2ce1
SHA25622d5f4e88be9a084e8569915d768d6bf298418619427389cc9d7d27734354774
SHA512719cf6bced8a1d3f93f4a869ad2b7ef2708fe1e915913331ebaa3ab147493a84054118f7a5d32f8eb540ed59919f73974b3162ec7e868105b048a496124182c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06