Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
246s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
1604178db4cf18a7e4328a2e93502290.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1604178db4cf18a7e4328a2e93502290.html
Resource
win10v2004-20231215-en
General
-
Target
1604178db4cf18a7e4328a2e93502290.html
-
Size
50KB
-
MD5
1604178db4cf18a7e4328a2e93502290
-
SHA1
bbada83b2780e1430e5628480bd27a704d8b232c
-
SHA256
0b4e0857b1a2e6a458f97e1118320c806f0a7e11ddfce87163a22114aaf1cc29
-
SHA512
bee78cb2c6fe23c6d525a594beb7b5455c3324c3868cfd3afb30943e9bee48a91256a270050c930779de6fbac64ecef013d38bb353ae1ca641ab9cbd19111020
-
SSDEEP
1536:55R/nPW4vVrVhO2ttxbhUMP+zlWDNWc9ba7VOQ3csF8ioFzXuinqS7nsv2x4ok9r:BPDIDOQ3GiIzXuinR7nu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0E2E830-A505-11EE-8575-62DD1C0ECF51} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409877432" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2552 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2552 iexplore.exe 2552 iexplore.exe 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2552 wrote to memory of 2904 2552 iexplore.exe 28 PID 2552 wrote to memory of 2904 2552 iexplore.exe 28 PID 2552 wrote to memory of 2904 2552 iexplore.exe 28 PID 2552 wrote to memory of 2904 2552 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1604178db4cf18a7e4328a2e93502290.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2552 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba8f3ba333db5ccb76c3b988dd17bcff
SHA1233b2c9b0fbdad8c2e2ccbc6f382065df4485226
SHA256ae31458b0abaa4f29841ef8f4572d108c958ee0f90f88601a5c2ad5d51d68383
SHA512bce56ab5275a01a9dd07ac0767e64733c853dee60cf96d0359134100cedf9e2ab005e5f8d04649e300f8f4593db9698737c1e691491e5f335bb0c3cae32adba5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56759cf8dea0cbfe1de5278cbead07027
SHA18153d8dcc919fe84e00b04dc09f531b4f1ea07fa
SHA2560b2a55f1e66345322c2db22604fabebcd422594030274c0687aa179f243b5624
SHA512043c1fde28071845553e516feea72585fa8237b7d06372ab9e291ea8467a70e6a21ca6e130e08a9c904cc76364820ff05ff01c1374adef0752c4ce81f25dee37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e172ec179cdac481d0d884fb26a2106c
SHA1169c47c9dd4077e32398d6ff9fbf43a843cb7c02
SHA256bb44823733b3f6aeca2488ff91a09abbbca3fb1fcdd8343d09f597293d759c88
SHA5123d88763398cfcb107fbc6e3ab80c90abe4b9d33a51b668b5d7f97cc895ac2d1e4d0ba31d37284353445611131291c8b3d08a1951c4e4d0077cede372ce28f92f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5575a54246bb00c3396e59db963731b82
SHA150f68e81657fa14016f0cc77f7eabd326c5b6bad
SHA256b8128fd536a1c25a2bb8ba6f90822bc2440ad99006cc6b7f1559d8b4f68aa636
SHA5125c40d6271433823b2962c0b0c21183ba98934166611975ded68863c2c64bccb29ece409922d0454c2bd23682cf20b66443885c66039651bd3a9e8d18bb5e823f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a78bfd8e12547e88c1d147d3fbb8ba6
SHA171b73244810dccfc36b06a3874c599a864b379a9
SHA2560d6f4693a455bc7dba6da1f4a92a0024c486f76016885d78a59d825691a5b587
SHA5126ba5fb53cd304abcf3e0301d5aa32eb0fa22358f88160b19539d3f0afd039a412993500bbac74c1d914b712f50c7707d6661c37cc4ab34943305446b646c641c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523d896e804b5e3fb046c437ef17ee75f
SHA15a3c202a97746037ee1c0696feed2b86f5a0488c
SHA256e5ed86a92c8c0dd8df644ad5fcde572f49d7bfe663419060a0376224df291a1f
SHA5128b55c02608b62c27a03816fdd8f9449b98f37d1689cd327e6265bb9cb0db378dc0bfc972e64108d522ae6f7864059987b419e30531e48d106e5893874477fb3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5179f41228fe54dff717351daa6a1fdfb
SHA1f400c0da548407b1aded9edebed08d6ab500c402
SHA256cfe8123c05f9bb2dccdb40d7972638968cd565534085cf2da14dc5f58eb6b38a
SHA5121360777f412c01b629e8f7bbed226d02db9e4a80613b8124280c6f5679c53a382e80ad008fc137bb1d31005dc5ad65cc4edaa58d2a980721e6ce3448a349e55d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c51d0b5c8d69bf1a50e57387576337e6
SHA1f659d8c56b912b3652848e93a390dfa6fe312578
SHA256a3f729a936411c66fc67c97aa95e0ebefd697ed609836ea355e055bd930191ab
SHA5129b0b8e172de102d6cf037d8bb0dcae8989dd87982e0fba794212f9905bec1f63c495af2e86cf5b00f2103e4bf9f0d1b39ec4576d6434bb7b578691f70b04e1c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a367ac8ed8c764fe39dd68d06c771bf7
SHA1235674bca11a90ba927b75efe2403c9aaab9d047
SHA2562603d1c270ef6698e6931b4553cb3f2fba031c7bfb860c84e6b343993e6557be
SHA5126db7f6bf5578217b5d98598027044a941da4a98fec195463f3efed6e4bc0e66cb420755a378cb69568d58dec9418888cdd7d561e0032bda55dd1bcc7829c4a6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5153ca1b0cd9648e0ade208cd86733ebd
SHA1e25214cb05dc5b5af7c866f6e53eb479fd5ede18
SHA256a98dd5e5f5cdba6c5bbe403ae06bf2384c96ab4ec9c675a62ccbb6e152b78e65
SHA51298772024b1dee32b05d61eff25da81800d88b0bdf54a8c2477f42cc7c7fc14e92e9efb207ef4240064d28dec60e59467f834055ac8187e309cfb9c0cc603075b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06