Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
176d235f8c31c44d68315b2df20d4edd.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
176d235f8c31c44d68315b2df20d4edd.html
Resource
win10v2004-20231215-en
General
-
Target
176d235f8c31c44d68315b2df20d4edd.html
-
Size
53KB
-
MD5
176d235f8c31c44d68315b2df20d4edd
-
SHA1
4f3c6ac7f42830448b4daa26d20ba3fa31b0fe90
-
SHA256
e9070e219f733fef47a3369b49d88b82163f676d940b6e5a62933287043c81be
-
SHA512
90a45fed9cad79ad10c48957205faa0082a4576bb2b65e297a9aad774b98119bf11f158fe3d2803d53975b1e3d2a1d00205aa477dc7860352375a155827bd0ae
-
SSDEEP
1536:CkgUiIakTqGivi+PyUNrunlY6o63Nj+q5VyvR0w2AzTICbbtob8/t9M/dNwIUED9:CkgUiIakTqGivi+PyUNrunlY6o63Nj+i
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000078be1ca0f1552543ac69b80f49c01a896fce566c7768f248b211b67deb7de2f7000000000e8000000002000020000000bcce169e0cba65cc82c3dc9af8c98283eddb0f74d53c1fce0ab62060174a230b200000005fba567e07180d61ce620d775f7e46efeff6644f20a050953d334d41efbc41d140000000751e6ad4e571dc5109622a0002644c58784472b521cbcd610c7bd6dcb3e1572f8be314037537a6b9c8bd8157f7fecf1f2b467b890a9e6604e9067b0129215899 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e1539ba850af47404d5af10bbdde4e7c04a787c5293a639cc73b8ddd84af02a1000000000e800000000200002000000005b6dbd2c1430d3047fbdbb2c5d2f0feb326a4a97be8d16ad36e6915efd5db7e900000003b3cd235f942bfa9e33b8a9744c745b76d08bf91b3892a854307059d8a8a87227367f9b23b785ad3356bfb94f4fc9803a5c9ca3a956b12514ee9cc803c767eddaee12e3cbebf7509072e2b39963850ec73c77f8f214d2b1b10e7682c1eb168396f084bdf2cd0df9ab84430add3e5df8305284d8d85ee4dda3bbf0df7a2356e937493ae2bdd9ab7e008c4f2b34f6604e240000000708ca34b852b824998311a9ee483166ddc83f1a1691031c6ce7aa086c099e937a470dc00b28d474ff4c312a4c67714163b3f7a9fa5be5daa2d4131b86f48064b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4F657911-A388-11EE-A2F4-4AE60EE50717} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 100caa4f9537da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409713509" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2884 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2884 iexplore.exe 2884 iexplore.exe 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2884 wrote to memory of 2740 2884 iexplore.exe 28 PID 2884 wrote to memory of 2740 2884 iexplore.exe 28 PID 2884 wrote to memory of 2740 2884 iexplore.exe 28 PID 2884 wrote to memory of 2740 2884 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\176d235f8c31c44d68315b2df20d4edd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2884 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a755a41c38230ca75e8a40a708b201b
SHA10baf251b7999d868203a96905dbe7f1865da4e3f
SHA2568f2e76600dd6ec45cd05fa8840d6f2c78ce79ceb7415108de202a308ab16f480
SHA512881bb661873cd046d3fcbc5d79235eff7209c8200833d18ff55b86231eca2db678b6207ffd0452d556305ba75129fcfb4abe8cafd5e1345f1cb5b16ae10fa4c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1cf6631b6e2ebb30f85d1eda4895d68
SHA11d701f934bd7cdd73038b4d511c1fdde685856ce
SHA256d02723e9624f348a6832e60d80f750f52d897a0ba530a3dc7dc70a98357f2300
SHA51206159014ee1f66211470ce4d161c74ce17545787e97bcef69e2278c9df1ea47ccb4c64a62ac3c6145b2e7732ea64b0619add040fd2ab1bbe42da9df0ec6897bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd2da96de0b80a1d4cda85d32f320baa
SHA16470b4e38ec274e1fba0f3bfdffb17bf48076fb4
SHA256fe312dabdc6e75a74bc0fd8d27df70dbb0cd3145d206b344c3001f27dea34ba9
SHA512c762e006ff7428a329fab0eec7e063de488721840bacbd85ef99bfb6ab4731120b6684f8d8bbb0c3219ebb2c63ab4592278a2fde67372824288f3c19d2b6e889
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfef7d8390753a1d42cc7144b5801b78
SHA1da538f7f1ea6792e43f5e551a077d218c5b7409c
SHA256a80ab37857a275465c20cb2beff4f3b3d6df1c0b43368a055449b1201c8c6904
SHA512ccafc679281573b3b12deceea9e178d633749901c9f8cf88988ef61d27ab0015ea488f36608c641d00ef69f30c20cbf99ab978a14689fb51debe9ed1a2f3889a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe4b21c28d216a0f3d0fb7ee7569217d
SHA1885db3e58f7338173ea1540814b2aeb19d0a5191
SHA256bca44baf9a971e68a35a8adb6ee7f40e376e8340c2638b886435036a5a7a8055
SHA512114c319e4fd76b4d43a71c972de9648907a50a5bb87416362a50ce89fdec1ff38f2d35a9fdd4b7b5702d3154342c0e30494acba311ce891fe2ea7d94d11c6a25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543bb9a68fa86b664a460893d4e688292
SHA1c6d83b0dcb0ffe915b634afd826479a98f712c5a
SHA2568966f094cf4c6a3f31362b687eeb4751cc95a6e0681d7b56e8d464e064cb7382
SHA51229d1fdc9a4c48f1ddac31054ee7d513c9b30df9745b3bdaa37bf1be73162ade845829b07b9c24cacca54eea4cc382f325e7ac299f5a76cf2e5aa981b76140410
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdbf67b5b83d9294be994d909d1b7ed4
SHA1264c29d01a9280d2fdb7a17e8b6871c08fcccf57
SHA2568c6920d7d3f5c69e460bfa99853f1570fcbf292d308e16c6287d106a70a1b89d
SHA512ad954a14e763c9aea505ba83f7b93a971b3499bda2df2807a6111d219bfa77136f4bf15c32a653597ba33744c1af2bad355dc8cc7be2e36a2a8dd83cd8153b7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520f156ec3f32d4b80fac1891aa7d1251
SHA16be5ab3979cf1e383abed36be941bcd9bca763ea
SHA256df2c97cad94fa745767f043cb70f1e6f6e9c28557dc19c7d4344c45bf99a57b0
SHA51276168b8a1acbfc6a3600aee5a48ab587064b8bf807a8eea88af45d3f0c30593cba6c1fa4397a980822bd5edb444837741f255a454642030eb612e47df0fbe60e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5803ed47d215c3a030f602f71240a2141
SHA10be638d3a796c0c53da93db1a88fb98387e4a204
SHA256dd74e12b89668fcef100f0504b10efa25d1febc0848cbdc882b42af93c0f7796
SHA51252e5a7481b0c573ac1d67b0c11ee8d82dd761408d771aa97a79a370c6e8cd9074b6938dce3feb6fbab50c7506b42fbee25cbdac635ace101b32243a3caa7aeee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e939e7dfe155ada4add4b702d3c3ff9
SHA1213090513c75541b5d8399c2dc633efab13ee408
SHA256203d97d929fe1685984eaa5f418c2579ec35fc5137280be6c393dbc7c2758247
SHA51290eeeaf6c31b1b0c9b8a0012949c775e08aa46a3d062877842f1e8e946b58751e866ae05c108e3d51c50bfa7d81a5b3fe9c836e3c004f4a5edcfdd04b5250cd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5083bd5035ac0c6352386af92461c347b
SHA14635f756daa16b1ae95e554cf7538910d460d34d
SHA25684de678bbb0636970938fe26eb0e8ba75bb2845d76066093823880b2e2524ae0
SHA5124e3a72cce0ef6361b8a3d7ce3aab709eb5bf5271f0444d888c058ba424e8b0ccc68ff159eb6b77b9b267654672de8448140db352b8823b029b9fafb533ab5e08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5675892360242954d106fb0140dd9ddd9
SHA1fc9704fce07faea75d54dc3e0ff2063e8c6d6581
SHA2568046ec6582a111989fbee99ca4861839e7d542aba33f5bc9e28b493e3c53af5f
SHA512ab4049e0c1f42f4853be0bcb4bba3ea995a6b0f7161816f81e77318f1d660693bc5c335a5d5cc6359d73a7f823be64633d5843352c6f104676dec7d12b05d12b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f82b0e039aa832895c1f4d92b4921a6d
SHA1c7261c5efc1ce799aefff6d51a8e1306abca2bd2
SHA256e4cddab265b251d1d18b3686e15e4b2519f405036ebf05d3eb05af96f947fd5a
SHA512b52230ec310a9c78e52ce49f33c60d7b8034585f1ad33ef9163124e9731a8df0b1746b97adbe2ea920e22371c48417d0085fef85d967305faaa37cc31d45547d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6840b0b8790c73e6b588f34ebb0031f
SHA14c26c17449ebb88488bd4138e8218743ccd1384e
SHA256738ceb9100af52597dd34b1ee4f9d2c1ac1e713771149f27c3e11c431e004d19
SHA512b20373ed7121d6498194a764b3377ea7f2cb10dca6590ef4f4961322e49ff1fa63b9a7ac10e8ad47bed8d67bbdac31d269632bed2b5edd972ee16a44202903c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06