Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
199s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:42
Static task
static1
Behavioral task
behavioral1
Sample
180d8ef3148bdeb74fe28dc9ae4eaa8f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
180d8ef3148bdeb74fe28dc9ae4eaa8f.html
Resource
win10v2004-20231215-en
General
-
Target
180d8ef3148bdeb74fe28dc9ae4eaa8f.html
-
Size
4KB
-
MD5
180d8ef3148bdeb74fe28dc9ae4eaa8f
-
SHA1
8aeb632b90844b677403153b543726e85df4579d
-
SHA256
fe2830867ed96e98945271bf488f3bf7f51164a1d5b5b2a737b62404160fdab2
-
SHA512
af94a86195cf62cc1a3b0688617fbe3c14f4cbe0b8f38480c56d1ddeef16e07b8c3066b9b2f4abcfa89b0b56eef4dbd90d958196d307af939aacfaa0caea8fbb
-
SSDEEP
96:ZWXGt22yDf4abXGt25FSZBtKIoRlCRlLGwxGctaZF:4XGo3rBbXGo+08GwQctm
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000bd2381a31ba3413e12ba8905df65e38f60e8aaa923ba5cd289971768735ec6b8000000000e8000000002000020000000a1694849c1d3b726932317ce250753e1627cda25e2bb0e431dbf0fec4bac9386900000003a4b2aff9bd2f044475a016548fb1a3555c60e2aa21ee781a4555565b7886c76c322600229a30f74eff40d121603d32441eb5afa22af7930fc12abdd465a3d377509a3280b3a2eee0ca738a2d546c5d7e45feb96563453741715601ac00a2557783e115270358a109aa6658a601c1a359fba7c8c044b52b32852ffdd4f96cb8d7ff84bf2737f07f6042a2a62128a620a40000000278f213351c607871072f20977f6aa3b5fed23aab94b00d1e205c115d9698f4c449d3b5cf8b4c7373bddf3591376c610b097f96b0431e39f9865d6d01feee6b3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409885136" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000314f3b02e7e97cdac8f8b9375ee642c5f339d7d61561a1722e9b9f76415e4ef2000000000e800000000200002000000061d51a95af45d5fb17008f2d5f85021329af571886f6f9461ae9b1114950d04c20000000f5b551a095aca8c4f7d160641d43ba5b23a01fb59c56ffcefb3cab3acf5f635a4000000025b2039d249c314522480c256d63f77307ceb8f376b0ffb0e42e2a60fa0e4d04e32a32cecb37b9cb093e3c2d6a99da71891ff51ec9c79fae8fed0b4a678ec3c7 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dbd2c42439da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E0B68951-A517-11EE-A1AA-6E3D54FB2439} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2724 iexplore.exe 2724 iexplore.exe 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE 2272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2272 2724 iexplore.exe 30 PID 2724 wrote to memory of 2272 2724 iexplore.exe 30 PID 2724 wrote to memory of 2272 2724 iexplore.exe 30 PID 2724 wrote to memory of 2272 2724 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\180d8ef3148bdeb74fe28dc9ae4eaa8f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54822b8d8a82c49088dd88ccf2b5e5471
SHA1837bdd54ffbd6098fe0e2731983772c185e123ff
SHA2565459781ea9c65ff3bf492dab7955965416a3b0ccc36953ccfa5ceb7da5178d0b
SHA512d45ee9d23ce2bcea68ea829d1cedbaa2b83ed64a31fe7280911aeec293222bcc235610f22c8c86d7474cbe6d359859ee3a46d8f25a6bf7a815a4cc52bfcdcf7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5678c9f5c2f469533d45bd4841b2e3b89
SHA1849fd0829f5f92593b9e4eaeb607dd56d22ac0d7
SHA2561c55e68bfd3d4e44f942de784e8700c1796a7fce04efd76445a2a685d5b6138d
SHA51221427163928ee23b2dedc86871a89a28b051f3f9668bf5f065add10c7e8ff2e400ce2b962faa24e885cf8cb11f50433d1410265fb0702fe1b91173e92df1af1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551f9f8c7f5d77b7efb122a051742f364
SHA1eab75869ddc8eee351f850b7d3d63ed4fdce6f11
SHA25607c755ae86cf78f53e0ff4f0842529871c57bd86565c5b9caa9546f12047a95b
SHA5124b7e76993b427e3f4a245cef888090bf6985e5d314e1e4d2617e007648c58461a6cbbfe19f22aa81f1f670cc6e6fc7b2b322246fa5cb3bc62d4153ffe3eb19f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a1911ef5add0ac6b330e0263047be1
SHA1119528cb67ba1662ed2a2f0382fb2d7e25ca23ab
SHA2568c1a0d49e4b7b1d03708e4d7c1499098db93ace86ba8b0ce3ca7e3f421eb9163
SHA5121995d432f920679d87604db377bf8b180080608a946ce8cef805bf2ce7f4253cccfced487849943301f2000e002a6ed17f013fdaca2a08c97bbfcdc3fdf93868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b28612dd7f5ceb1368d6794711d032db
SHA162f4f0ddaebff6d01a7f8901649e0dc0ba3fb098
SHA256d63cd3fcef572d12edee5d122a9764722dc476a2e8b97b3fb75fcbcd6c320d88
SHA512ce10e561cd03db73a1c924aa14b4d5e5ea9ef1a9ee4b78b0cbc134b953596d043f53e15b4ea343de6523fe6e12a0ed64ef2bc7132d3c37294d1ed161020e6aed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdcfc8976f76c21822db8bcd4c4e3b64
SHA113c86bf6663b4aba7d2756732b35775f82dea2e0
SHA2566665f2870811dc26d258500d385de5cc3e8a0155a565ffe0d1a1ded759775292
SHA51273b1dadf46f5eb8da750ceb7a7140a50acb1a9c709242e7fc3ea01fbfc9e11d47e6e0de85c768d0c219ef80db0f4862e8f53219391cff9998c786edf9b15129e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06