Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:49
Static task
static1
Behavioral task
behavioral1
Sample
1870dc88522b7d1c3818741aaeb85cec.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1870dc88522b7d1c3818741aaeb85cec.html
Resource
win10v2004-20231215-en
General
-
Target
1870dc88522b7d1c3818741aaeb85cec.html
-
Size
6KB
-
MD5
1870dc88522b7d1c3818741aaeb85cec
-
SHA1
8eeb142af43c433856267fff185a516c9b35cd9e
-
SHA256
e2ba22e2bfcdffe7ac229b8f0fac5feb5c421a9b9cbfaf0ac6a1b36ff3408677
-
SHA512
553e341b0fb06cc1489dfbd7efc9f4085a3534d72efe05f5bf7ba0a150958a92f9bb000a6bbb06f57c4b82a6aa2f2563aa763870ecafbe783d9e70a9450e8381
-
SSDEEP
96:SI3iu8IMYXKjl63GL4X9NH7tIm6DTIBDD4HsfuyxCDeD4XKQrgFf1Gj2wve9W:SI3ibA6oljGmNvfu046uw1aPveg
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000cb8e1bd225530b8719533e7f5177f8fb8408241d5b1f3b888924af62f9af199c000000000e800000000200002000000070e726881c93131a3c3d668c1d07b23b89e30f28e1c5d2dc0d98eecf988f8c8120000000ef8aaca8db72a121e2d715f8268eaf207e5d7b643178eae300fc98f20f55347540000000bb7978cfb5300ebc44c09b67df05c0b2079db9e2a713684c2fb9e506413b69493e786b9e935e9ab506b69100e23243a76545143dae90d282afe6e8ee353b3d9f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000023224f6ead951bad3661c28383b23785fc99dff702c6242d3a8dd6fd56f896c8000000000e80000000020000200000009ed20dde3885521d5e84c0913650c0099412162dd5e9826c0d28197dff7f4f74900000003c2656e25c69c171e16904d271f966a77c51dea08d9e402bab4d108777713c2552c22693f245072a1836b498a71d406d6c36ce5106b613e7a03d2cfc761c9b68a7a99d46723b2e4aae50e97c58cf4958013d3efa2ef45dc9c38251c499bfc9d4d4bb2effa86c360f48ecd0d913cf42903fc670d898c7ed38ecfc83f0903b2d09f9b7e5d4235e4966d58f09fd4db4fb9640000000a3e8f140d050283f35aed4b20fa48f9f619243b8733038b890e7d41ae0309dd553a807a5a4cfc90a499779e8bf8a9c9502831b38d6f29cc7391f89fb74676630 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{36D7E291-A51B-11EE-8568-DED0D00124D2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886574" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f26e2a2839da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2580 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2580 iexplore.exe 2580 iexplore.exe 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE 2276 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2276 2580 iexplore.exe 28 PID 2580 wrote to memory of 2276 2580 iexplore.exe 28 PID 2580 wrote to memory of 2276 2580 iexplore.exe 28 PID 2580 wrote to memory of 2276 2580 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1870dc88522b7d1c3818741aaeb85cec.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2580 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2276
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503b1b742371a385607dd9995c32ec056
SHA1cdd23a482dba0583babb102529e7cb2d1a231b25
SHA25644d4ab523efb9b1fa525f150d7881dd75eb6a4f4daeb2e2f487331323eaae940
SHA51213f2a179078e7b175f16b5b9fecd80c91464a086a0915708f39a46588ae794c2fb8bf883cef2d35d966d051932d0810ffb404436f2e54dda0df5a6a07219a0f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d5a71bde0e7d54719c5adffc37ea4ae
SHA1d4d507cdb82d710e9a7cf5c6db14c270fa86dd28
SHA256e4e52c3117857585803be3fe1fea02758685c6e6d66ee072febb9dd4df70e983
SHA51285a500b1609bc3f5491145738be9898bb118f8949e112540336c1889a067ef92edfc97900617c984d0c3c17a8b8527bc8af98adcb05cbfc3779a00ee0edca679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56adce0171af54ca29f92efa9280b1f2d
SHA19b78b49c18e58d4ae7c50329d6805612b9f573b9
SHA25647e4654b9fd59ad4de7c2d54a7f6f534f495660acd91dabb543dfa0e209260f5
SHA512f512f3a42d2a8db83ab346d5eb7cfa3ff168706d3003901ff46c953ca098b2fe0800aae14ad74a9111fe3cb7126c57f46a763654a41256c2e65211defa1d3ed6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db4f7c6943f2a993725ba1b66f9f9355
SHA12c8fe257e8e111b1e674fd442b3c55c1cdb5e890
SHA256c85d3a3822bedecf841cd842a418b9cb9685e1a370e3c4790be9a9edeb882082
SHA512bbc47d2cc9e18439ce4608801b2d7a118fb198e6be48dd5deab7d10b90ef25a2d9668ae7cbc8709b88cc43871a20d36c1a66b550b365c8ba92b56392dbdaf619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dee3985ce1687a9e21ef7e31107a4f35
SHA1d20f1ab0e5ccffa78eb4e6ae0085a31aa12c1e5a
SHA2565cafab493445c8aa54104cb3308d477ab3774455383cb38fc574b97f25e28c50
SHA5126bf1777540bf0fc95bfdcbe4185e60c0fbf3e4af00849ed135cfae4adceb16b541db3f101b0a1e371cc841c16b6ff83f37b05fee3beee014d592d97e5c16734d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580dfdf57d082e16059b875c6dae29a8d
SHA1051418269113068a07d9864aa7768d58c37c8a94
SHA2568602ed4ce3a6a8769a26462ef106bdaeee4749bac01afb5bf2469f1bfc35da59
SHA512c853a0eea537688ae27b2b4d984c25929686f1e7056a5ff569052ade019b8d0a28d654214dfe5f9ceaf3baa01a524383fed24dd298eee180956f7633b493ec56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea7283fd35cbb78e3de09820d8816a95
SHA1be98e8ef5dea56a3834cb39d17e9d91899a3ec66
SHA25609860b6bff48f5f5e9d010fe5c78e287434ba03d020290d92fc3a27950393fab
SHA5121ffbc21325cd4ccf2040a5797f64b7cecd723ccf2149b94ede6f15fcbeb28d0225eca7c3ef3039980e591528a5a158f3ab6b5fd12a2aed565794afa0eb24c036
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547eaac887529dd7beee74b4e86264358
SHA1ea2722b9a001e579706709b6d9cd55e1219ce3c4
SHA25625eb1b59662e7be0f0c3a7c62d7b980ab054176c9b0a7aaa93c790c60bb04fc7
SHA5120081c5d463f735afec37a1fee90c5c964b278400bd40eb0a75980df36cf974e06e192564255c78e4b6aaa1fb02fd9297d373923f23921397bcd1f9db54619bce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b410cc9bddb9fe26a7cfbeed44471341
SHA118d4198c140591879a57578eb04c06bae670e49b
SHA25661cf2a94ef1bfdc49814fa5a4e977a9b853d00f47305ecece031a2673290dc07
SHA51217ccc9a9ee8e51c976cb52acb3254bc4cf8201e4a18e4055972ec0b32bb2d576f1359a93f501c78349bd0c093ad29ed7ad1c7fd34738b9dbe97282c586bada8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da90e3a003a2a98282c6acf8460b3a46
SHA1ffc81d4298203c0643c1a5bb5a19c5764550f97d
SHA256d78c63757defd28e27fceb059be971dea69cb3488a8d8a20178afb38971c6e20
SHA512c6b6b11201b3201c121ccebcfe02eea1800e4680bd3dd145a3421595fb1cb33c2f5d5855ade9fdfaffb66c55a1630b76910aba1661a8fab5f09805709b68d045
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db35641edf39bd83458008b2e6644ed6
SHA1fc759c40d0d69600a483f1a018339ce536f00ce3
SHA256c6a08f46c8cbd6cbd231131e270728f8fd6511c7b98a466cf2bc797b93fcd446
SHA512d60636c92c4d774d6b14e6fdf5c7ba10331bb82c89062c6c5d12585420749b8e99817ff8ed813d3dee5bcf4d9cbc6369207bc7c14754f143946f1dda25b6cfea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5274cff70ce76fa1eaf8509014d1668d1
SHA15953cc0cf7b161bbf1241f38fbece33dfd761e1f
SHA256c25e8eae493fdae1dcac05d68b29a5777e268e2e53c063bc2d64c0f0d2880a6a
SHA5129014d08bd87d5c3a9ce52df2fb3046c2d55917ec93ecdd12cc3f6529599fb3f703378f0020bc4eb8d8bbba939bf0eeb6e00578f3130138d439f8e7f704fc0465
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06