Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
186567d838a081d4cee0e9b0b76bc3c6.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
186567d838a081d4cee0e9b0b76bc3c6.html
Resource
win10v2004-20231215-en
General
-
Target
186567d838a081d4cee0e9b0b76bc3c6.html
-
Size
12KB
-
MD5
186567d838a081d4cee0e9b0b76bc3c6
-
SHA1
467b1d089aeced22c5b8f1cc8fd38fc8552349bf
-
SHA256
dacd740d670c0d63764ebeef35d4f2952e46703606f5989c49ae7d0f4e45da81
-
SHA512
83b582b5e0da5bf8b6b4c4d72c3e31c82ab863611389b7b47bc91b35daad3b0eae4f3f5625569be1003cc779ba04499eb8738a49b361ab76fc5d2b023fa41b75
-
SSDEEP
384:16qyyTib0ld6rTyv6Rb+nQKrlibQmYMH/pMF1E:+GgyvCAdhi8yfpe1E
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e031f1c42739da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a300d78f0bf27ef4f4ee13298faa728ce75cd660a2a11906a0ca9bb31a25ba52000000000e80000000020000200000004260a2302be05580a4680429a4f91947509ecf2c5d31f32a21e1095bf70df6889000000016f242b20ec1dfd5d7bc6f7f69e4266cede15041a9394a5c7a1d9c060f0ad1725483fa8f2ea2619580990f4cecd7f2046636fe41d057e44c0881dcbba7d197c3e84be71f87d8330426eff5e04bb5ea0dd383139754b215c9e22f2f9a97f6acf804be344169b75320ea06d3d9fffc153bebfaf94be5d5da6aa37e0497e04963f52236e36269e24530a08f737d0648954d4000000009ab69eced0fbe105489d6df5f358e10d46120f6e3e8db937ad01edaf364d319c5e37a21801657d508e54c8bf4ad4c70c24b3ddf0194dc03f00ee21d19a17373 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{EF843601-A51A-11EE-8183-5E688C03EF37} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b763cdb3e3ca2472afadbd062e3f57d16568e8e6b59d115228e8b5b15ec114a3000000000e8000000002000020000000d896ea359e9ec0e0a192d4624c1ede6924875627ce5d9d3cbc1b6426ef8ec36b20000000f940d17cdc80b461a7a340bf3bac51e7f5e9a2a732ba590e1ad8e7912a0cd3db400000008241a454af70df4fbe3892879b5eb841324bed86c51a130a0cfc43c861e47d6f92ca84a4fbfc12867950966bc853318d9aee49183bc3c2c348d24f54685e656e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886429" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2184 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2184 iexplore.exe 2184 iexplore.exe 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE 2672 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2184 wrote to memory of 2672 2184 iexplore.exe 28 PID 2184 wrote to memory of 2672 2184 iexplore.exe 28 PID 2184 wrote to memory of 2672 2184 iexplore.exe 28 PID 2184 wrote to memory of 2672 2184 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\186567d838a081d4cee0e9b0b76bc3c6.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2184 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597d93a2c18302b5ef8413db49a2e3091
SHA1a880b2aa881204d4a4fcd6740b7aab535fb516e8
SHA25692e6db277c9ee560c66a5510342899b5c5abd08b7cf1fd570a184c76d2cc201a
SHA5128197ab9883e397fc22cc0fe16a9d3ef0f8d762d0ebb160cbf57f1b0999adff819e3f8b2965267ab37da4fd1707da8c0701b1bf4ba907684043bf2e8652c0a428
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5947009602cf0c395d9ec5c3efa8bd6e8
SHA15000bef2db9c0efc42668cb5d6a3fb6efb7c49ad
SHA256f6424030e76c50bda87acb0c21cfd51da8628b32ce81442faf60c402f14a1498
SHA51247c9f9705692519eff262be7dda65e5edc08323fc68f5e1207a6a6413076c0ed426fe2782e0d8d230d2f8c2e93c3657de7b912ae8daeae4818e477eee6acc88c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563881bfd211ac1582c2b312b74ec2c1b
SHA1633d056cb7a85b721c778947c7f537eb59b47966
SHA2563b2cbe3f0ab602015b0dff14caa27e9e76b263a9edbde5049198dada280feca0
SHA51280271cb5b1aefbdb8e1c8328b0a5f0e8dc844f57a80592475752585243c398b716fa9d3f8aa6156a8bb4e3f2050016a1bf34405ba2d210cf19025667de7070cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b1e4efa353204ba3940dabdabdc55f6
SHA16e2c4c9bfac298bf0cb92aeeb268ecf76abae384
SHA2561a42f31822b578d4e8f4c8d7ecb6d111bc84ed899cc265aeb869d61b7ce824be
SHA512f522180a96cd008a214cd8ccbc20efe3c9eee785f05de7c380762b243dfaed010616047be62d4cfd9628ec8c2fd0411e24b88020fa1c993bb79a42b6cc7dbe83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa5ed4ba2d0d2d675eee503153e903a2
SHA12e0f073edc4fe12e40c5fccba63ca8aa18c0bf2e
SHA256e48c395f626369013bf41bd5e351f9ca2362526c777d7d98eaf855d463498694
SHA51278fd1f3627210519421f1aeba84a6011a3f9cb13c3c7b4235a599dc82d2140bf8d0f5c15ab55ec49ebcc48c4f9d13f48676ac0ce97e03e7706ece29ab96605d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54685ccb25e159213e601abf2df0dc209
SHA17b1adde407744a237f864e338e0422b490a5520c
SHA2562804d2ea0a6582ee4f1d10a31aa22a136dd9560e31b93673fd57478a143fa96e
SHA51232cfb722953a047a247863814956dd74670a148d10c07ffe8ddfc6c7649ba1ae54fde8052d47a8925bc008183b239304b43f7f0639139ec4ec67c127b7f739a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddec55451616430187e376f725057921
SHA1edeb23059cd5c63ee40652652f9887640261a3b2
SHA256ae9176e95e740dec3ebb5d9c949f3286d3523d55a402416e452750f0677d3c2b
SHA512cbb870ce8268a669cb9bea7c56bc06495d00461e126606c8c6fc7f0bada8e3f552989fc39b64d83c307e294dc3eb1093c0057dbd3aa2eaf03dc57fce43844ec9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575efbc50a0eacde020f4074808bef186
SHA10b4d1ee9a94cf1be4472217a2df0d4dae905e50f
SHA2561e61505ded3f22c3452ee5cc6d114059a930406597b79f717ed3b9602ff6e84c
SHA512ce57679479afc3bba3ccd796cb98c40420074f393ebb889c0b790cfce2d2460c813b31dde5c87a128141b268427853e2b4e0eaa09bc1fea58184e61e04fc8fc4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e1c6b52093f79fee90fd91a57b79e99
SHA1ae8d3c79d75281f7e7813fb123ac3d70afcbf89e
SHA256a33131f5a8dd4faf7f08128202925f82e8a1f5a7e86b5fd1974c149b4be2b7ec
SHA512d78d65577fe4d020f3f1c79c08b246b302a97679fd9040cd544896af43acd2c96d0fe42f4d2d7aeaa94046aab0dadd8a34e3811321f208c74a843fb10af32fca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a60b9221212564f02b87abbdae8f9a7
SHA13526cb7f5974221b1cc66aa3cc05857f170fb203
SHA2562cd465db615d4a8290349fd605e02185cbace95ae7695b13edf7863eb69fd418
SHA51283af6a2bec21d6b436c5a75ad8d08092382ed7327ac313de13d460535d08b118b702134db9ca7bf3cd0cdb1e5c19a2ad925faf8297bb1d57bc2ad0a931087a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d641b1f7cfd326e14e3473df8761f79c
SHA16bd11332eba209b0e63a0c78c5ce209b0be98f23
SHA2563e65c797a29325e87bce9e64d0b33a30b60ef071ca1580bd5301b75f05661d20
SHA512d8b0ddd96e353d8713a87f659857d4eae7c8d64681fbf21b18573949beb0d3bf7cb0dd8e053cc70b5279b8efc0ae005a0e41bcb3eacc81d0569cd1862e10b6bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538917fe30bf0375d63fbfa6bd00d313b
SHA12afb4a5179418b52645e1399f449ea4d2000824c
SHA2563febb934e1d9706e2d484f3c0b9806b0c9a32188d1a3e4dfd0f6de6187cef374
SHA512b49883e7e1537ec07ebda0329fa7700878c413b3fd5c4440a7cbc6ed97997da3ef1a49e45c0c622840692beb5f6462fbc17e42802362ce90099a5e468e890101
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06