Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
238fcd0295e8e7cef850dadeea19b3ae.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
238fcd0295e8e7cef850dadeea19b3ae.html
Resource
win10v2004-20231215-en
General
-
Target
238fcd0295e8e7cef850dadeea19b3ae.html
-
Size
2KB
-
MD5
238fcd0295e8e7cef850dadeea19b3ae
-
SHA1
7323bba026360c9609b695e32b07842719a9b3aa
-
SHA256
3e0a75bb0af4f0318ad0c81e94e94f956bdddd639df6c43964d7677c28e81614
-
SHA512
85dfff94e054f2f5e67d4e809bd0cb423c1ca5c2d60cf58476a992d9967b9bcef569d4c19bec4c9b3ddb81fd27abf1464f352992e5360859a0bbb402d70f7413
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409929474" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c04bcdee8b39da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000158cc7a468db2330b5be075bd86548f87f2fbab9a34dcd6faff6542209aed503000000000e8000000002000020000000d367ef0fe43d3d3ea6b4e7381563fe3519b1846823955a76cc6d66175db4029690000000d764b9da1795200eb34ac542630125a2fdf9ce802dd52e05c96dbd35b738c6791540f6a277a29bb8148ecef47babf073141a6089db6a1f65080c6ee2b7d91906d2d5d4f72d703bb297f312b2f4418858695f39a24bd6b7dffd98044aab5ff159c82df3f8d58df3d16aa287199be1d22da3d764b4cb37f7f03f5ed5374ce2666f2f4b2d1aaac6f4455fc8f4922da94a9e40000000c040222f9cffeb29cb7caa4a1020438d89edd85be79dec9b0e6257ccb7ac7efea86480e4d0adce18a8a408784d0789201d449ed5471452db02d1709a9125ca11 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000616c7d3afcfd363829ae706015e1d471a9e590adc5eb920646a8899f9fac4826000000000e8000000002000020000000c06465378a8d013c3766fc6e6b0b9d167606ccf5057331ae4a953bdf7efc11c520000000633e0096cfbb04463ef332b2c5ac1606a002109b78f904bde8c3cead755376c1400000006c9cea6b2d2a68fc3f13fafa96fcae614eed74a62982221db264111d424cf13d952199b5ea189a2b466b92db40d865b1fceef4f57f548c7eb608f2610e639fab iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{197C24E1-A57F-11EE-BF8F-CE253106968E} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2316 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2000 iexplore.exe 2000 iexplore.exe 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE 2316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2316 2000 iexplore.exe 28 PID 2000 wrote to memory of 2316 2000 iexplore.exe 28 PID 2000 wrote to memory of 2316 2000 iexplore.exe 28 PID 2000 wrote to memory of 2316 2000 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\238fcd0295e8e7cef850dadeea19b3ae.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea28661e7258d5977b0e9535670f458e
SHA10c3f9c82b3cef5eec8f103e33434b00e24930ae9
SHA2564f4aa8a2e7df7ad93143eda6c58d983aac6f889142cbb7ea0567830af8041e55
SHA512bfba24fd6010b743673b94a23f5254259de8f9f394145e59785d17eefea14fb1a69aea01ef7cfd7b1c2210922bdcc3c7ce05bbb983635a4270e240be4c8560d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580e7483882e87708a14c2fb4e48b1d95
SHA1d8dbf3848c793d2c74af837ba8b5ea8c66d1fc69
SHA2562fef4b6c9547d82c943456ec80561b2f8556d81d1b95d8f4eff61d18dde29f91
SHA512addd88526baea14c1e4e81ce3cc925df3c66350f865e1bf5135d87a86b187b13ab574ace7caea281c431e9ae097b286bcce65df5473e74ca6bc68f4bf1239eb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f444c6017fda72e72c2263a99336c641
SHA1b6374676d7b300f0a8d6b0ba9a4d51ba8a985826
SHA256e114c3efeca0001d19e0da60b5f722e0819f2808847c99b69c3a6ddf61f18b07
SHA512e252e679cf570880880f078b8ef02c9f0b4cd3af43a7f9df3e61a557ad6ad6cfe6cf4ff15318d11f4723b71e16617e62c28136ba06a5d59f25541ae6140554bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5165073b7a1df24301338833108cd2aa8
SHA1646deb6214c35c0a73af11956c70dd09fdddedca
SHA2561744deecdbc210120a18960256e0e5b15ee90aff1b74a42ffe9028a6eb277329
SHA5127c784cec4aa75796573a27bc49a8f084dbb241fea53ff24a99900212b6d0fd9ba9f63b2e6c21242c7a7cd1adb636a314e9843e323983f0711ab8b9c6025da2b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fb8ba2163ca9a2e466e4a3c9eb90892
SHA16f266f5b462fa3b2f4cbff629d2b12ea972f5b4c
SHA256dbe06133d7d43ad3712c1462984bde21781641e856ab8dc23718f95c60b5b8c9
SHA51220add3a7bc3a376e0635a34bfd1606abc4d0b5b790a82c642e9d771dfe942a60dc1198dd843f172bb42024a1c61468aa4ecdf55adeb9de8f3d6792646810b00d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6bdc41320ac71d6820a0595f854a020
SHA16bc40da1515422ae19170412730a1e911c3433b0
SHA256e7cc712906eea1fb11e6fe98293ac2e34c811d385e2fc17b27016378d604b366
SHA512662ceb4211f6653d5dc9ec21fc51f0786682f9e902239c064787aa675c0466bf63aa852c20cc6a9a36d2329691edf5f9a0f1c13451fb86a067cccdefe1da8248
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b96b4fe637c5ab3c360ef1babc8f61f
SHA16bd054e00ef2611e86f56298fb07bfec90038470
SHA256191501502d14304686b8fc8d7ce34d739e75713a34c58f9f10f2e3e1f3941859
SHA51253a21226e1c26c717045f9e79b1688509ebb20fe233da34b1bf11e6f432926c88ca33fc18d6fb862bb48ef4256972b82047d02219ac659f0333796bbe708595c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f83ea809e1d2725405f1d0acd11c59b
SHA1ec158e9d458aea50dd852abfeb6837ee382ed00e
SHA256fa86c797d9ca39cebb219155b453dfed1fd2d4c0691400f152416b93f60b508f
SHA512813175f2bccbac264e0d0e19984af001474e0bb90cac7cb13ea6862f2397a6c4b475c3adff7cfa686cb87f50ac160b7958b3c55a8d0c607ea0cce6d8550ddd9d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06