Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
280107836d7daa0870862bd98d5a307a.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
280107836d7daa0870862bd98d5a307a.html
Resource
win10v2004-20231222-en
General
-
Target
280107836d7daa0870862bd98d5a307a.html
-
Size
19KB
-
MD5
280107836d7daa0870862bd98d5a307a
-
SHA1
8d458321ec220c84deb1d2f526be2f67dfc1a2ff
-
SHA256
dc245dd2dc023b235d00ad4ae3ddc6d57973446246ac5a4aab5e1ae5b4df9b17
-
SHA512
24813d6facda6ed7ac07bae6414c5105243e993c4b0b7464a94abcb72447d871e870ac3aa520f49744f5747d1019418c15f7156b2fa2903aa6eb1680f84ba473
-
SSDEEP
192:VQ5cVZ7oxovwLJxFzVk4ba08EFhI04YLXIMdWZSj0VuPft+yholiXj2agujLallp:e5cVZeVzmeMzMdWZSj0VuPfvdK
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E01370E1-A5A7-11EE-9CB1-72CCAFC2F3F6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000fa9e27e096fc3a38081c17b588acb2215800ce18c1285378fe0adb07588bf77c000000000e80000000020000200000003851e8a9418fe0c7b2316a95f9613e7e4b31eac67c1305bb29f61ad6446487682000000092abb2dbf2080a4a64ae669b658c1ba071cf5c60107b8addd3f91875c8459cdf4000000079387c5d81108311bfd0990db20ae83cb7c64efbfa21fa15e708b526f7c3b0c5704a154e37b28ae7120c375c89ab3d7a69d5752dc75847ecfb824d0a7021cb50 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409946967" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0dd4bb7b439da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000f82e5761c60ba7877c0832adcffd6bf6b3629b3ef88ec5d7fdea5205c3fa4cdc000000000e800000000200002000000069f832e0ab87c358c53000fae525cb759847f50c6d022e9ad168fb5e4a87165390000000cb90a75056149e8d1da39629c798b5582dfe020a351b2333dff05c155540ce7af1e12fad3f305396394e9022a6a7349ab5f81d9ecd3547a10dd3aebc20d894d1e32d573cc65f9968f1fb80130c670757a9fcec581a779cb1d8b5be4a6c1abace6f8b1b4ce5168f0f9e3373445799a70e2c2359ac94b0cb5b00f75bc46b1777bf844fb610de7ad51605a783d7a5290b3c400000000333b1fb65d066efda9d8669d74cb3ef26d8e2503a6bb6dbde0614e76f805d2c7b8a7116ff9d8baf468e21cc0e7ea18adad6d29a2c8cd5ed036a89036521e72e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2984 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2984 iexplore.exe 2984 iexplore.exe 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE 2192 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2984 wrote to memory of 2192 2984 iexplore.exe 16 PID 2984 wrote to memory of 2192 2984 iexplore.exe 16 PID 2984 wrote to memory of 2192 2984 iexplore.exe 16 PID 2984 wrote to memory of 2192 2984 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\280107836d7daa0870862bd98d5a307a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2984 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2192
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5596fdd0e4977bfeed2d5c5eb24c71628
SHA16678613d991b18bd34c606847ec35534e7366bc1
SHA25634f02fda42753cfdd2c0a67d225824040f6901434803fe162fa0eb438ab6e514
SHA512951613f9da349a521fdd8d0258e961548df68b1b9dd5ed2b6621abab99305be85058308dbe70ea1c350d8e837fb40ebd1249231e9683d3f9e8f4a40c3c4169b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf7a4120c332f4f96b5bac6b60a6cee6
SHA1bcbe8acf56bb58b5d100fc80d720aa341d1b4f64
SHA2564c095c4b178da9439714b20525246423f4fce001b5b5817632d438302a75995c
SHA512f79dc25c91bccd22ed6e72935e026abe17e718e8b06f6f7c23283a382d2d64d7f7e83c0300d7dd704361643ba1f89e472efe689329f4ca77d8dfb870c01276bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e317edde8123fa1a7967129b98beb48
SHA1196d98b3fb4327716842b940169f7c633d942d8a
SHA2564dee2642b7e505b0171fc80dc61869da9e713724adfba4b7403f0715f40ffb2d
SHA512ccc8df7e7da20abe80ded50907e57abd63b91815c386bfbe5bdc8a950f708047fbbb69db41717e7a29d2b0a6931bc7605c606b47db5fe3fbed66db56509d0268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535b7993e38bbce63da7daa9f24aef83f
SHA1d37c1158c30288147e9e64cf60b3784fcdeb788c
SHA2562f573711386172232152b06c0175b726e5e60433f2335086033165e148992b66
SHA5120859d1e2470deab5b2394dabf03ac6f16cc12bd5e8b321563614a7908f59b925ee0e5018237171cdb4a928d92d31d00230bcfbaec40740ea4e1369d39ac4b780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f96ce7dd80dc381f4e606b6e72d353be
SHA14c17f8d24332290d9184a852933661013a45fafe
SHA256706ced5fd91e44b94d83e3642082b9c5a77fa45d4522a605b871255e26cb013e
SHA512162f663954b4748d438f01590defd394da3e6fcb05e29d190eda7589d1b43524e8e125b8501223ed569292a8f43918868d7e52d1be568d252474df33ad6b36dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5772f75378f3e204d0d95ba19f3ba8bf2
SHA18ffdc602eae29dedef107992af83e4d5505e52df
SHA256821608138d53ac37a511c421f652ca19ad372ba9e7f1b48201ab84dbcd8473bb
SHA512fa4fccdedfa4143660079fbb970e38fd07b1bd3bc714020b3266d3b0c6ab04a351e57303da6ce579dda85ad526e1c2da1d7f6e34bf493756754afe45e673699e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5d64c57dcc9dc019989f16adec76250ea
SHA13d0dd9727a48bbbf7c584d7d5acbb455b6459f51
SHA256b96bb53aef1b9191de89969ee92987a72de9a3755a3881766b9d1f7625eb3475
SHA5126c7ee893323a4028ed7ffef9bec8e311b4d362e19f383228556656acc806e9638a505094a1fe5a0ed2961cedd454a0f278fefc24073d4e5f22fdd5b9b266c347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06