Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
239s -
max time network
263s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 18:54
Static task
static1
Behavioral task
behavioral1
Sample
36000647114e408da6d5380e7b28ad79.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
36000647114e408da6d5380e7b28ad79.html
Resource
win10v2004-20231215-en
General
-
Target
36000647114e408da6d5380e7b28ad79.html
-
Size
53KB
-
MD5
36000647114e408da6d5380e7b28ad79
-
SHA1
93430c2d02dead8f0a9336d4fce8c7305d88eac6
-
SHA256
e43634402c4835f72d39f1c2f264e7b67c0a42322866ad005fd31f5ccdfe43d3
-
SHA512
c59ecc66f60f1ceac66063f4b5dda58c6b9658d11e581bbac5be87b80e08f011e6fca92234c0c01ff5ea89ada45d0eeda48208d99c0467aca125619da7c19257
-
SSDEEP
1536:CkgUiIakTqGivi+PyUlrunlYZ63Nj+q5VyvR0w2AzTICbbBom/t9M/dNwIUEDmDd:CkgUiIakTqGivi+PyUlrunlYZ63Nj+qK
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A66D6D10-A614-11EE-82B3-FA7D6BB1EAA3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000034977ad9856ba58fc456ff2470953edb77665a62f2469d9804361a164a520c97000000000e8000000002000020000000273ddc69f40f3d0aeecb732fa58b9224e9c2b0c62a0e9836dd5ccfbd272a51e0200000005288cb89bd59945e16b4d0851d5c7c4000715512eadab082176aededc302b0954000000086a9ed99113922f7f02d534116ceb0250ad63da010becc652972dbdbe50fa5ca4c6c3a0c709eee6e0ddb133c3290b1897fa4a92f1e85a77cb3cda75b407d5f38 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 001efda2213ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409993689" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000b5262e358fbad96aae8ecb0c69bb366bf69e1257e0e09a72dabe174cc1afbd90000000000e80000000020000200000006e429f4b9bd81bdaf17cecd57b92d32bb442043036b75336231fcba79ae3ec1190000000eeea71b2734880195abbe1029aa8d0dc37162bcf1a6fee04e8dc31dddaa03aaa804f102875fe71c83a585d307fc17cc4ff594a0b4199d5fd6424ecb8ea02a1d0fe5b55de5b4ba377bb82dba00b30c1ef301894d93828f19d26d00d1e315392a406af60e94dce4e3998e69e1cd84e68cf286e5f8fcb9af068ff7d2d7da324c3fc91a7ee777eecbf29ccade25333b48e084000000036b938e305ba8ec9fc1bcaeb02bd0dbf7ccb7d20efd8cbd02d6e6e556f095f8c1830e6324d0741a4b69ae9a03e827615498a6bf50f2ed3d3fc089eeba128f8ac iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2852 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2852 iexplore.exe 2852 iexplore.exe 668 IEXPLORE.EXE 668 IEXPLORE.EXE 668 IEXPLORE.EXE 668 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2852 wrote to memory of 668 2852 iexplore.exe 28 PID 2852 wrote to memory of 668 2852 iexplore.exe 28 PID 2852 wrote to memory of 668 2852 iexplore.exe 28 PID 2852 wrote to memory of 668 2852 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36000647114e408da6d5380e7b28ad79.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:668
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565708725c402b1c1e28b044ee492a5d6
SHA1a66a614180c0b83b851fbc1afbefd53641b7c551
SHA25616ce07c662f2557a2db96f945668e6c3bbdb327a207dd865f470c8c34d441fb6
SHA51217dbb8356d75bdae9f7dbd562ef99cf2ff9ac299b0d6d9bea50e45c0c3d200f27005227c7495c1543e8b1b5c033ff00f1bc3d9c540e339606739afd5d52de0de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519c39b313aa01ab976b84c7c56fcbc77
SHA17dd7f6ab3c0933a606dd525e487cf61829b39679
SHA256f167e116012a57be6c52b59577834c2bab89993f2b92259e40cfb3484da02e3a
SHA5129016358669cae2bb43e6dae9a795ba5aa4ff81f2e24b035bbcd4c948450506862601b8b27e5e7cd727b9bee07747c0f57636307a67e12ecb68ac246fdfedfcac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe2a89f79febeabb051a559247126753
SHA1e4a8ee702096506b70aeedbd31256c91a63db13a
SHA2563137e16d4b103cba61ffc0c688a683972468baddc97d4e920eb76e5b55fc90df
SHA5120af4fe5e453940d315a66860871cf08f6ff2075a712bc57ad083df4db1ee9b5c6a03e21b2897f58348e1c54cc758eb84f2aee4a7bc4862b7610d6d2d0c8e420e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538fa6de37b98ede012c9d21e1fd8014c
SHA1ac8384e2e7716a6babcac71a113af72807fe6b0d
SHA256192869e12c5309656b10dee9adfe7dd0d83c5f6a738988903baaf27131563a7e
SHA5120d4872ace6bd3c4e7f2f1ca5674c69a930c4021662418867adc55ac3286d12531b9452e918e43e019fc9c619c81bf1c5d1fd24091ce1b61249fff0a2b7ab00e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550e854f0aeab02edbd5125a4b9d3a13a
SHA1486e38d99e1b431cde36cf16cce7db9bc9338ba4
SHA2565a890e21cfc66c02874b873e72590891f66eae5cc0028594047116ad67dc1eec
SHA512ded1de8ca86d1e094c6a1519185a06e9a3e62a929ab552acf045ec7596072c30e274da99bf7ea4200b7856eb745e8db67c58558e835edfdb3ce14f41b43fa414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c82c482405f0bafc2c037860eb33cdc1
SHA13893bcd208f248dfafcf665519968b256c131596
SHA2564130df7dccba280ae9a4cacc1d803d3b099e89ac5218cf31c84d92d5f348b5dd
SHA512403a0b98f0c5ac49a8c7be7e63dc23180645307fb2191aa166a782248f04b5ca64ef1ada99f77b85f4955e5503a23af3e82f7b5d7a5e50af585a8202d017b6d2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a8a6cd440982a507796d6b5d45bd084
SHA162b13ab64079aeb56bc32aad8c60e2678f9f4af0
SHA2561ddfe1520d5833cd9af5f080c0b5d5de2ea230634e55382497fc819a239934de
SHA51250672b972cd66e6a47f1d03e795fe449bfdb9934d351ddc300ab695a7045eff82c4003630e64560afc357183b0ca38337d6d9c7014daa797d89ab27d363becb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564beb42bb3bfb318e9634bdbc6be1f2a
SHA16a8e686aef3fc08bfa0012e132e25d61ddcbec48
SHA25664452661bd05c3ede34edf99ad56f6398c27fe394937740c55840368d0331e58
SHA51270ac8f8497fb84ce905fee6e7f06f70428ab1414361eb20d52e9e0855793f11b234635f3612f19721d0a1f0a53ecc83558ca36138ba94afdc655f6f361fc5d83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514b35f308c744e95777d1e0b8e3a61a6
SHA17776ce7e935dbe462837178def5c4976466eacbd
SHA2569ab078d0dbd0bd901cd7f298279091c792f796fa16b29d5aa2432a082ae80f3a
SHA512b36157ff9304af5a44e7fe2b31aa3c928659c669a8376d22c4b5c8ed00d60320817ddf0f6c52e0f7a5ef1e0ec14a7f8a3c1a1397b2b1949f0b1b733b6d9d3b4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e46e216b19a3ef2be83fb0b768471b1
SHA1dd5290cd60ac12471b746686a1e36ead6cfab9f4
SHA256aa4793d9676b548c802817faec9269aa2d1592801d556aac6f99b97c6431f4fd
SHA51285a9d508f7eec76f5bb31d183a3c458209320d75f9bef170f64b98ce3668ded21634c645d3164d90fd7cedc49f0b1764ed8602f7bdd1cb03c05c59930c867b4d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\upshrink[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06