Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 21:24
Static task
static1
Behavioral task
behavioral1
Sample
3d56240542c966decdee78c32481b7be.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3d56240542c966decdee78c32481b7be.html
Resource
win10v2004-20231215-en
General
-
Target
3d56240542c966decdee78c32481b7be.html
-
Size
3.5MB
-
MD5
3d56240542c966decdee78c32481b7be
-
SHA1
fadd086e1824217088cb02a0ff15458682e21d64
-
SHA256
ed9003c0dbcc635492e0fa6d58f367185c14f7af53e9a4045000accf3b20b0c2
-
SHA512
8f3414740dfdf218f80850f979f6799ea33b72e8bce520c7657d599c24223953943fb02af4b3a50330123a20b5d82ad56b0fde8823acd37b0656af54416b64fa
-
SSDEEP
12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6Nff:ovpjte4tT6Nf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410019936" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000003c034ebafdb99aac6f290de153bba0ca4d637fde7b8ae233b692c8ce5d4de32c000000000e8000000002000020000000c82546a69facab03203acdc4935314c8bf161037472b2eeef3f70f18fcf0540c2000000049a7fe08e3de5ca9d641afceb2ae9d5a8bd2302e7c892836f4fa870199fc89c640000000f976991271b6ffe7493f04ea94e8f2c71c3833b526f46772f7934f8c47bf664672646307214bbc7beee9e05213d3bce6032b74f02ecd106689bf96d7fa9fc718 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90b3a8a35e3ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C6D166F1-A651-11EE-AE8B-76B33C18F4CF} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000008a1bc9d57ea0bb15984c3cd14a8d6ee45554e6f0649ef4189b06f8da170921c8000000000e8000000002000020000000c11d1f814032b4180c5878c582c16b688fa1580f28c0c212b918f4c8612c687c90000000cee2507c6a6ec24b11f50855398c06d16481ec97745e399df837ebc5777966ed3a6234ff3fa9d7419842c25db263198fb2aec18db020bdd55ae768db1818c25ec6724d9007db8e990cf39c7f59798e9bf0ec06238c793d3fff1703e22c0242504ff998b71539917f2cbe72740a50fa8ce9e3f6cc2a605cb2141e6ee82f8edd7a2a34ed4f7b72e52d5bb05dead4b799e940000000ec7ef0b3c7f156ac68c63d7bc8101e423ff9a4ada42abd7ccfe0130e0d865eb0b08e5699bc9925cfb8e9f909742235dbfab22ac41436dd16750b724c3f2bfdf3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2012 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2012 iexplore.exe 2012 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 3068 2012 iexplore.exe 15 PID 2012 wrote to memory of 3068 2012 iexplore.exe 15 PID 2012 wrote to memory of 3068 2012 iexplore.exe 15 PID 2012 wrote to memory of 3068 2012 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d56240542c966decdee78c32481b7be.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7454f434c9296f44a366e1c0c5c8433
SHA11f94b983047cec74edf73da841e8d01738cebb92
SHA25655f83a9a41f7914ed5fb949c5468d17e4260bc04223fd456e718554edc06d65b
SHA512de2748712b8733cea68e2afb0a045873760a9c622afacf2ae54bd76d105b6ae6e0fa6f102cab5cd7f4e1ec945359abc64fff72b1bf7778f13e365cb6244e85ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc44085e324302925bd8824b38e70be4
SHA1ac28f08047bdac7146368256f25370c3f0bf3770
SHA2563d4a4bdf5672856551fb948f897010cdb73cf6a97cd011f01ff920292258617d
SHA512bc937d4472a0c7705b60cfa7411ce8397b7002edbc73f66eecf12315e69d17e7696a72d49d8ea01e1c9d34db534d2b705abd3d794ece1708b5513bb5d2835df8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53725e321ad6469ec855beade63728e6a
SHA1e94abe92908c7fc0c15fa0155078eba41a84f8d9
SHA256e853ec5b7f6365e90257bd55302117cbb50a84affc9efaca239007630fc1f1fd
SHA5120757562dda2fade64731a3a0457d36e0ec9b6fac553248b9bf3c0472131ea7c3539495542d0b5cc21eb9aba109fc3287488197c285cf6d3e5a271b65150b165d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea9af161b826cc84e08525d1af1131f8
SHA1cf6f94ef84a8374fb7499d057c7cc43694032e73
SHA256fe07d0d115a22de5cf3d8a8c07c2e48f57f96a03cf54e3564514758a63b829dd
SHA512562ce1ecaf1bef55796a412c31b80a3ffdd9175036098334f4c095113139dd1521d1371c75f9c780349307ada7c9ab8e30a16c82cf53a51820fa0085e8da2670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555fc1595c091a68e14f492687c1b0743
SHA1dc502ae3becb1165d2daf3cbef4452e9d79f9b32
SHA256f59cc33368d6c96c1e24cbac3b17a36f57e0e23fa4ab5b42e0ace3c46f675547
SHA512d912b027f4828535a88600dc8da06a7ff569e63cfc382561cf35dd0d10a3abb3a9bf690c9f9ab6fbcec822eb7a8aaaa6add45dc16693367834c804a5cacb11a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5740efa6bf9acb90bc028c4b9060008af
SHA1937d761f2b6dc2324159a225828bfb108139c200
SHA2566f03c21697d7b50ec307f156c75a55dcccad329f126c9fe84db8419dcbe3b57f
SHA512d61ec080037de766d795d6737d963cdfabed45b9bb6b0be8d67e1c1ff8f90ebd3977237f5c75f3b6aa931454a4bb418eef06686be9dc6ebf14ca9acfbc4ae9f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595a5086d05c5e884d3f645983f45cc47
SHA185898d0768102404fc79e09f5aaf3b401c80e1d7
SHA256d826f21b6af98c23c3ed6d4df827e5ee68ae8b4c737454182a686934daf5b893
SHA512365abf8902a33fb374e3220d6d091730222304b1d459c3a4b2f51dc7e77bd6849057a2d685e8e6aa715b95c40530a40bd8d665a4251458f3bc7041e12079fa38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587b4f95080ee5c768615edf0b8e0f614
SHA14cc0b5150b404034e0f71b9b1638aadf75a3e8eb
SHA256d06043593f932f4bd637e8a1d867f13de81e554455d13979fb660898c9063092
SHA5129a2f453000f13adffc79b1897317bbb2a48c2659abedf5af939573e32c3846ce001936c13ac75110bde5a18bf3e4c1e46809b965ca90efc7124066966f12c049
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a53b1c2582450e8be1c9004964a137d
SHA141bba9f933e07fd6f372fd67dbd0f02142610be9
SHA2565d0245a6adb269434e9b1b7e0cd78711e63043ae0a07257663a89d4db81a9141
SHA512ea9c211fb220310097b3d1a061efb892eca22bf2fd07082f1fa04dae84aca401f084da4dac2084a43ea84e29d5632d38bec8f1abf9b929a2937437b0f63a7536
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502299003fdfba0398bc8835836dd1217
SHA1b9675394d1f1bb82f730bd75e5f94fc027278331
SHA256fd3d37def3fe2e7e73d2195a3a16aa177d0f298dd49ad8dc16ac1c2945a6a78c
SHA51259a578c7eabf035aeb2b9ff0dbbc7769cf5f377bbe7fd8222ae654f7201840116a75b49d7c3b7669beb37fc0971ae05214b17fb405ae4f3c1465d63f9a8cca17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0236fae88e2b2cd7073ac54d3766279
SHA15c54b80a5abc59b94529c1093fbe919eb635adcc
SHA2569e5f3ddee8ed7f786866c908190ab76ab2d86b097693bbfbff3f887e0dddd331
SHA5129250b137f2e6fa2baa128cc0908692d0d597c89ba4463f728414400665cddd911ff088bc4062d686d8bd1c6fb514b35e65ae0a7b2b8ff023811f09bb8ae8ec3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD585a48d153bb22f2ee5a10b802af2d891
SHA148a31faf83e4c2c3ca6a91b5c5d366af43227181
SHA256f4944fa21538092e10952def90bd084f4b8bb3ed8cf81b254e38058f0ec2ffcf
SHA5120775e84b16e3131241c5c17fe89ea95bf3b0547be2b90fe4b766272f30619dcd43a2f1b8a391e18d82e356fa1fae09c66e50e7ab67203e1593e347607604150e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59184385be63356123ebda7f3cfd6eec5
SHA11d068233d09bd0b34f4b57bacde261482ba488d5
SHA2567254542f8abc3b4f8acebf738a97f138a68341d6b5edf23fff8a4416f462522f
SHA512af65e44de82c181930584fd055fa585acaa58ab62e051715a56588ac33014441d3b68026a06ff1f9484aeede8aeebf74bd905d43b7b2094d49225d3ed5fa0e94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533b5ec24a6855fdefd4d488a94f87675
SHA1e34aa78bdf4bcb4b8035fb548a74e8ccf38629c6
SHA2562b98acb37bb6bae2143ddf5de5bbe60fd9bf2ee2f9e1dfe127af8d9dc4105193
SHA51239561a854cee923e5c17bf92c77ed9201ecd05ad739685764cdf34a2bca85c73286be10727afe968617dd146b71c2c3818f57735a4927f5dc5fc414c05659448
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53806ec39f075f5905e44d78ce43934c0
SHA1cde85ce9f461b7ab482ccbbc1704e4afe8c159e8
SHA25690aee00d3770423f4acb7ae5fe14c38418900ce23c67c9249fb05668c446a525
SHA5120924f467ffb49da3d9470efa7972306325ebaf480c660ad4e408a04754ea9e4dbc13923dbf96481ea275a6acf58238d572a1757a8affbb6ebc2818cee49345e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5963feb5f86938cfcbdfe41a66500ccc6
SHA119c780b69872c349cbbb55316503df5b7e2928d2
SHA256295bcf5961a97d8d5d6faa8cffc2f4b54976d9c27265fe80b74853abfec0e223
SHA512193ec2818f0ab8822314be70040eb21d2b225a95b9588f1dbfca953731776efc0c730fc03126e789381c2913aeb9754f26ee1660c798601046e2576e197aeea7
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E3F2LH07\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HVBRC7A9\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
92KB
MD571e4ce8b3a1b89f335a6936bbdafce4c
SHA16e0d450eb5f316a9924b3e58445b26bfb727001e
SHA256a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5
SHA512b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7