Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 20:39
Static task
static1
Behavioral task
behavioral1
Sample
3bea9b56abc15ef6c951c10712647d5f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3bea9b56abc15ef6c951c10712647d5f.html
Resource
win10v2004-20231215-en
General
-
Target
3bea9b56abc15ef6c951c10712647d5f.html
-
Size
12KB
-
MD5
3bea9b56abc15ef6c951c10712647d5f
-
SHA1
acce0c8d3c055b37402e61e851e9313d63d2136e
-
SHA256
fd5b4a4b464a0c1228a3e51f445571bd89e49841c5fc5e1571952641f93dd4fd
-
SHA512
a6c95591ff9cba4d8e659f92d53ffe65e23d544bd70089ad47e531761c38b6f1f635c9e6e95f55d7419582a4af2325991978174c0aa9be185ff2e5147e0ae0a8
-
SSDEEP
192:yAyWbl3znxt/5R2c34R5hXs37rCTo4AiZXI8y:LyWbZz284xon4JB+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410014451" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4075a8d5513ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB958091-A644-11EE-914A-EED0D7A1BF98} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002575f69e9fd6452498f41f7ca724ef1cdd38b8b91ff73452b4dafa5b60c44263000000000e8000000002000020000000e4a5f409c9303e4e25162995210bdde9ba9c2defd8112a354b088259f6e0600390000000950a142fd7e7511901cae9eb27efafee2e09ca1c788dd1e7675a39eed7bbfa34933520dadcb64ec6e83257f302556f76f59f8423c060e7c9d2d9a516d43ba6475df198deec6c4d0a847fc6934706dd5ba4643ce79e134332f555dcc41a3c291c99c9812823cb39f0965c1115aace12592adf89b01002f36bb5b6dd160e11fc4666fd5758a69ac8f1ba0cc4401dc220194000000065092d20d750ae1bd21ca736f56e9d19e82197b9f6308b61537e79b75e81a6abd1914846dda86da1a8a6315293d85d3e0a0dd4eeff4765ee20621e54f1eea315 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000f25903b52911e08b3941b0e16ee814e90a4c35bb492e334d565a454ac410175c000000000e800000000200002000000002db6b683a0f68549e10bef15ebf9bb70ee1ff408e3fd47bbe75501a4f3c327b200000001b555e4c6d42b83b2cb671b6957f73b89ebff1462061e140181f77b2d2dca27a40000000e04b1df85c32f7fd3e19e3dfd00a9710b29a0c9b4ea07619fd5dd4b0194c64ba2a25d4782be00519c07fcb64fbfed9f616c8910e3f89dc7cc0f3521376b5af67 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2020 iexplore.exe 2020 iexplore.exe 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE 2300 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2020 wrote to memory of 2300 2020 iexplore.exe 25 PID 2020 wrote to memory of 2300 2020 iexplore.exe 25 PID 2020 wrote to memory of 2300 2020 iexplore.exe 25 PID 2020 wrote to memory of 2300 2020 iexplore.exe 25
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3bea9b56abc15ef6c951c10712647d5f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2300
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c9c2fe7dd0b3cf5c13b13be676f2a2f
SHA104890502bcfb1f655c4d4a7a35469d58fbdaf9f0
SHA25658e0b73ecc81dd08784421bd4df735110be5ae4d9af20d90016018f92f2cbdff
SHA5129a4a8aef89ef1fa6d445171ccf72556c2f11e68f7022b9d85ca8c0617429ba2e7c0bfc832f73850b6bfa8c0fd050736c262e554558c612ded5a55d795a8d48e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514304d47ed6a7437a8d34a27740ac7df
SHA10c08edf2a09720faa2b343ed53b0269afed22e24
SHA256290b28888dd27d4dda14ac80b4b86079af9c59bb175ad8e7c99424db02c0d3ff
SHA5121c993ecc2a92a3f056cc13553f83380642b24277d1a1920beeefecab4ba39178811b4550a9ed9691195fc1613aead484a4bad91b643abacf846af69c72dd17dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51897c4006f976368d1b61676f65ea9b8
SHA141b4c66722c84ce292e999063fa2b6b7694f5a45
SHA2569846f0b5a116b968d81b8095756dea86cd6cf0509f42fb3327bdd353255d358c
SHA512dda3ff1792cb9325e38b4c09740ffa8415262562315ca4aa1a9722b3fd597638ddd8ebe8a2058dceb98f640b14ebdab7d840d444d346b20aefac17df6f361bd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe8fa3003dec8f41e890845e3b9a3778
SHA15212f97d5d8e6bdb0e5a3e7d393c4654e189cb9d
SHA256f3d9e95faae1714e62a611606e146eceb4996953209b4a816bece75c983d23a0
SHA51212e5f6c94c71f60129c9a9ea280a02044cb8b72dded76d3940bb6ade82808d32251e46de911117252731e2c60811850ceeafb7d01f98aceed3d24b731fc001a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5417b64db12db48b04406e1973040cf4e
SHA1cb35d285d6ebc7dba5cd6fa2b98ab19847e64d68
SHA2565c4d8bf1c8031f307412a1fe16bccd91ab4c6746352e4959cac6ddb8886ba9fe
SHA5127cdb7d77849e2f340550430d997f3b425575dcf69627dcacd69730e6bbe19d5b186d5560c846803d2542cab054194253b0b77c5159ff07d06e925050554b8143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d587f5f856926e753dc209c903ff7226
SHA1f42ff5562844e88668f8ef53b34dd8ebde2eb82a
SHA2567c94721887e665dff6ff0920574b31bfae37b161422303d4feabac6c56a7fe44
SHA51289720d703cf050a69cab98008a8157ffcdf47b2e57a720686b722e83afbb1d894438b0b8421d9f840243398bb6666bf86b0b49231de0999c5720ca3ea63d674f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb53da4a7c33fbbfb8eceee0112e8b34
SHA1c1b4c2eacf14485576280d2149c4c72256ac8a40
SHA2564948109bf3cea6ca6130beef8f7ad8fe6417abc4acb1f5328cb6410d5666d086
SHA51203aeb6dbd3bb2aea57a570bc460a70a944a109a05a9cbe7a7c448c9adfb89f43ed82995d4777df003784329c6d03a56447eefaa1ef5f0b0245efd5fdfdba5e5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d088edcb167ada17bcae1a78a0e5400
SHA1ec63c08e1b706192ea524513a9fa2628bd8c99a3
SHA256a8d4ea826d4a6c1cace55bd13b3c68cce07e21fdc7963570b0c89823ee4b99c6
SHA5127cd66bbc9b3b2a7fe685e763e55006bd80a80f4ba6fc5ec2d1745d5c75a2dd1976ef30bc7f50052316df23aa85e2cf415142369d79426168674848b41fb3f698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0be15b4493fd853d7a3eaee85817b9b
SHA120d36598be7713f4477f3e39c06de776a2cf326f
SHA256bc57838e3f3a04527b72ea36ff19d86cac715b1b496d11e8c892447768f67aa4
SHA5126656764543f006de24ba77884cb7450e795ac9f7c3a8bba92d4bc2d807289cdb13ac2d55d99281ab2aa6a80262cc141e4e495dab6a1b0432a79f6b62f94af281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ec4614b6cc65b6d8e2e9ae78268b6b1
SHA19f7152373fc00c8dc7c5f70b174e14144bfa3073
SHA2562f680b179b926bd3f647d102d0673491a149a293f6658347e44cacb73d658dee
SHA512dc9254abc57b154eb5a75ef87bec17b913066aa4ecbdf7e12db0ed8fb75ee7a088cb97926232fdf40e9569fd60cc7f93e6dab9b5c0490becf539a409370fb227
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2b5ef4c386340f1f6c85d8d6e30eebc
SHA12431b0927659fe28b15d33431130adabf194690e
SHA256ebc7bdd1de95ac529c4cc871b01310aee5a869e191f78188f55f0c27f7f00068
SHA5122c32b8be7cb145ed9e841955807e782467a297676c02fe934b5face3e46530cddeab8f664e1d91611dee6fd4c00d8c0780b10d6de271d2dfb913c7ed13da73ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dac43512c8a0972cd611060af29670db
SHA1a5147815f15623c0182a635f3e4273f7b93091c5
SHA256069891c0c497b21165a6c8a3581169e67ea3b53818cbee9f63626903535573b0
SHA5129adc40203aad15e0a846048602402e2d998544e1ef962489dffd0592f5bd61e26258936fe9c64e8c3a96f0fc14e028f858b2ef48d76d663dfca7e55922745668
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
137KB
MD579d53eec61a256614436e7da16e9c89c
SHA115fb69aba73a7c6ade25b7520138123135458697
SHA256b4285f9f286c68ffd90352a7eff92d582156a3d3f635c388ada0c50cb1baa85c
SHA5126c4869029909c432a60317de47e66aa6b26beb9dd3cd6fd0910dadd45cab0772959563f751a99f76652c03a9e548554c589686c73016386d9b60f17e44cb15b3