Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
67s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
48a25caedba037865338d7ded1e750cd.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48a25caedba037865338d7ded1e750cd.html
Resource
win10v2004-20231215-en
General
-
Target
48a25caedba037865338d7ded1e750cd.html
-
Size
6KB
-
MD5
48a25caedba037865338d7ded1e750cd
-
SHA1
b31644cab1baa392dcb0a852297554095468d328
-
SHA256
dc46224a1183869d87958fe80408cc2924bf58254c4ce445d18d352a197dccfa
-
SHA512
c2ef1743176b327dda1e6b73969744953666c7e0e762280a3d0305262f12ff7a6fe69413cd99444acf3f95bbf6f089a33c1de80bd7a67a32b1a0591a62ca63fa
-
SSDEEP
96:uzVs+ux7UkNLLY1k9o84d12ef7CSTUiZcEZ7ru7f:csz7UkNAYS/hb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000071350ca38685bc3045470b8135182f3d0902e0cac9eb80279841b8ed6a0a32ce000000000e8000000002000020000000288d14ec3d98d9767fbb4ea89d6e427a94d419b38db0881fceca78d8094709fe9000000041414c73c307cadd4c826ea2ef958936690b49a902cf3955a5b6918791fd4297c1e88906fd4b5a6e844aa5495b32d19d2960444d43b7466cd6b6d5e4583037aaec0bf0625b7d0f87de5f4755fc8428d6342a45656122200093a20ee46f4d09107501456960d2489a5b8120a0d8084b5559aa056bf3be890073a2202ce9c60ed095f4cc2f18b764457fbfb72fc56c3e3f40000000b44c73c9df00080fbbdff85415c1d3e90aeebda24ac20e70d47e0a3b7f8a56eb7dd0c534905be97ccbd1879b4f32a6440a27cc69dd7a3f5e92425b2d94f94be8 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e060986c38da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C1AC8771-A45F-11EE-86E5-EED0D7A1BF98} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c454b11e524a7e08493b351ef3c50195452eff804b320a38e64ae11e69c96bfa000000000e800000000200002000000013f4041d04c4554b9a778caaa82c677210b1e1ad311d883b17001cc901955569200000003e635a5e2696abd46ec6b9d97249757e1759742161db434ffd0aea8835cb3ab54000000019003a8d4eb1976c41d7b263e007000e0f87ecfb4a4d1c608bde5539445f1bd861e01ccd8bafcbac761844e3956af3ac0f96c6cb253c4ea32b0c4b38b0d31f9b iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE 2708 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2708 2488 iexplore.exe 17 PID 2488 wrote to memory of 2708 2488 iexplore.exe 17 PID 2488 wrote to memory of 2708 2488 iexplore.exe 17 PID 2488 wrote to memory of 2708 2488 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48a25caedba037865338d7ded1e750cd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2708
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587fbd591f406762794e3dead99a18470
SHA1ffc1b2d123a5f334777d6da8b172168785b2ba22
SHA256c3fc75b0d7a6da9c6ad02409adc5e1095a88596ce14edf63865cf678cf1232fc
SHA5120bd7e1a54a1b67e1e9e12e176f5dd4f428c721ac1e5f1ad5780e1b37f83edcd371a5da0fbea59486603e51373244fd2dae99c1c19daced9d2466979b1cb2987b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568c9f3fcdc00b20c88cae504f9fa066c
SHA18eb7ef1820136809708183199d54018758c89a10
SHA256b6f37ab77d6c6900ca3d45b72ec9f608d0f021d2a157d19f2f3a6a9d2e770791
SHA512d37f10a243f616c44c5b24fa18b5450aa6e22b6b0e9d9053cede5b5ad1315e6b087a85ccea317a9facb33da30e410bdd9d6471b04388b16ae397bb4185105a58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52531069865e0b806b4a8c49f40977869
SHA1535acd761cf6211c6237ebdf16ecb135b0492154
SHA2566f6536048902a650dfc6cf31b4772a6efbe7576d114f8e8d4055037986f7fc45
SHA5122a546df6795763be4cd7c31599e09343611e5f753590a8b37ddae15ca1611f2d0d9d5df740f9de8f974658feda7addc8c24961d2d81f33386f2a81b15e672824
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e02d9542bc328a66fa01a9b2439afbd
SHA1df8133bde4cc70fab12bf9725412999a951cf0be
SHA2560d0ac172a324915d886d4bae95356720c13c6b899ad619072d03fc27c3b525ac
SHA5128c67e7c1dbf314856e7445128775ba1a5c082708398bd746bb46f691f2b132555b68a89fec20753c62f7eca20152f24b33e930fa68917d62fd5b4576103390c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f1bf12b43f9b7ab1b16352ef4728dfd
SHA1255af43f9b47e7c5d91b7c0e9d6266a3ae7fab4a
SHA2565387c579620c5ca84234b37869d3e19ff9e549357ee4c54da34b0044fee13ec3
SHA512486b0d5aca7e6811a212b39160f26737447f442da4bb31a0be4fb33457be0250bd8750466d960b97844c5f1da04a68267ac434a8308dd774341a43052a8a17bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548e2525275121084ef22580278350744
SHA18f59b910ca99ebe9168820152f3e5f446dd6543c
SHA256977e9fd84c888bb84b0a96abe2eb5c3ea7f441fa1b01eba8492efae7f4545599
SHA51234a992d2c595aabe4715ff95670f18b996a478a8725b272f12f06738329eafbf807d8aac19864ae542239803312436a4a9a0e51af7e4c1b69d817f2476bb6659
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5960478de5cc48f7ada6f0d38e1ef4892
SHA198c61e2c693d3fcbd4531c78d64b200bad37d725
SHA2561f789ffbbd649ff35f28e05d1e8d56910a5b6c7986571afe3629a96c5741b667
SHA5121fde0576717614c14b0d4f9a06d41ad7eec492c695e8a724d8f2f71db2bbf543960afe9f4aef49d60364da05ae8872e1a714b00e9e89b71507264b722d37a9c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5123cd4ca60769a2d9503496a2eeb6de1
SHA1a1bfe335c08414ea8535b194b16ba34919abf339
SHA2563842448061015e6e282f61192c5935859bb3f10ebad951c8bc56d064f804c6a0
SHA51231062bb90bc54fc26239924a3a02d797e501966b7028777a5368acd03282a806f71a6d15c93aed2bd339368224788fd186909c6c62b298ba4cc867240f7394cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd2137fe12a967c968710b5439c5b59d
SHA1d7a54d31d500abd1dffd24dccddb6704165681c4
SHA25678cf0a644668fe8d36e90f6dd786ac8a690032f046ec708d6f79e35e22dbfdce
SHA5128e2cc4d7c286f5a7d66abbf1e3a87b6ef23609e054052d52781b47a63efa89e6d4d4ff9876241ec19fed6dc29d948a59d6663d8a9a50b704fedda19a10583bd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c24d85fade795590ede23caec4d11976
SHA19018479be9b3d170af17475107edce6bdd12f40e
SHA25696d49aad42bc391b7f37b8862877fb5d30949a279a3978bb9134099b80872604
SHA51239dd832a21f7ef5792dbc446f92fc67a54b7758b73811e3eb067fcc2b7dea76d50bed4681f581485d4cb159f83d19665fec981aa594bedc5478799b9fd221bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5025d1a26ddf065c42a5e51ae72adbcab
SHA1eb61d3810e18994b97912edca82133e58d5328d7
SHA256f245504974e50ed9883eb8c3cadde6c6cacbf732c6324b283d95dff6966182ed
SHA512d69f17ac966bde6eeb9173e54b5260af6a8d302162e6ef9e3f7003eb488588ca9fb8458f6a497be8544f6c5db83054503dc675c79bc5b84c85f7ef7b779db07d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575f3ffc12f169b43a02865abe5c3b4a8
SHA1624754a7c8474d0808d400e6bdcfb2bea7ab9f09
SHA256df9140ba04795103de2f14ad4f36925edc8f2a5831b502ea8871c41ace188421
SHA51279569ece274ed4a445ef3ec8de7a796737c958224b95a169bb53bb7d2321f7b39736b779b78963e56b0c3b554deb0e6f281ade43563816963a0936b30e17948f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5617571b50d094e0ba329bf9ba2cbdb74
SHA12a14f1f0526b6f371113bff118d33eb4fe4b6328
SHA256cca00bc77bdebe9195d87a1c51297eec0d386edd562b6841dd68b7fee9bf5210
SHA512e60da781e3d92a1c489980e41385844e2192635245f79748e8e7b9f6b6608bfbe28f3c98b757b2d0fd12b4a03f0fe14472fea9e0e082dd0d5ad831c33f4a2a83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d20ff0cd28273e3d28d17827063c1fc1
SHA1199af1dc8b5d244b556a0418b985f4cc76c89367
SHA2563ca18b80a6b346cf62b84a078fe45be0fd897ac42009e6e006f25dce04327605
SHA512de62e3a1ddf299e9787cdc7e331b7b2b95cefccbf4fbf4632c25fa3a25fb1d9b0126fbf27f02ef3241d67db965310844fb482460d6dbb1190c5c0b97fae5db1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abf8e3951aa5c5b8f19401653681d648
SHA1ca9c0475a4829b3bd823302122c3ea62a335823e
SHA256df97cca3d3ca2b1916132fcabcc9c6b7de37237a3f8292a3a2bbdb6d1293e9fe
SHA5129c2d4351e0e1e19a12dbb96916c7a1c93dc2f231ab2d2e3faad65ef973e18c49fe4e70680d0504a5bda92a324c4a06d8eb54ede1b4e27427d5d49c37c72e8cb9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
139KB
MD55be83adac37cc25a366000976a04758d
SHA1fc6e33ed812e459604c3de031a4f0196ad76fc3c
SHA2562fcd63fc541e2b0279ef45a39f591126fc66e79f1d2aa07f5aca17cdf93ab2e0
SHA51247555af9d9c00d09a1a4b1d7ffdb6bc067b70317031a250b1ee4ffb22649d4c52ccecc2f66303036b2f729b5e1aa8bda63db3b9c59a07640e36e3e03d61025eb