Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 03:59
Static task
static1
Behavioral task
behavioral1
Sample
526bff29043b179f8a07ef13c8514d38.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
526bff29043b179f8a07ef13c8514d38.html
Resource
win10v2004-20231215-en
General
-
Target
526bff29043b179f8a07ef13c8514d38.html
-
Size
53KB
-
MD5
526bff29043b179f8a07ef13c8514d38
-
SHA1
ef6d588f6fdc3f8d7d1da581545c7baa5ca7358a
-
SHA256
e00143b5bdd69952baf23372353610fb361a6f04cfde1f7f49323b22d7e8c9e4
-
SHA512
e0b0ce265a86692811df0ef43738d9dc33031872251c72f27e76ac5fc50544c0e2b37afd85c927311777a4bd3739a48d1efbdb9638f49d230436accb856cf033
-
SSDEEP
1536:CkgUiIakTqGivi+PyU+runlYL63Nj+q5VyvR0w2AzTICbbzoA/t9M/dNwIUTDmD8:CkgUiIakTqGivi+PyU+runlYL63Nj+qK
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410390165" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000001ce8cc8b7f692789eda5330ad663c7c1bb90974ccba4ee4c6635f0767bcbde00000000000e80000000020000200000003467ffcaef5981fa9c60fc64639b87c92340202e98334cf161626006693b6076900000002b6ad2ea275dcefd0d1212c04c29398dabc67bb266a9bdcca74592fd5885fbdb39e3b29359554cc056df7bbf1374a5b559752637be563a68dc50c136f1cf8d2bc1dd787afd74009b6f4ef9dad18edca04402d6b7fe5227ef7d0fc75b68cfa774426d1f5e7e3eb934871d3b14c4e78ca0e57f4aab8b0244df9002417f413a7b0b65b784ed8a5b54e6f3604e67bc3ef50940000000b8b484382480e545bf8732c77a9b7b8c75e4438536f3df88a0475b696982297ca4aaf12d27696944ce001274118acd191b6b4f89ed79a17fa7cb6d4c9db9e537 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e570dc37f7ee8109a702f0617a4864680167b9f5ad419358e164967935be8028000000000e8000000002000020000000aeef727587884613a40627fa4165721231ff012e03d2634f1f10fff50069376c20000000a8fdf4718b8385eeaa9769a727da58a2ed8669bf5f1ee304e91d3f3744fdc88140000000918b85d5a19fb420d4827f55eb76b798a070e0f5ac0f1e4a6c30c21fdafd86cfcf42155da52e02d1bc1c89c58865b6fbcdc6911e5d2609ca2e9985fb38de9d9a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0080d2b8bc3dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C9A6F0A1-A9AF-11EE-B59C-EE5B2FF970AA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 860 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 860 iexplore.exe 860 iexplore.exe 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE 1272 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 860 wrote to memory of 1272 860 iexplore.exe 28 PID 860 wrote to memory of 1272 860 iexplore.exe 28 PID 860 wrote to memory of 1272 860 iexplore.exe 28 PID 860 wrote to memory of 1272 860 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\526bff29043b179f8a07ef13c8514d38.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:860 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1272
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e795ff62cc0e2ae570e24f0ae8c8ae7
SHA10099d0eae9778010ecf06089a048bdbe8bd803a8
SHA256ca502ebe59afc83b2dd424e510dca57ca4531a42789aa89998f7711c098ed204
SHA512a9303de9699be6ecc63a05e7c3ee487b4ed85995afdca2294ee5aee967cbde8a98c43cc442a99fd948ce7f7e4e107f9fe16775f0ea00f39772d2308aeec6098c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540a2aef74a087fb9e617f444e7a18271
SHA12363dfe1198ca458c5619efe2d145893f3d78c62
SHA2567e0d5abd654afe24d7ec77dfae04e42544b40473829f1f0c3c98a4d99a2797ba
SHA512e39ee64ca235d61d6a2a0cd097b27e784b71dbfe131675a5bb40d6ea4e0d1b9171413493ab88ec1b9d2bda21802435b5ea3fa4abf0ab49e565a7ddb80f10e67d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5744e9d0159d9efa72308ecae364fff
SHA1143dd7436e6bf81be0ff462d1a49aec386c9894a
SHA2565ceb69464b97a26c63c8fabae2150629f61e7f05b0655dd1c86eba8a32eb463b
SHA51244c7794b61c6c818adc72967dd47c93efc6a03ba8c536f2a27b969ee2ec76aa646cdd9be16f3bb2af0eac180bcd1226cb9716dde61b29aefe2c736602e2495b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d07dc5348bb1c2bd4e985050160cab06
SHA15fe778f1b0c56545e9a5d0bf19219efb459ad5cf
SHA256ae271e58e317a5e1da361168e04949288f5426b38e1d3765ad03837c8f12b176
SHA512b1c22ae1820a06588c77d63c84ecb04c054a43641594dd08fcdf94bd39efcf07a085e8492c58acccc4ffce102f90c5f98f1119688ca55ec4158114dfae76dda1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599b93263e8777d7bcb30b9b6315a5d7b
SHA1f442a30f2bfdedc3094a467c87b61eeeb07e054f
SHA256e74c49b7dbfda5216b66cf30c8701c42140af03ac4f34fe350b8e6707883e9dd
SHA512c4fe3525ea394a892770d43426ec62c1eb8b4354c389b5536ce762149fdf23ea368c25c37a4d9882479c67ddccfafcf295c17144e6ee82ed073d959444b8e9c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c60eb8ea93513d47137727dcd75332cf
SHA15baa648cda73826a65c95689e923e162af7b8e6b
SHA2567d1756b5492f32329ffc7e731cfba33f83bd00ca1b3b613864ba22a1115f4f5d
SHA5123fc1244dd4da1b9fab391c68568f5f26e8b0e2283794504bb644087b6898d5111b03329462c9bb845149c58f17d41d8ad1c376137e7ce0aaa48b7775644959fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543889f72214072c4b4e207e3b57de070
SHA1081f3eab44916e7779e6f96ba12088add60a722a
SHA2569906809e9db85f49316abfb20c95ae54c95759795cf6fb72b51a4bbc9605b73d
SHA512ae64c5227d3c90daaa82c108c6b83ef7dae98cfc6bf7ec16f5c127a9a59445b3111de5b1119c4c97ca2ba160bce4f4a05c99681b5ec812cbfeca1670356ad332
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cbc970e5d6a89e33e43009aca42f636
SHA143b33f809e145b56a0190aaf829a4b06be0e6544
SHA25630aeba86a915107da78701752884b0a5268c3b5cfd9eae9d8d2ac75af823ecf1
SHA512d95312cca258f155a1ad86dbc9fd34669ace0dd3b87b9cbd68c535b16b52f46b686fb0a778c3af47e2b08496f10a3d7672bab6e8755f9b9b4545150e6fa23721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5704eacc647fc9ccb254bf280c08c50a8
SHA11a57a2f5244f34f7b12cf77eb16352d139f391b4
SHA256c8ea2f79f576768a6f2172f05f9cd5fae99c63a104da923fceb0628c8853da34
SHA512027a0b6049848b30bd0e1a9422a5b353246243565e4793f2d8a90d9aae2d5d3d73681b9b10cf81dc79c720e6c0d5a4dc8346b24b62f916941bf75363d000d651
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5184a076fa371ecd5247546f2ea6687f9
SHA14dbadf35b3d69d81472dfcf31e561b75fc4d5368
SHA2567db99dff478e75e748749f8d3869b5af2889b52eea1e24782682f6cca0cff281
SHA512f867a78a41b1ec16d3f3fbe963d26f3797ea67e049424ccbbe169fcae0b8a2bacb538aa1b2880c20b787ea7f5598cce492e77a999c410ff30f4022eb02759b6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d534417e9be30619ce5d0aded16d80e2
SHA13f95aa656ddc80bc7b37ff69fb497c33dd2e80dd
SHA256020160426f4138c4054d2b778a66a69290b8d7b1b6aae5777d54ac5a0b198dae
SHA5123bcc0bb80c69dfebc30969a963f963fe67db8bb3a7ad34f45260f48372c4118d063a27acc072f4b155a9e87a4831f96beb28b42a1064844fb1a863bb963b85a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1a6cbace719a3fc4cb23da170f40eb8
SHA1e3600322d0548666cb99e64a86f1c3f03ed584b9
SHA256fc549bab23740dbae99376b6f35042e0a381ffc9efa2b0f352f0f1dc021263c6
SHA512c96333bbb97779266881f4c3737d2ee5e8ab35e19536fc03dc0da133d0d7e219f8d5f2e4c837685f0f9ae55eceea1125fa15672fcb0d780100cf8e3e9280b9f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bdf4ef0a5db53bbc61ce255f408ba7e
SHA1cae3823befeb7c145b30c41125dc4c9b52357ba3
SHA25638a996be9f0c040cd8f93a497b0f72d94aeb92b07833c9edb4a698d8c737b6f8
SHA5127d732565ca2df3fa926cff22992687c71a3ccdd017e7220c0abc73b9284d84371f03756c4eac760d1defd34414fad1f5414c481dd59a672b935afa0ef436c979
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea432cac70db9779aa8bdf7f510bccc0
SHA11d68ea9040bad9b6b89a129ccfffcce41a531054
SHA2565bff17661085d024a3317dabb5929f904ec38a3067e5ed60ee488a3fe96517e7
SHA51263fc031fcc42f17c5bf532370ef0c7f3c10471bfca8a425c1214a52026190ffa10aca0f112ab18e0f57ce399aaf5fb5bb5c49232a3f7ea08c7b062f0bd3eb40f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d11ae082da201aead3da149ae4fe8553
SHA10da3d2cc5d440c522c5ceaafc9caa7756e63cd53
SHA2560e30772f1845a88ea595b4bdb2cc4aa62e34cdeb83e1f4c1c631f709998c0601
SHA51225472cdb981df6724a90bea396d883f709c5c852b06e576e6aa290b76d87fde4b903f4ec431f7f606db5f1006734a4769b1b06ed916215a37586a32f93a2f3e2
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\wt-logo[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06