Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
55462c59ef0147b79411e0bcbaf81daf.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
55462c59ef0147b79411e0bcbaf81daf.html
Resource
win10v2004-20231222-en
General
-
Target
55462c59ef0147b79411e0bcbaf81daf.html
-
Size
22KB
-
MD5
55462c59ef0147b79411e0bcbaf81daf
-
SHA1
c5ea07430b867eff022c86a75804c5ea73b20b19
-
SHA256
6967397cb053801df7dd31fa05ccb5c4c31ea769079bbea59e7a2a93a471e30b
-
SHA512
064a68fa856cb50e7ddefc23980a8b364559b512c468b909b527e1e6cbc030883b193b3fbb4914979780dc53058406f9c9c8255768e9c85f929a13abd0944f45
-
SSDEEP
384:PpUqQ1I/RSl4utC8MJdhqDHhPpmOTiZsP:PpUGAl4kqIBhiZo
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20bd7dc99e38da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409827599" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c7f7f3b7e86a0f42925e6bc045b0b380416a5852571a9898f6b79bf3555bfcd5000000000e80000000020000200000002bd411e56fe5119c7dc354fb571bb17370ee6d24aa9c706918ed97ccfc686802200000009d048c94d3b48c15d7fdc6595809366591c68b917f20c55b9e5a6a3a2d0ac20540000000d7eee0c18b4382c70392a25606e23936eceb3cbdcf87c16e91e4630011cae1b7bd412bd50a8b6c4e605fb4e789eaa260e44b3c61c89b3d9740a70897b127b30b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4043E21-A491-11EE-9569-6A53A263E8F2} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c764d432f930b04ee15f55639ba38d75f50fd9ca51b320662efa9e0401b49a3d000000000e8000000002000020000000ab00775136ed4992862698e74836b31c2e91c319bfa9c27df26657c6eaeece4e90000000e3ae3193b5e047092e6d494bd72d40ae50d65812e53eb6ae50c87c750913b94dfabb5ab670f3d2733a5426e0af3224e7e4605d2a25a3d56b0b0a8cb24896af5000d3f675000b62fca1e6553f71d1be120445301d85e65085504ceda1b178156db85d0f971a67249af6bb5d370dcf5dd9699edf9e765f99540068cbff81e3521a08452085152c45b67d9f9b111f4c606040000000c190a56ce2e1c6d9c2eee93cbc1abb09034d1e32850544dda18ff074297239cba1f831d1ec5d09ec3e2c1ecc8e0e40a05a8ac51cc4b8e6cd6b1249d866851410 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2480 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2480 iexplore.exe 2480 iexplore.exe 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE 2924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2924 2480 iexplore.exe 28 PID 2480 wrote to memory of 2924 2480 iexplore.exe 28 PID 2480 wrote to memory of 2924 2480 iexplore.exe 28 PID 2480 wrote to memory of 2924 2480 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55462c59ef0147b79411e0bcbaf81daf.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5261b6ed2143ed59c1ba4bbe86dc6ab6a
SHA11f07aac8d2112d101b43053eeb754b9c35be6d21
SHA25696d0f2ad6355ca7baac0ab2db415dab1bd912d7900cc15bcb8c4e1fbd84adfb4
SHA512452bee0376e134a051747c76f54263399f851451704c693922815526d522a5040e712ea55e8ec6b6f2a3124e96fccd91888eaa2d25b58021187b812d2ed43619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f0fca90ce117e8feab77ee28d139bf5
SHA16c78e1e29d992b8965d997616924ffa114a35d89
SHA2564a33865c1ed40a81a4e280080eeded3262f7ebf14573d5289070e06fd323f5f7
SHA512b0dff6fdb939d9b784a55c64c643b5fa4fb4ca794cceece77376f848d5fd785a4e92232d711dec9000c31761a9eb62548ee4ee36c7059515cf44e76199a4533d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c02b7f18e56e57b57a3fe4015f21ec2
SHA14b230b341c387f2defd150d0f7341a191c098741
SHA2561a4d755a1bd1dbb55047a2301f81156bab48fc32fd86d84e5417de6d1b6eb508
SHA512e06fdf6cfa77b08e85b753bcda4e1cdb2362c4edcf150f6b6ff87e13458b8a46234bfdfbea109a8eb4a52b71fed2aea0f0de9bd8a0eee8c2993470c2976b8bd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53afa07f24bf20e453dd3677a61e6ee38
SHA1619c291ebebca32f2cb16f263a09cd524a7588ab
SHA256b80a6224408b18a0995c60ef7fa9516c02be18a4cf2dae3edc0d5da7b5bddb90
SHA512c9fcc54d96b4535578d5962dd578c17eb66be8b302544f32a2a713b2cf39822bb200edc0154cee9822dfab4167e54db95d241cec66ce1f4ee40397a4fc2ccb1d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d98f2c98bcc5c1ce8beb7f30c59b5ba9
SHA1ca98bdc8c2a429c84adf45a35bec195b39ac982c
SHA256cb2e2d642c941774ccc775ebde9b88692e286006e9ba108d279441a7264444f0
SHA512c46c017d6a11a36d561b5452b525d729df07619b9b9eb43d16833b48bb3ec3dcf43338e4a200d67137b0b6900841dcdd9cdc173d13edf38eedd04971e0cfbc29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55206c9084d65781fe2a8ede0d0d22dfb
SHA158ca353a376b382b1799c9f20b5f765e3ef63481
SHA2566a95a6d208f02eb6f29d8b2540095ef503ef5f634771d3c07f9d5207102d5c28
SHA5127b8cab06766a915539410f96114f0359dc9ed40ea63f9b6d2f2b987fa22e7f8bb1edf0cb778843d56d3c7ea441dcef4bbe64d35c11746cda494e2074d0de2f74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ade3cb798beead60cc54dcece59b7d12
SHA1d215b1182238054988f5ae28318824b61b59d5f8
SHA256b7bb8ada0ec80c330b69976bb7d6a7b9b566076c1ba5dc0718044785858c5002
SHA512d0bca0d3922e9d8a03ddfbbb8ad82603ca010d4376a95e43c7b9d370ba2bc1156b1e1e3d0c923a75d7037cb525492b185e7c84705edf77b2299ff871338155f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b718831a10fe348eef36614929eaa4d
SHA1acdbf6875e9d68ad2d862b7634030d59c507203c
SHA25617431096b010d23db1a06f79a5c8629f7487e8cc8fda534efc227b278b0ffc4a
SHA512f884bd1b4cc0523adf54411f2f5e23a66c58e40378ffe3426c1c97cc9d9d607ec04454d8fa92d8837ce9f8b6b1f7fcc4424d17888eb80be731e91dacea81bfb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506604fc8140c7efe860cce355897d3db
SHA1f9c6c3ec55eaba9b0eeb882e713363175085d7aa
SHA2561344dba36444e5df3baaef055b46b585af0cc52762f9749e49f07364af9b8ea0
SHA51259a5aeaa64d996abbae73e9587f08ab9145ba7e43a785a057ad299754da6a9923ebfd214749809f753a859b516c65b460aa6531e08291243e01cdcaa0d5570d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f09ea78ff66adba5257429871cd6c821
SHA1cb791aaf5c9053d1def34c0962cabb92006d8716
SHA25685c89e6f9de9ef60ef8c948b0a809ee9842b6ee0c4358ecfccd599b09ec2c457
SHA512eb8fd2a12111a0dbf51c26887f62b76af4aedd38758f571f9adb6ae05e5faec0f342aa169a351c9004cd7d1e167f8f65ef25b17e010953babe03d3895fc50f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ef53792c384f47f283aa057faea314f
SHA116912482fcfc7bca6bfbb7a2683269d959e193a6
SHA256df94967c3ccf51afc683a751339ad4bc6df7bdebfc7a59bce760daa264ffc08e
SHA51271be933ebad001a43103b3ccbabeddd807b759cec242e531b7e2148fc0b12aa0124ac1b35a83880274347560884eb1777fe85dabc7f69d9dc9569bd37bf3a46f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bba5be0f7da3cbc8a53460604bf546c
SHA118fc6131e6e62e635556e20e6ff79dd78f482472
SHA2561012f0939f1832d44c353ac3923b3d088529685f0470bc093567d9009979a0a2
SHA512c2b59d49ba93804bf6d5212e32c91526679568b081014c616219e649331a09530cc01d1d70feccc0d063a656de7d7a0e05ae4cdd377a1aae95917c7fe78df2ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e62e4635f43459fbc9e9e6ac55f5068
SHA1ce791845b54fba49814bef779b27344bf42b8afb
SHA256b4988fcd8f3e6f4b4e7c4b7efe3f88f655d9260af9725b7c405551a937d929e5
SHA512ee7279c8822ba2647ff628ff43af7edcb707ff108003e7d825a7b3f85cced306be80e4cacc17425e72ba8075909c9e45217b6b56c73df70270582d8f1ff01b81
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06