Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 05:05
Static task
static1
Behavioral task
behavioral1
Sample
5688ff77595784ea955e0daad4860574.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5688ff77595784ea955e0daad4860574.html
Resource
win10v2004-20231215-en
General
-
Target
5688ff77595784ea955e0daad4860574.html
-
Size
53KB
-
MD5
5688ff77595784ea955e0daad4860574
-
SHA1
1d6bec52777ebc169e7970e4de13b5d1ce296fdf
-
SHA256
e8fc0523166613dedf9b76b47e3a5466bde1272b2d2bc3f002ffdfea899a779d
-
SHA512
6d25036388a9aae78d781f6399b583d0ab8c824e20c3c4f8d62860a85114152be71e0b31d75e29ad3980e579041a8537a27dd18d998685765fef191c0d87fde0
-
SSDEEP
1536:CkgUiIakTqGivi+PyU/runlYA63Nj+q5Vy0R0w2AzTICbbpox/t9M/dNwIUTDmDA:CkgUiIakTqGivi+PyU/runlYA63Nj+qO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{01EC1C01-AC1D-11EE-BA23-F2B23B8A8DD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000030a8612f63dfd763c835956b0458431bfa845e49b0bfa57c445b62f381ecd55a000000000e8000000002000020000000f381fa0f40f5ed0c86890b8acb4e997abae3789fac998d5f111efdad434420b0200000004b4d6babbf9c5bb31743c63fe1568420e326bc80cfbbbb25923d05edd4a6e6134000000014bc9b28495d6a4cc4b109417861a730f18b756e9cf3f93c93d1a2fe7c98bbf67dab17334d4a9ae9f0ec737873b767f8bb1af5e2aea45244dd853bd0c2c62bd1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410656996" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30fc9dea2940da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006b096084e2a4febefc808e03640f115b3d2c1fa28465205a0e578c6695a656d6000000000e80000000020000200000004486d1729979b33e15859a2c7d32ae3f0c4c2c0f035c7406971fd9f7998beef490000000bfc06972db1b7328a43526bd126c6a9d3fbeef0fabdbae67c35b6a948001127a386ca395fb09e0940b417def43917ab561dad853b79413494e79a507055e66a06756b5afa8f4c2f5ee60cd37c2c6f7a74cd049f4e949dcb495d2842bf851d1f1ce9e9215a8724ce54a1b47ecd53ef187b607a344c166f262dc35f674ae93660e4e6a92b388249d4bf60571f62504e38a40000000c50c8d3751019b22a9292fa071370eff52ae1e5ac36c23b295148e9f218d4853e253971c915baa146370fd64c0542aa776d0caf6afe64579af6ddb72789172ff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE 2904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2904 2912 iexplore.exe 28 PID 2912 wrote to memory of 2904 2912 iexplore.exe 28 PID 2912 wrote to memory of 2904 2912 iexplore.exe 28 PID 2912 wrote to memory of 2904 2912 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5688ff77595784ea955e0daad4860574.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8f86cbe63aa1a7bcb04743a076b0fb6
SHA1b70d7b0cb6978436d486f61088139033a55b77be
SHA256a50d6b521e2180d37c0c2049b149d107488285f37953766f38a550d2a6ad85f8
SHA5121375a003b52ad14c011a54119665cdf58216b414227d8e123cbc804fccdb31e760c2ab5217481e635380a1b165bf028142b3eb524c5b3734d8073f0c9207db32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8c1a46b8cb29a1cb2ac9e0009021717
SHA10b13c3e496d18666c7a09c8de2e6b7c22b6ef4b7
SHA25647ca3b97b08a8da310ec563f11280dbc7b2153f0da0a27e516a440abe4eb85a9
SHA512c9c995044ec62279d22e2c20aac607fec8de24cc6d3afdecd3f9a0bcc1cac859550d24a092ef758ae10ed5240c00c8143f24da93daaa09cfd55b4f5d6c40d323
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5042c44624caaea0fcd9fcd85a0496d50
SHA1a187d0da841aefb249dad003971f0ccc4021ca14
SHA256944cc2690df2f1e8d3a249b51fe443ef0fa14433b6fe1ebbbeb20d58d4f26905
SHA5125ba466f610f26aa70033904d8c67f2bdc9250ae0bf0f7449c23264e1396833696c1d8bfc1c87ccf7252e8b9dc809776a0c1c7c2cd9d798086d6e91bfbe0d6d02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59908985222ee98f4d584148a8bdf0d69
SHA1b5d0bbd60b2477124451f870460214869a54b4ea
SHA2561bd03a1e72e3d2d1ce08e1078b55231d4993229a8e4d884d692a0492746d18ad
SHA512c244848c0398343aaf0475fb63900ad6b0fcfd04de896b96de49bb2a46a792c8a8ac7d957c2ef44df589057a3492db0ee15a966d18c11228ad5b4a3ae55726b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e597916fb6644c7c1a20f7d97119d9fd
SHA1ce7f1836cba4b85bea6e5013d5c26e6c70413b61
SHA256dfb9cf03f2d2c34ec6ba626a59fde82937d5283e87e109b3dbc1189fede49145
SHA5126c863284a1c8393c4795475de33753f5949f4316f93a8b1db637a21e08e5fb5ddcb44dfaf18900cf60f3b08f13db38d781f55d57101066a159aae3c5d7ee2106
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56289121913a4608928b4dae0c9b7863f
SHA112846127c6a99e91e4333207661f4df87d74195c
SHA256827e74c7b788bb342be87d1529270fafbc8d3035c4771f420604457a38480e50
SHA51213761216e6514a95fff955e36a5d0672b5597bab66021cde11f16746a929f8ebb5e0decc3b4f7c937cd27ade045bb6d3fac8eb003e1874301bf57daf2c082d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5441be410b2a9431c5fc43f571e8d7cc7
SHA1ac81d1275fbadb04398bfdeda468286cd4163ac8
SHA256786d60e140dab81a721386a54cd3eb2318be0317472eb622fa6161b208a8cbb2
SHA512746a5b6c8bb4a02d6097059d15fdfe7920a9feb77768d3d6a25ca744a7bcb9bc737c51146fa69a38f14cec43943b2d62aac700c8270432fd69f6e6a986a93180
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529be0365c336c65d1c59be90cd9ec3e9
SHA14906639615d9df1ed9c59838f1343e3078038436
SHA2565e2d68f55d93dee7565a1df424a4be8969232ec6c775a5e2675e2d1d8c0c092c
SHA512e223d324f922fce0689214b6e9b6995f14a73fc010f4b21452caa5ab3b9df539d0074d75cb62c62b1950a05017bff487dc1310516f73d39bbd6fc7aa904a2321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57077cfa40781dd4329ddd10bd56797a4
SHA1c484b994cf00e0bad12bdeb37aeb907be78954b5
SHA256857305070ea5bb5f0182da02701452dc76e84b08ddf42981b0ccf34a49509791
SHA512f0f9714f33299cb7fe716f9d771b858584bd47d76e962aceb4d676ea86a6d4c1a10e70ce194d2ef2d9245c6867e6e0964080eff107f8dcdb4101f4b1dc202b1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5394258c69c2885176e5723a6d9d5bb17
SHA160b11e7a735b649bcc65f584fefc1d52c4c96e98
SHA256cbf9718746700b45b8dcfdcbdaf76dc6b255e4536f72c9dda0691b5a3d883d7c
SHA512a5345de7c605d36033c5ba9e0e113015b5fb305afebe4e86feda0ebefd869b786134850ce30a8f9ce0f1a1b1532a5783cb02d746111b3ee7202f91a501db4053
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab43eba589ac41fb5102c06a003d6e25
SHA1a4bf6beee65e625253f69accc38b2fc1ed00fd43
SHA25689992ed247c5cee38987809e4e4a98a7dd987fa1e2529b32819bd200459299e8
SHA512702d3ec87c950de509f85d9353ca7e60b5e5eafb6a8b46d36a408512ea538f8abebfe48305e76f77de573ac0b7dc9d575c4a9096161b3fe2e15da546afeeddf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff69a469bb18cfe0a1cf4158728cfa13
SHA16a242271bb8289bacd2ed945793ceb9481a17c69
SHA256fbb540a66c0293986b953d2677f6a40446d508e1bbf19479ea8289c743a31a6c
SHA512a376aa2dbfe4d74a7dea26870128abf8fc82c3258520afc136e33920ce9411187c3d2e8a2f5169cbc31d9682699bdb762233db3731fa61980ab69952cdc1ef84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5322c8a2db7b35e9d9c6fb668986874d8
SHA19813a2af5705b743d7dc9eaff0ee15e1a0a5371b
SHA256d81e398eda17aeb940e90543480168b10bf035418190ac282bb1f4fab85cbfbe
SHA51280dc412d4909ac29681f1d2f430940f394af2f0692f3d8b4608a71852af1a1b8065cf7c5b80e20d507db434892e9e253b2e760d46a8e2274f5c7c8cbe0994573
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cdd40da5be586114761a517a2710c13
SHA1c9d1438c87a4d7ba046e27f73621d422f249272b
SHA2563bb92bc622b63a2ed68b005b7c7058d728eefef96d5d389f1994b388340f0e72
SHA51202739ac6b7727694a9dbefc71050cd7be639f7732793bd229b148da3c82e36702603eb63fd2ae51fa6f5132d640358aae2126841bf905f6555d9ea2ad2ecf54d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5693f411d31668cd3a359d7fda3a42603
SHA127d72dc3e4cdbf32bdc30485a04bbc07924d993e
SHA2564f2e09a53e5452388f9bd336a88cb86336931706a221dec5762d956c56e244d3
SHA512e90b705d08276b24d5b896725334995f08d7b601f2c13b9b16a6de2518992c3d0af1bbbd6dcdecf2b5a4ea52e4549e6b6e498614516262a49dc7ebb3a9118f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572a1572de8b8d985f6f99332f7d770e4
SHA1781e9f67dedad577ccdec2d5a717f4a50b8c56df
SHA256bc66a48d68b6c8c6508895883389b60fd8f128b60e67dea64d61658f151514de
SHA51270be3b5c99ddf49945a140f9baa45e04a14f8b810a82e8eed482d11eda6eb9d30a66484803bbed4d7cafb19ef81159d70903554d4294aaa7f460f1bffb153eff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52197faeba469e987d4b75d5f1d4f58e5
SHA19bc645cbe59555f0115d3ed16b02a1184139debd
SHA256c3261487931a30479eb5dfd9bd9367dcb7b871ec563a5fea4a7df9701317b42f
SHA5125d714d3190a947cdf73a7fe485c2b26c05a1d2da58c7f3f8c463bd402157149418c3871c41046386454e9669f898e11e220f2876dc6d4111633670a04a832ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593e39ce03648e579abd48310df702456
SHA1cd47b55aa16f13b65d20aac6a84e492d66f9be4c
SHA2569c7ff3aaf21c431fa2e352a47e16e4b908ff8e032136188464257bc21b1399b6
SHA5127349b5e5e735cf51af99c47a5ef20abb5f331235cf4bb0fa8d803c0f49f0d0a48090a35082bddb34cfc1740b4f5c466089a2872f798919ecc7479899af6d362d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06