Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
56a9346f24227beab699ffb90b9fab35.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
56a9346f24227beab699ffb90b9fab35.html
Resource
win10v2004-20231215-en
General
-
Target
56a9346f24227beab699ffb90b9fab35.html
-
Size
18KB
-
MD5
56a9346f24227beab699ffb90b9fab35
-
SHA1
359636b6e0a2b11454dfc81e7269f5fab720d24b
-
SHA256
e2f907c7fa04f21fe8799bd619bd424d08bddbce7650848a8722dfff6dd00850
-
SHA512
4767c1cb134523b8b1fc5874bf9d49ecec02c19fc0ff6ccac7c11937ded10fdb5a9166583fe432b760015e950e0b74e2e0d1d5385a10f54dcafee7f230722583
-
SSDEEP
384:Xf7iELoO7trlTVo8REQ91TmhIqp0cYAeMM:Xf7iNO7trlxo8REQ91TmhIqOc2
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{482B6AF1-A497-11EE-BE92-46FC6C3D459E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ee258db1feaacaf540a744a0a831d7766626bb8669398371d6a76b590904aca3000000000e8000000002000020000000009c41e6dbe05b5d08cafa71d2e17d61c7ecd96db56612b33ad0081afc4005312000000032b0de74096bde8c7e6c67ebb57d94d380b6d71b9841cb6a24b1a6b4fa539f834000000070db4fccdb3e6e0ef81e65609d5efe8c6123c2a609f61653a8f3be5fd6850c35aa823ee1ab980dc0a1275d246fdf7f4f10d0049be0750b97cdf2a002b7f1a03f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409829886" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c71524a438da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000b65424b0085722d584730a0ebe5c1e373caaa4f391cb55887e5a0e32ca3be60e000000000e8000000002000020000000df565ac6fa2dd418bf77acf52376c25505354d22b87949d25aa31faddfdbc0ce90000000babe8be8345f5129bd64435d857e2cb4911e9e2640c5df0e64b933361397f921587ef37cab839a326b24042055515cf99ae5dd5390357bcacdf0465c8fbd1bd43ad5bb5265e0390bc384b1b9a5e67dcdda6acb14e37960291e1a3524f724037f65bcdb82c9a4128f395c02d3848c6c67d339663089668ae23a9815c814a128dfedd5ff970c21b9bdbd611c96fc0a898c40000000fc3dd8e58e63b14616b3036c347a324e08ed82093b8bb5ab54d649eccb853a89c0f8280c2eb81f5da004703e7fa0b0e7f6a0252a74643b14e959a0bc98f14f2e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE 2372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2372 2376 iexplore.exe 28 PID 2376 wrote to memory of 2372 2376 iexplore.exe 28 PID 2376 wrote to memory of 2372 2376 iexplore.exe 28 PID 2376 wrote to memory of 2372 2376 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\56a9346f24227beab699ffb90b9fab35.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2372
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5f34f8025796bae86422c213351c50349
SHA1fff55dac328003d6acc1a81773f0638a8bee20cd
SHA2562b81393f459316a0b52f3e7596b3a696e0cee6a3d81fc87c2b0d58e46b7476f2
SHA512edcbd5d301f59d920fe86f5de6adf19b6d08969fce65f07dbc9b62eb44dcaf957186388f22fe560064c9515ae29baed925a0dbec2b4925de7659077c28decb31
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e35f302ef000a0ab963e0c3e4f129233
SHA1885bdd0575852280332f7d94d3068131e5c97a1b
SHA256a148bfc61c37a404f20f3e3508c46a979ce09f72399a4a5557d2829e05e8e6e6
SHA512f716afa79a9dd3dfd5e4a943004098cce95b1a32b81a194a581777df9e7ba52288606cb9b1fcf8c1e1702c2f57736c52116459887713162ac86195049527d137
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573345b4dce45e70f4dd1b269c8f586b5
SHA17c083c025caba4217ae2bf835e95943e0433cf3e
SHA25605c591c8e71252d77cfd5e1637acb3c55f176d64da0e22808c2e7c4bc516909c
SHA512c5be8de18e01282cf60972cdbff5d3503a0f4687b5cedb7dcdc1fe66fbec6e63996e5f0735f2f11542531fb89a2d3525432f81ce21c6708b6dc635ddd0a2c5c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c01d84d72f61b04e06dbf12b98843c4
SHA1a48fda8852136ef2525f646fbcdef86d5f9205dc
SHA25601c2e32f07fb47e349b4aa2793b079c135d4ae0918a1e18ab811fae4e00c1018
SHA512252cdc782313f53cd94b6c925222d4b782c6cf169ed031b50330ae2a28d9fc9c3908ace3a4620af108fb7be63ad036f49f6afd28475d4241d08f8e9a0d1f3471
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dda28fb637613edeef933e33a2cfb3d1
SHA11192c79bfaa657c870a486447a7700a66b6977e5
SHA25635cbb125b92088462c5f5f7e54d80224ccfb8f46b8fddcb5da5dc50cb0df2fb3
SHA512e458b0db7897831d1e25bd086368b8be6cd8ac5f0a888f28fccfc83f102e26314fc3402213ab5c05f2558cba362a958cabb7dbd5db937a8089cb27c1dabf5b97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c588a8bd3aa9bfd930b47ec416df58b1
SHA109ed1b517c12a12f65314f019d21958defaa96ed
SHA256280746d7ce847530eb18c8b30ec1d9508026ecac150ca851bc7d559383951346
SHA512c9375015631b31588412ee377805a717141fe81755b9324a3e270c0907308142bce07f10303259f912ce3722bcf01343f47623a6578af601c46c88eb1182bd1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd313a16122acb96bd12bd49ce2ae6ff
SHA1918f62814ef03a8301d37c8f0854fb3d465e5702
SHA2566318789509482e8ecdd5b54ca09212ad1d1fb48b4c708b208c1e9cea13e9b0c9
SHA5121fa7890ca6e70c7b2f068a30f7a4465b7fb91f111e85abc50f5348be16bb4926839b685011fca686dbf72aa99ee8ca2fe096a284e6adce2173aacc0c6e24037a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec52103d0d7b46c410d10e55146e0beb
SHA14411609fe9d6350026e77688f4f6ca4461b70135
SHA256f6252a50aea1c678d07c0fa131598ea91b49ff00180f7dac251ee9f973aef344
SHA512a74360d71be0863f224402be480f83cb6458064b3d2a04d1a1c195f852883d14757865c473fe370fe90df7329e6a106b14ff70049abcae34c444f6f0540bee81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5841fb4acca3814e5f9ea1db26d4320d7
SHA12c42f4c684405abc029fcd66bcb5ffe47d4dfcc0
SHA25626d6f88c0ae3510af42c846019836a1e9c93114c9ee427694cb8c6bc3026cdd8
SHA512d1ce33315fcb0a01d5f136d23ef0e205986f6991ba8dc8930b008ff28a0e09d1fb8066fd6b93fdb818b8854e137069a53d45a6b064666cd7a64b74eb437ad111
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba9dad59a89aa9b7a86a0c9e5ce5f897
SHA16a11baf7db1d124205c221db6f8cfe998c0072ea
SHA256ffe58170dfee5855cb3bef07b7e5d4fee2ab0d5acdd889fb6b3b1e73238e07b2
SHA512dce4d772030aae24695dd9a343c948c48378f7b8b95889169833b10ed951fbffa743eb4847e51e963dfc8fddf9cf6f9c7ad5ba75507ed04950c21d38445b3f5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c91122960db01109ec75809f9c357194
SHA1ca5d220e47297b7b1187109cc1273d6b976335e5
SHA25613443068ed1d580a979e8675e1dea15afabd77b21e5f2c922f5f4a625de7c11c
SHA51224a8c30ae43949b9f4682348d3dabee74b761d4768c17ec17103fc2a4eadebda72492a535afc023434aed54552a38b26512948c7a53e753aa24e0fe3007c077a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd2991035619b9c5e5d97f2916be49ac
SHA109d04a99c3ef8ecf7a56875700317d48d3f6dba0
SHA25613dc78311e9780e2508f14555347c24e248d70a7d814788515e31d4b33ece755
SHA512a8fb916ab4de40dc2338e165182ca852b19cea9240054242ac232e7910e4371b8a93a7276fa1de15b2d72dcad5af1f5c93b0d1795b6ec2aff1d1651fa872f78c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD579d2cb5f10941b5154db0765c4fac61c
SHA1bf13e444d5741affe55fccfa63312a7ad5961e05
SHA256313fd03d08f8820affe1630c5488665355bf54b859a91efc1d9de2195c9d245a
SHA512d72bdc89895ce3593123035b46c6dbeb99c0bf7ade71e960c79e4225eeab2e1c5d6165cbf1b4e137cbcfc9ec14f99c23a15041863dd1cd928ec5b1823ad9c5e6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06