Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 06:53
Static task
static1
Behavioral task
behavioral1
Sample
5adf792f1a3604695303ce6566a9cb4b.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5adf792f1a3604695303ce6566a9cb4b.html
Resource
win10v2004-20231222-en
General
-
Target
5adf792f1a3604695303ce6566a9cb4b.html
-
Size
254B
-
MD5
5adf792f1a3604695303ce6566a9cb4b
-
SHA1
2a05418d822c202bcfdaecdf85948bed8594c1e8
-
SHA256
eb6d3fb403ded7cc36ec185970a581ee250021690c99cbfc92508da600ba9a96
-
SHA512
50115c307626707ea9cadd6210fbc07a9c4047ee9d47f438da65a7d9f8f2ceccdda3f93c3ee930691d5fb98bbb08547a518f525ccbbd8ac6b7b76b98ff774914
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000c0a57ea95fa24568b35890fd4ffcca8ab7bf7ba7f25f2438276e0571d827ebc5000000000e80000000020000200000003b5c4acfe9c234235702430b66c07c2041ede458b901303625f7c2b812eeeb7490000000e46dad9ebfd4b5970daa361ef1dee0c76b1750fe03e2943a9c48e889095105e2232c0b452475e4d33fded86d6ad0dea96d15fac2f7c0cbd05b65994c3f71bfe89c101940c3855e23c88559424f34655639da983764bd3fee2078e9ba6ef1eb4d2e2272e8ef2d575d0814573ad73ddda107c73a4f80637155459bd4b1e25f963924d47d613423617fc29706c04243b42e40000000b75d7406c8ad414574396e972e066f2ca2e699778d9c093f5bef54644dd1331a9fac5e4bc202f3f87fcf1d0c53005284a51aeafd8d708a046ff3804985d091f0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE02AD01-A4A8-11EE-B331-6A53A263E8F2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0df9683b538da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000015bcf8f30e4f3262d359ad6902472a4b59fffdb09ae69e63f4a6610a71de465f000000000e800000000200002000000029e2efc2ec253665bc6a1a97b335351fc4ba0f7448f8452bb8723c2d7a35906f200000000db24fb65997815865c45b2acc50a8de1c88cc84d93023ea01e38b0211c88cd64000000070ed78bb5d11f62c94f030bd21c220e0107064176f54a1c21ba60ebd517fd1f65c234a867f776fab8cffab0f5883c71f83d561d6f6ccf48a3cf4aa07ba77f373 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409837371" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2400 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2400 iexplore.exe 2400 iexplore.exe 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE 2132 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2400 wrote to memory of 2132 2400 iexplore.exe 28 PID 2400 wrote to memory of 2132 2400 iexplore.exe 28 PID 2400 wrote to memory of 2132 2400 iexplore.exe 28 PID 2400 wrote to memory of 2132 2400 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5adf792f1a3604695303ce6566a9cb4b.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5645d34e271110761e187e4e5e1b8781c
SHA1ea643ddb9bdf22212fffa7d287fa993c4f4b26ef
SHA256f187218660b4b4cd9f13d8065d72c1d6973d303b50871d3ab6f7dda1e93f06e1
SHA512b384ba720e27a0222371def14c911ad223fec04175503926e22b00339d296303175e7181553602e442b6303af1511c5ec495b8dcae66cbac82d6a489a4100050
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53daf2c5a7807cbe3e26098d89555d8c3
SHA15107c94258a481470adebc0b6dd45549b50826a4
SHA25696523e05d2db4f588373f1a6181bb077ac16ab1acbcfca6c7915ec7fc009d972
SHA5127e9f3e55d75f546d12cce252eda79ee8422dd0791485bd3a24ff4339341c96c5e430f847b9991212eb4f8ecfdc3bdf050cc4b5cca224aaea563939686e1600a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e004e1a47f169ad08e256297c93777d
SHA14eeff36ca53518bbd63a447c5b7b0b59cefaf3df
SHA2563aea3892f0012fdc0fa371354814d3b280020fb16c2a57ed544de5ac234ec787
SHA512f1553c383147b55e3e34b52d3e9ab7392f38a87ad7e7d94a6df5942009af3fa0578cd13d68da372941c393f83bd01ae0c33636dc92dd6c181bda1cdb3bcb517b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bda4aec81a94ff71fef38357e0a4909
SHA1f5e5952195445a89fb5bc7b69eff9cce6c12617f
SHA256e990f6513a284e32bbfcb003be7200d859115089dd1cb7d6a69e702948d44815
SHA512d3353b1d42344583aa2deec20a232192052ffb88524f96a2ac9be741fb6054c7e880152019525540f54d023624106f7e262b3a3a0193f03ce228d958554922dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56600fce7705c6f921e04adfb05bc04b6
SHA1db0ca032b9827c1d39b48b5bbd5e3fd542e953ad
SHA256da2eae1837b8e2393d41fdba1ed589073c344e1789af8fe459f10f7fd9f3826f
SHA512587a91fbb616dffc717e703a97961310176f332c683ba6ee2218aefd0cb11c2448f20985caa64692935df53f2ad3607fb98c64867824d6332bced525fb42d041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe148eeca49d8aa9f4a600b01ccfac08
SHA1638947ebaf217b88ac2850c7c0b103e7224e8506
SHA256217021c8368380e92472d3d2a2099820671898d7a60c88d9be604db05ef995e1
SHA51273507f3482ff58400d5fb22055f3f5feed4135d6e0c711af402f3349507ae5cfd24098162a444d20a6ca4a405c59177c38296ad63eddf65dfa5d5ce1a44cf6fc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06