Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
5bb893f095a4abbd2988a877e98eae85.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5bb893f095a4abbd2988a877e98eae85.html
Resource
win10v2004-20231215-en
General
-
Target
5bb893f095a4abbd2988a877e98eae85.html
-
Size
56KB
-
MD5
5bb893f095a4abbd2988a877e98eae85
-
SHA1
915294630845a561f0ee71ba5c13c811d5d33fd9
-
SHA256
30a5c9f8d1969406a2e0c926ae32fbd25b1f4e42036ee2988b9b5bcea1338495
-
SHA512
d67bf9bab7d8251dc4a748cd175540e7828c9d49cece7618e88e24b69c17353a5f92beaf716e26384ca2146a264dae1f1887c39cc0b87b670cebffc36409df3c
-
SSDEEP
1536:S1I9fAT3Sd/4LwL1zj41xRq6uNaaQi04REyGKifyCnWpH0BIzRxUMFV4Ujukp74v:S1I9YT3Sd/4LwL1zj41xRq6uNaaQi040
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{650BE491-AC41-11EE-B59C-EE5B2FF970AA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000059087ad0d0308ed0c80d7a3f1d2cb5d1c8bb70c2ef580b722fdaab5476ba3b77000000000e8000000002000020000000c5e3e0f22a0378f8d26772ee9df8d5b753cf7d94df80ec46f66dba8c82ab791a200000003cfb25c459e03baff41e2f8f9ac4808c39a616f5f1e6923c7ed9d3a6e65da3c84000000008afc02a0131c1b76d2171056687ada1fa13c739fc60653617a3c4fe66eccaf742a1468f265ba46ccb0e851c33f3c23dc40074b9f62bef2031f71c4bdb0e1031 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000679d9f035e5a0b218fd8aead7e944f9acdea8b43a9a0f9de2fbbd1725ae7badf000000000e80000000020000200000000238701fd4612355612d62f498743b0dffd9f7a38ae598603400ddfc0acc7b40900000002a3f0d35b1d4803dfdaa4515599dd5725bc339b7e7b748e3a8e3248678180cda1e6dae86cf4f25f19ebd805d6ecbe41abb969d8dc6dc027a99b8864404470203cccacbdd6fc11d1e0f7f2b4a085d9e0db509cd6cafc2b96e07ec452cb2f8f0089443c51131ee0e0cb62c76536e19f44a6685fa151a6a3ef4429f649ab1a921c41defb7cc6ab52dac03fe1f9f7a9df82540000000a68df5bf3f6b6d9666890507b973bda4afe84992459a1d46bc4a9c5244363bc398f268286acd6aefdfd02ad77129fab22f76fcb10813334c3d2ce65ae9c96f62 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410672620" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0a50b534e40da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2252 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2252 iexplore.exe 2252 iexplore.exe 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE 2932 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2932 2252 iexplore.exe 17 PID 2252 wrote to memory of 2932 2252 iexplore.exe 17 PID 2252 wrote to memory of 2932 2252 iexplore.exe 17 PID 2252 wrote to memory of 2932 2252 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5bb893f095a4abbd2988a877e98eae85.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576e9f91ecf846a65889f21ac7959ef97
SHA1f9f8ec1785158b0dad8b6a6b7619f69983ac6e0a
SHA25697c8d156357889a38d17dc10c21b28fe030ef5a0f4126aea4109e129f648dbda
SHA5120111606598f179a0c282786fba2605b3f32b79c4cb433bf7c906201bf22dd90375a232807d2f082f13ce0594662f35fab6cd45fafd629b34cb906beedb7b5d92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522a5fef6cc6651873eec14feadb473f2
SHA1bb2ef80fa790215c79a8038a49ad1eacafd192e3
SHA25696ed7340339cd7f4c04483c40f07417b9a98ffa83e4f88e17fd9e6eb09a503c4
SHA512fae45e1ecc581d9f07f9ea163f0274e564113fd1046be8930ff65e80154b26344bdcb163d190331c469c27f137ae3b0c004bd443965d0a5e897e41d1f384d5e8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594cd92bf04b51ab1bff982d614a34d72
SHA15c4db8f4616ef30a5092c88728c6feebd3dd8d4a
SHA256603c1100db2d757db321bae42a6ec0d140f8766fbf14d9cad8fe7118e6ddc75f
SHA512d2a1714b0744ede71c1dcd52f0c38968e191a8c2fae7451751209b73074897a7c850edb0c94603d8fcb27e6c7f6a32ec44d9d7df6c2a59ab0bdb0944f69ba367
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6beeb75cedfeff6650751677ec50067
SHA164a775255a5872f5a41b505e2a34d9dfd409b721
SHA25691e8ab9ee681ae2b8d20055e334609c0989c8fa1c57e4ecad142d5454a3e9881
SHA5127670af2881e8ce53626ff5c1f24ae71f0f0b24171d71faadaf3fce4dba8a409672cace8bb8f16a9cb4d89b073ec46a82d7c9038f75aee1dea7952399d11fdae4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533573867442733f1ae751123f53ff1d2
SHA197f934ba06403badea11a53448821cc3e6da330c
SHA256a9f8f6174c906b9addaaf1c206d358f3f673179bbb05174c3e9c17491fed51e4
SHA512c74e81c463436296f490107be06aa6d132abac319115fe07e88c04046c385d8dbc24fab61b196f6540d5d8757af7efad59ced6404fd5692109bc63bd65516239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb4e6f36a8daf2b5868c9bfaacdf9229
SHA1f058d511b2aee51d4de9721517f74f55c9e3f923
SHA25629faeb0864d03458b6db4d45e86dae1a340c1a8eede007a840697627fcd2443d
SHA512ba23896d183f99db6c8aeb671c06bebddf923aa666bbe6729a108ae7802f20a893b5d3f894c09d9b82f38254c6a5e698bb6e2c4f79d254ad8696d162781c0f77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c65cb43bf13e3a180242531afc551b93
SHA133a8e421f2aa0c52ccfee1e739f9479e3a5f5c1a
SHA256733a2d5c8d7bcd171c0b2830e804875dada67c13e6c80276b69b19ae62c65681
SHA5121d14594cc239edfb7a94505b39bad489b9eab0d6a7799385f7fc7103bfb56d4a03f4a73d23e7fac24fab9284461d187d00a6140f9a697b321c0d0d63ebe00895
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577e61422abf1341d9be082327a6514a6
SHA16e8891aefcf20ee664a7677b8478db9c396b4d29
SHA256cede47bb77a0011bfc8677b13210a85b0d14b188d60e7848504ee4c430034ed5
SHA5128b0345f2e479ff897e012455fc37716394ca4eb6b6ae3a4286356f14a786d36227389f847440f5ef229d62551a02078a5b6301c6e8120a9017c0e549185e013c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559f8fcbdf4e14949c2acf80a0f48d2c6
SHA161a754c6b82947599177bbdc6de809fd296ee446
SHA256c044354c54426c1afb7955ee9f50d2f86c33029cca760f0e6b53d6e83e704465
SHA512a52bf8b1c804e74fe9ecd0909221fdf53089e2aec226c7b9c9ac4a5ed4dfc87f77d188531b1bd45c13985f026de0feccd163fc7206e248703d1666e17a97a9f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5785606dac8727e66afd8728b4d8a6a3b
SHA17d4229508d7a770ea6688ca84992938ac0394568
SHA2567882a11cad05381be864eeb43b0cec0973fe1b530caea07dc7757ed350f2de62
SHA51281f171ea6dd4594e1bd4af5292683032e65a9f817f8fedff7a9e3910d5113e045dd47de121150c0fc40af7622eca76599f7b25d49850e6917901deb1bc7e618a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b7a96d940e713e5f745f04df39e0720
SHA1a4d58d3a9716b2eefa35fbd6e0ab0d179e01fb94
SHA25649011ce40502a75fef9cfced67e3f0b70a2a0a6cfca6354e04ae8b76a5043fdb
SHA512a8378b47d53e28cfaaafeb47b683136c5c28e19552b2fbbf7f48032e0e94a45aff8d203c5c18d04ae79ac2082386bfa281811837e96a01bce3b743b3280f23b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542197cd5e0e6b616ec63e5707a3115b6
SHA1fca2030f761f8cbc08b88a5a58b6c268d2301375
SHA256f1929c5fbab5774ca898b40e237896c237fc8c4cfbd698dedffc252db4cba783
SHA5126a6dfbe1d4789a41a09ec2fb745de89c74b5a566b323485defb0b7d2181109c29155a7cbdd861050ef8d15385480635a3961da4f253c0f7d83465f44ac4fe8fd
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06