Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 07:38
Static task
static1
Behavioral task
behavioral1
Sample
5d0979d70140e26cfa8b0170c36cfcb4.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5d0979d70140e26cfa8b0170c36cfcb4.html
Resource
win10v2004-20231215-en
General
-
Target
5d0979d70140e26cfa8b0170c36cfcb4.html
-
Size
17KB
-
MD5
5d0979d70140e26cfa8b0170c36cfcb4
-
SHA1
e0056dfe5b410b6951be6ff7c6c668ab2a8d8f22
-
SHA256
6de05f6095ff0dab578810e62338b38ca5c7c999ba42b407a1dae610340a87d9
-
SHA512
6921afa6cb5ea01e18b588a06f057164475ac39ff9c2c5a80197be1171001f853edbc3028ca086293ddc7c543a355ba731059495e5c83eaf7b9ba3e94afd2149
-
SSDEEP
192:GiIeRXW/8XRs+Q+hS9Z5EUsBHMzteLXysIU3e2MbfHoyXaeBNZWiyRUhJRw:fZRbQN/+BHMULXyqO2mfIyF2
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003f418b16240b972d3cb30913ccd75e6b86ba4bc8f97ad87eb46418f3106d52c0000000000e80000000020000200000007e9fbb1055d4988bc9928fb862e5172899067d8f83c862c3868dcd319fdf765c2000000012e9d6fde54f4ac2802b4249a06204e624464b023f720f1ba78694272543ce2840000000c2d16ed0bf341bc6371f044be9490dfc176f1626164d007fa9bc7216d01b545a7f655a4e8950c921f0b6ca77f56951210e583c2781292bab777103be8b290338 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0029fc51bf38da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a34445846fb11962f032d9bb67e35b038c12126b584ae1c153fe634cbec315f3000000000e8000000002000020000000c57c93e6da76e8e16aa39b46aa79812d237aa843c58566dd3a7bc46f6a1488ce900000006b3675ebbb287bc18b8f5fc717372c5d1c096c49f319956cc4b34c30f5dcf8cb7301cb3b1aa12ae54e95d597e271d9fb731483fd8c3b92a3fc8716cf6219c72fb9516cc37cecb74cd60a2e6121ba4dd93d8ebc67c8dddc512472e76c06fb5f29f412e9c177a8df9e10a0fff74be64807a04b0a48006356402058367e53713f5c461a5ab9530d42d2cad78b5c71761efc400000009e7b20cc299cb1bc1090d0c20a583e30511343fe633699f14878be3ed14053b714f9ae4140892ab84815c1bc2b596d2101e587d53e458e59c36306fa360b9230 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409841572" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AE59401-A4B2-11EE-8C96-56B3956C75C7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2260 iexplore.exe 2260 iexplore.exe 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE 2828 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2828 2260 iexplore.exe 16 PID 2260 wrote to memory of 2828 2260 iexplore.exe 16 PID 2260 wrote to memory of 2828 2260 iexplore.exe 16 PID 2260 wrote to memory of 2828 2260 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5d0979d70140e26cfa8b0170c36cfcb4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51672586720b06887596c4e7a8a0af483
SHA1715a922f01b984df3fddc409dfd51c94339ef322
SHA256b32b8aa08fe11f7e930573dc9f5f77cb66ebcfba8a30621247eb5594ba806796
SHA512aba081ee08c0b127fa1ee7590ca4fc193b20df7bef71c51feb1c1aa977081efe47e323000c7a5d31815f7aaef24a36a55dce8d779e71bc2dbd964ac64cc7ead8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54b83dd7b9032349ecc02deb71eefda37
SHA17c5f3cb89858fd69d93723ca448e6069ad589347
SHA256a85f9356a0c9355809bfe6dfc4ec4c0f30ca8e5258e1171e0440d028996e732a
SHA512a929d8915df7a3f1720fd2d1ab6934c3cbe5e7df76545b5e25fb91bf5dc00cec15ae77a502c86a3fc4405a86e13cb081dfa6c140ecbc023938541ec777d22c12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ed791b2b43e20260b18e0e95c961fda
SHA187c843c5ca4f3d6ef772f6710146876aeba920a1
SHA256de8afcdf4526181dc1e7370856c97f43abd99c571ac069ade4afdc1e61a1a285
SHA512262ca31ae27f58466ded15147e2a6d15a78eca48b73784809739e5f7aab233a666d22ada56ebb8343b587207aec53995edd5ba4052f828627bbf01092ec29ce6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b50dd9e2ea567134877c80aa1eddf5f
SHA18319010ac0b238e3a2b3e151018873311c6bec64
SHA256767872fe4daa4caf722af8184fec7de7cc41b88c9fa928d5c4655e81303370f6
SHA512256e3bf423f73477e35524d083655a9b7a5a3fb1d3ddc231c7bc339c3a72bd0c6a77272278ae126a7e56bca5380a304d9da21ef19f44f5e60909d79956e63d73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58847dd0ef626181d774062cd25cc92af
SHA15ffbd74e3dd662fb2dd3e1a18c2d6cccd252c928
SHA256971237452eaf95fc9a7b78945f2ad93f0e3ef4967f0bcb0af01136be83246ccc
SHA512311ffbeade5b4bebcc19a9c64ded3c31b6e601a5ae1ea4709cee9c62132dc5c6c789b1cdeaaeb4474cc6f3aecd650ea867726a60d726236837d69f2c3213b3fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9a582f8e36febef27725245faf10f49
SHA1b655cabe0d8df1b285b0e7dd02b851a4f8aac08c
SHA256efd3814c3f1d1ac513491e67bee5904bbf01a493334ee3feedc79580d2a95524
SHA5120896a90abf7feb09c53788fa1a34c9f8dd62479bc6e3c91650f56366dbeab5f8238cffbcea4fba51b917bd34ee1a4487b7deaba0f31fb314bd3afe8e113010b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cad73fd4277420689014e0038a898348
SHA1bd900358e691fb18864f960748cda3455b1137d9
SHA25680fb5d9139e250f31021ef62cf7fff6e5c80864a6e966307c09afa96ae5ed79c
SHA51213a9cf0569ae812acd120f61b1929204a28399f308717b7efec6a0856b7fabda40d84bbfccdd5695d98b53f3c8020dce2af5ad6df7ceb1d8e815b5d8d0e6e665
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c772b120ab8e957be69e92031fa3ebba
SHA1157fea526188669a62cd333d128d8af14af31a21
SHA25693dd92427b79d3760e05919ee6301f2ed3d29b84afdaf820feb15369e64c9b3d
SHA5124b19c4c0c25e9f6609f4d9f17172fc646e143e5049d1c74f6ffb810c91cc3a61330ac6c596423fee1c6ff1c18f9bb8c9d96596d8913434095dda9411290c51b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56eac9f939b9a989245fb6914c72a21cd
SHA154275118e675d342b3b7fe21387b5af65dbd5af1
SHA25657eb4a9ae35dd33bad81b9461401e2e5556d77c1e48e58e34fc6d2598ee3e0d7
SHA512811b1c926d59343675448522bb4473f957aca2622bc80ccaa14b53b383c7da0b807ed8d4effba541a479b50fbed433e58735bfb968314d41ce4f68dfa710db94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bc237913efe4eed2ab8b8b45f86f5ed
SHA1b1f13c2b2c1a69315fc9dcfbc6d47feec2817326
SHA25646bc6218dab4a4f79d25a1309299b80dec782c552ba568ed6783f072482f61d8
SHA512b243cb41371159c0d1354076c410075cdf45b6ca4d17142ab7304720afa5de34b5b0f06c8b2f9ace2c845979f9257c2d81d9e9d616a2047d17017313beb77e5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d60187b5d3058b5de62f5789f122acb
SHA184f739ae69ab21d8cdfe980a6a28636aecd3bdde
SHA2563f3d116acd8f8e03928edf471d265ae30957a43d538037ad35994c32c828f5eb
SHA5125ac6d13092e39b1e580eafca889d076adc2cd7a3ee22db321453d212981bb60fdcee2bc15ea4f79fc9fbc13f16d15b044cf5638454689b4bbbf828b28b5876fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6c42a87c04ba4bb49b863c9cad42f63
SHA12c642a7bba6e4aaa775cf0c5f68558e97fb574f9
SHA256db98d0f25c8b26d348b426cabc7af1acafafa1a616e8b75ca854b2fa9e5f50b6
SHA51238526a2cb75d3704dc96fad08077fe32f3c3332762f3337ace12d63ac897bf2c136448916a2f4043058c45c662414548e72fb178d1444d649ccaa3c8509d5282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5480abd8729dc4a770a2766c0843f00f3
SHA1e3e89b083e6b55b80a484bf693a36ef0b3113153
SHA2568ccfa12916e796494f0f4cb7772f786c1f8368905ca170cc24b41eb7b93c6caf
SHA512004b9d522490e9235e5813c3865b860c1018b92308fe98808f16a9decfb412b4e14a2b35ae26c06557d73560dc586b1820b4fd1edc0766262d136668d108454f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59be09a3f3d6d37fb19681fcfeb254211
SHA11653c02a774a7f24ed0c8ca2b77b58ca330560af
SHA256f0319684113e3fc5f958c1cb22316e721ab0e0d60a32cb7d20620f89a47b3d01
SHA512089a4c64df3e39959a3763de7b8563724c6c75428e81b2fecc9c39ac61e13d5d7f7eaf9231e4b98d063d6abced4d804b7e33c1f6ef599e2e4f0357af1441c591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56adea2f77c392636668fad74ea315286
SHA1d1a00ef66afa4fe65e550288fdd14a2f533db33b
SHA25636427d7032e2073aacd32a8690183b5c64dcad763423c98d12798d4097ca3939
SHA51224c08af4075e6d0789ab16199b90c57a97c465421020b8667fc561a09d7bac13089b0654ab240f144dc2967c942553b7ed63c63333ef210d357f899fcfd307c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54da918edf1e77342c61f3a928ce260fa
SHA12deae80cb3e0904a902ff1af962e464a320963e6
SHA256ccbd38a00da137d3c40c8d8831a411af9b85284f4a1cb4a8a28429ef224df0aa
SHA5124ae3c61fd1ce1b874796556be48fda8a5c478c14eca4a1669c7eb560dfd96f4b62f34c5a848b249d1d15b8fbae227656d7e5bd66269372d8daacfda075fb3ab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560c935c6bb83fb1dfd30e2bba8e0a77a
SHA1109075c614e74c922ce3d2d9375472d63f4bfa7f
SHA256e20c9c4046b2f99afcbd8a3fcdee09523568042fec32a62ae9a0705ea3c5aa81
SHA5128c5e9cc1fe4043fb1abb6c147f206059fea038929443e99a52fa4a3feac0b602aa6fb37473e34c2737b46bd768ca35b04d47194e8bec39e473d269ede9e42970
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d14820b1a607f15996001afe1f9cfbb
SHA16a1cdecf2d044abb5949f9a125076567af6db221
SHA2568c36a86bb51804eaa37c74c2d462a45e5c8a3181a3db32868a614a3ef9ce69a8
SHA5122caab7a595c31454cb772f5a90c8e027d74b30bcfcb7e7dd7660cd146c6c5a8a1ca4e4e600869ebb2020d2f49b8feecd3662b08d90efcd4d1ea78cc5d6a36dcf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06