Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
5fa401bc06a1e42aea8f0a58f246419e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5fa401bc06a1e42aea8f0a58f246419e.html
Resource
win10v2004-20231215-en
General
-
Target
5fa401bc06a1e42aea8f0a58f246419e.html
-
Size
16KB
-
MD5
5fa401bc06a1e42aea8f0a58f246419e
-
SHA1
9e74876aeb513ad113b8c8dbd7c684552e93b4f0
-
SHA256
472eb16a1bad68f1d58834fe55e95e5b758c726671ba7af95755462bc32df958
-
SHA512
1bac0beeca92f0c0501e15ef43ae0fe323a6078faf3e0cbb5ef832e71f127a56a971d95d7e0ba52b3ef3b467f6b7298db2a1fb5ad1f94daf22cbc30aa8c5393b
-
SSDEEP
384:S1A0xbuKGnsRXCT1znJs8Nq38roL3igUBFGjjvtLsQAC1U:+n5dMeCTJn68NqMThQ2q2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a9f7a877e6a76b1187d50194701e4436a475cf7672c3de97c2580ecc4c27749a000000000e8000000002000020000000d6371a4aff24ddb8f4cd7023547d66908ab78de4f8e1686bd289b3b89a12a74520000000f28ffa676ee0bf363cc0e3811a98e56489c256f0e7fe2fa1e488a13801b7928b400000007d3bbc36d1c056f3da9a2c4403b2c79d08eb9642ed7ecf96a61d46e3a0ac7409b72b43f401100f21977db3c62ba618f4383359373f08cbb419d97be51e18054d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0DDDF211-AC5C-11EE-A00E-42DF7B237CB2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ff863edf5a6616b5598059b429321d389f42b1493458e6bc25e5404e63246a98000000000e8000000002000020000000aa34c4a105f4ef7585ffa62ef4b8ad231e91c371f4aa797e98cb9fdf4a71b66b90000000c825905b1f10ff9223e22744b72a6cf7e983e98cf669bcab18335f11cb492942132f4b975e44fa047c05ccb42a650eb9e7ba917c76fd0b059f17a3ac1f02ab25747baf74b9c89ed413ed2f1296a7f066dcf4ce58ba3df580ca996813d09bcc964a8f336e506359e180e0ce11e0219b18444b56c813f20e8969ccc140c6b1820d4bba7a7ee0b596473ed77e8bb0db9cac4000000087025fb325714089db3d0cbd653592e27d079fe91eee34269600b423918ae7dca799e8b4b49f40ddc2d4c9e1eff09e7f9ecf243ac90f95f93970d54da9be58c9 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e1f7ee6840da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410684079" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3028 iexplore.exe 3028 iexplore.exe 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE 2404 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2404 3028 iexplore.exe 28 PID 3028 wrote to memory of 2404 3028 iexplore.exe 28 PID 3028 wrote to memory of 2404 3028 iexplore.exe 28 PID 3028 wrote to memory of 2404 3028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fa401bc06a1e42aea8f0a58f246419e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2404
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592eb5275bae1b39481971fda82b26a45
SHA14d632ee79b2eea0b026824fd613730f07087ba9f
SHA2565c5ed299e79f647809f762808b68daa6f72d8d5c90018fc0aa332280bfb7e503
SHA51248b0a76d7afee31d4f6adae8e9a3817baad3f9489337c0706ff81075e6a4c05834d174d1579cfb111448d15d552ed41d390023d59290fa970557cf368f4a6ac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588f8cd7156a098e78e42964573baacfa
SHA145ab6019dbd7cc98e6d05a7867bd3db9d6354fa8
SHA2567f725dc01582b3eaacfc3af9194772d986aa6c5885084c7b234a36eb762758e7
SHA512bdef89dc2d6dbeddd837c613c3d3a59c4c6452190225f52dd3276bfedc1707cfbc6a50120f58edd44d6560229bb32955d62aceeead9e7e8b2785c46a8201c68b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575131ea01c2184237543dcb8bcadae28
SHA13d3420f50a3f45d2fa85d369253d17edacba00a1
SHA256f22f7c8d0413a1b6a3c69d14f706588277a5251a611c7b8b2181e521c7046546
SHA5129781a6e4984c6c97e21c7183bb49f04a6f912e7a220ad4295e441c334ca68bbd94721e821e865c2d1bbc80cb93280ac6e2f7d8bc874a844116d7d18914a7ff3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a6edd9bfff27901fa5a14f4051af9ed
SHA175a43051a5e12267c75906b468fc14e9350fe501
SHA256983f8afafed4271ed2de4f368cc9985bcbaf991aa05400593e7cca051ff8aa20
SHA512f0cc635ac6519bec2d0387d1d9a776071b031dbe7607d58f51f2847addae3170f0497528ee8b8302770518c51b59ccd2019fcc3fe0edea2733e4cef287852c84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc50b0e5a74968bfa2bcbbbf5b7dc3b9
SHA1dc827cadc72e351d88168f36cc0ae7edb431ac5e
SHA256455d8970f5d6469652fe58127924f008e7dfd95998c4693816b44eb5813b41e9
SHA51243321406e19bc5ebcf8e014a8987e84f0f843ed81be706c99791153c086a0f9235b2ac7798a6b9f114f4603417fce11fca37aae6e9b46175eadd563cd98c8cf2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c721314eeef25374742cbaf1be85d31e
SHA1982f91ab0368209ea12776358e22bb5dda6579e6
SHA256793697932c7aeec37e91861b146cfb96f2f51eea40b86f11abef2695617f11c0
SHA5123395f0c81eeaa5bdc8ec920d5d71117c177ab23c24528db00d8a20bb3c41717e6ea3e6e83da452a04bc255d54b5558198931a80ef04d195af1c690e886aa8f7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578a907480a1b1e085ed1a3ad1b342003
SHA123c9633a1a0bb48371b62e6ef3e1a4cb320d46cd
SHA2567d2a319903780e8a3dec11a98839c6afaaa8d5597c5343c2b6d3013ea1d30c38
SHA512da6add246a66e4d2c22de658b6d84d806fb41c4d09bf5d407356fb8c235e60839b48b8e2f4cae0eb16c0d5e77afa11c06075828fd272fe6b0a68c4f361426061
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9e8b7313781c4e13bc41005d8982e3a
SHA16233bcdd54b9ca3b1b6d810da1763543f17246f0
SHA256d87e43cb868e631f5292c3c30bd4f6e0bb33ba5938bae1362141bb273beacd13
SHA512fcea089b5f26b155f72bc09295a99ee451ad1a2567e98659b3b6d53e8d0fbc802e3885012bf54d9d84c12ebfe605c42c6972deace4bcb12298dee051e7c94c53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a51bc15285f2e0995966a6e52e145d6d
SHA1786a63acb6f6377343ca356ce71616ee45525154
SHA256a480e1973b75da96a1e9d5ba258c1e03eff9fbf43c1d9146a9d49926b8ef1840
SHA5124fd6aabe7c69829965ec44cc93e23a918b2cb10756d387e8cbcbb7435be7275be9ad80639e8d15a8ae7acd320fdd88ae93dc607d84e088d6a82f42812ba76872
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edaf459c41859ac39ff619e642f81c13
SHA17f5dd99f9c04281c893a78c628a6a89e5efdc494
SHA256c7b3012862d54864cd7c12355a71ee565ff22f508d8de4c957cae4b6e61cadee
SHA512be128cb7d1f424a06f51059a2e00eaf4b8b9a38d04701a0ce629ade53fba5fa7d33ad58727ae5048cf9a5c75d4ecdc08ca7a7184736747924a00792730334453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57506f8d40018573bb01d6655a949b414
SHA11ad194f47aa0bc8d3ea5f5867407b2a01d3c497c
SHA2565fd13ae1921cd34e552eb51ed22f88fb75e86bc71f7510ce5f2aeec5a0fba2ac
SHA5127bedee399172759abda9582b4308722e2bc9d7269324d5a4a84ecfa46f89579c54128613662a0e0dafe237a6b3951d03e1242eb7158cb10ff0fad946fb674221
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06