Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:27
Static task
static1
Behavioral task
behavioral1
Sample
5fc71ec4b2617320c69a94639c469c6a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5fc71ec4b2617320c69a94639c469c6a.html
Resource
win10v2004-20231215-en
General
-
Target
5fc71ec4b2617320c69a94639c469c6a.html
-
Size
46KB
-
MD5
5fc71ec4b2617320c69a94639c469c6a
-
SHA1
72d165e691030652fbe8c06369a3207f481c6614
-
SHA256
a755d626457ae49b53231a2546157790172b45e36790eddfbe7b4db838b252f8
-
SHA512
34b2de82fdc769020480741cd33dcd07b4f1335a703f7afdf8b808f937c79ad82eaf9168e0337d63ff11e37c726ddbee54b35094b28e23677b05fb79379376fd
-
SSDEEP
768:Sg1YptSR5hnNxz8jLvT5vrvdWfsd+vd5pHVdpG:SQbsrjd+vd5pHVW
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000019521ddd4ce8ccada5a3807394330d8372caf48d5d15409a433d2d6d2685d505000000000e8000000002000020000000d76ea458964df809a1abbb791141fa6063715423a28341619d1a9be43d4cf01b900000001516d759f69cabec394f6496fd901aac2e4d04b6082b884bd35b86c48784605d0797814a9979a6b27b004853be4da5a19b5d5186641d70e4779ac30b78679387ea5a3fd2f3ed4f14e1ffc6cd369ed02c99928bc246589c9ef696fa0fd2943217ae1da6965461a550a72fcb48d9c776363c75d862de733e61fa4c56d9b863572a0caf227c2df4676a05cd48ac6caafaed40000000334d723e3bb96ae547698bc5766ff419c52bee2be641f9c9fae061110f01d264f536bcd1cd03c779c9891be584c372593c3f37c84cb72ff27098665174eb8139 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B7335F31-AC5C-11EE-86C9-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000befc4f35d273916063923e414a07516eccf0090ca49d0cbe5903878fe01a12b7000000000e8000000002000020000000eb2a7749feff0f076ab305d1304802827003e8304343fb8c4ea67fed6230b6f020000000717e80487728a3a834e4bbef30453636df19c03e9416ddf675c72db237ebf90a4000000000c5fe209d59c2466bbf2198cf2e09aad8abc3db683578b5a5956bf2267571ddb9d9d038943797a234dbe2353936076a25ecf195a919f51a2d014180d478395c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410684341" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09048976940da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2460 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2460 iexplore.exe 2460 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2460 wrote to memory of 2632 2460 iexplore.exe 28 PID 2460 wrote to memory of 2632 2460 iexplore.exe 28 PID 2460 wrote to memory of 2632 2460 iexplore.exe 28 PID 2460 wrote to memory of 2632 2460 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5fc71ec4b2617320c69a94639c469c6a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2460 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec68f98d9ad9db86d0d65826c42b632e
SHA114f380d409d1b2cb475e7ab8a849610f1f4c2f8f
SHA256f303a74aee5b965b50161c1b6e23f00149138af3409566ec888251210bdc447c
SHA512f753c94df1f5d2b9f1088fe8d263d7ccd994d8a7f29b11c75d4e17a9941042c950dfa4c08cb81f60c087d70a472d3e9b597ed1e7383db1e565529f6d713239a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaa3e570a0975d4611b85a7744301a46
SHA1ffa52a5810b74aaa994f79c2c68d28797200c908
SHA256cc0b492404ae233e629fc7f9712eec69cb7ae49d92d5dee6eb31b695789dc3c6
SHA51295a27f29b75320e92b5302dfe54d980f595d185f77d1270429d220b8693e4ef10fb2e139720c8cca55960821c07cc04664f43eb350deaf5da23e0f6e4e2a7507
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c3d581eefe6d5e7f65d0533a067d261
SHA18b074acd8d2d2a88e56c632b4541895f67828331
SHA2560cd0a4f5b19f62885616b928d2132710ac17a1e8a452b7b1f6289824160148b0
SHA512e03e66f9a732443999e291bc44cf452e7c84e0879e8c8c430d232a44d2e636eb2f019fb5aea3335340e984da4402420c2c8ab8ced443a631dae4441835e8ae1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdee6b6c5290235c3fe30ed443305dc7
SHA111e4ac3d8fbc3a3ac609b7e6068cbe386cdf56ad
SHA256c384ad0b1a92142cf25845dff0742def301b48a2b3037a6a520d66b01b745c46
SHA5129973ca8bc48572239678c25c5cd71802a6a58197d526dbef9cbafb2652a0633e66f42723a380217b7ae2458c76ec1c700bc4f8fdb8dc2bc7759f08553d18934f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c53f1b22a60b098ca1ba34aa265a0ed
SHA1d227e0950aeebfe66095a28b38ce5223e03d5632
SHA256b1098125838fcd270fa2551b00acebb126de5f8936ef0297e4644733caa7b69a
SHA512d16efffc77b4ef3cd01edf315cc3cd9c7b924ac823eb0c03063458a68c5e6e002a187a7943ef28e1a706bbf0f658db026fcd2fe6910c6196b1316c63a1d8c244
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9b4e1059ec430c1b7d3d39879e4fb4a
SHA159fccc2d05369119d731a02848712db2c3c829b7
SHA2567c7d2b83614c4eec13e6a946e5881f936e0253501f2dd58c0d09fe5d4b8c9437
SHA512133c8dcd133d9159817af79993644f7867e74881cef14f63f6a52693d24af5c77481c775911cdef9a452cde50b8f5e40a12b3360768aca36296a05aad0a5c996
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5edc97968f7183e6e75987ed5fe0f37e1
SHA1cf8f41c5de0f06e33dafc1be3d472d3e67f1672f
SHA2568a0645d10ed9be880d9ee6a343285ddfe1381f406b0834b722b95bbbb7d406b5
SHA51203757b73ce47b6142ced3be5690948ceca0336a42177a516f639f4156dae3cc5dfac202d0f68734950171bced71de00d80dc07736202053e2d65ff6e412252d6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5088ac626f4d9c0a77edebad7cd5c2ede
SHA1ac90acdd7d565296d00e7e393c867c342eecf164
SHA25624a6bb45940643d7068989829dfaaf2638ecd7d3d0a4a780b4d52e8729604737
SHA512489f162a631ad7e7867b294466c0ee064350ee3a82ad8921ae036ece8162717a8c6ce0e953e1e0571eb51d9e2434897b815b2724202a1ff75f854e1bdeaa2fc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d3a56394bc6f46dbaa285a6da5f0a679
SHA1eabe4440d7fa979da6451b3f2cacd39804df084e
SHA256beb0e7650822e268d52cd404b849200867c247374bc24e5b9f392c9423cc06ad
SHA5122ed39394efafd6e739ea653ef19d79e13ae2e5c0de44a968541f62aa786d9cebb365c782a3beea2dc9c15cb77ecd51829806c23383511a812c024ee76e27c290
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539832f40469d19d54e174f5c6c21e850
SHA1485de996712632ee5bf2a4b922197a5d74324367
SHA25601b00bac94f7be9c92715a45dfea0c681162db9a5a900d61bcd4b125aa3ef97d
SHA512a6d323af25a7d6cafc0eebf3154b87abf0a299023f332ed3537be29b3f5ccc278373972362658cf7ab0ab13f7f66d2a8b108720c8c5c371378d7983a4de462f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53708a052c7b5b3624cfbc300e3c01c8b
SHA19b4de9902e11b96e33effe865379ca19b62c64e6
SHA25600ab558210d94432af7127cf1146e2579b0b80d66816aaf0cd092b271cf53edc
SHA51277415fa5e4e3a936fe38f01a8c9421f710b3470d84edafb36ea8ebeebff1ad1e8c42fc62f711266f8522855432570851ca3996daf9ac2296419fe20601beef85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d0eff3a37197f7681e44c5496c1ecf3
SHA156b00affbe12f30cb6ec502f0986da8a4ca0d5a0
SHA256f1c9dd568df2e9de9f99d91666e016f951fccdc11c0b768d623349aea786b4fd
SHA5127979a88f1fb1213cf036d2eb3d8f65d78b5fb0841e70b5f91c2bf6525c512a935d4936dc78d76cf24ab20946c520dccdfb7afd18e82bc8e1cd4f2d500d835dbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a84ead919a28d0b4ec6691da4fd2e34
SHA1d5380864239e65760e1fc2a44b22cb29ab00cc55
SHA2561a5b46779f3f26b52737e322d1ccaa2a4c8f4d066d3676d4cf2d9186c56d8d87
SHA512776883865ed94c8f884d9a7d10a2daf0078c3884ad099a9298815cd2ec13c98ebfd2b3752825f8e6769e124eb4aeb0ceade0d5e8c5693148bd441395f5d8e34b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe9c25229583a7f0f875965c657c68b3
SHA1369d38dd5c02870ef78bd5cb043a494d8f36641a
SHA256e0e09211b8aef7b7779e27d9279ce75966806599a126b3bf3c7c91c814d7df26
SHA51206fa56badf272b48e7f3c35a2f3431716a3413e64a43a79e7f414bd81255e4a40f80b02e30e8b335af8af5997aac1fd11efaf8b123f706e7a1099605d6d2d190
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
93KB
MD5ac61eaa48255890d137c13baaf731c5f
SHA1f9ae28f6c21358660ec40239618f6ef9f6b333d7
SHA256a1535f48249efcf97d37e825a27275a4e0d7e4ac51bceb4ff1262956c6e48c2a
SHA512e36257b46ed34c2ee03231464ec70d889d35ea9f7f9255ea8bdb062838df8a4331fb6e8808bcf52323e4c26d6c6e9be8af4babdada794495237fd51f75b79449