Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 08:58
Static task
static1
Behavioral task
behavioral1
Sample
61c7f975f7d1addae23752d94aeef644.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
61c7f975f7d1addae23752d94aeef644.html
Resource
win10v2004-20231215-en
General
-
Target
61c7f975f7d1addae23752d94aeef644.html
-
Size
53KB
-
MD5
61c7f975f7d1addae23752d94aeef644
-
SHA1
b8780217884d27ef7322df7c5cfd6fc629fc9bd5
-
SHA256
e2802b1d8c5a29fb2a6f820bfb865dc8e45aa1c0aed2c63812ca7892a399b504
-
SHA512
96169d1aa99cddde774c4930d935ef376579bab2432df57677c8507dc5135a12701d5b63cd3d4f076871e746a5e44967ab6b9f64c959322df0887dc5b2004819
-
SSDEEP
1536:CkgUiIakTqGivi+PyU+runlYh63Nj+q5VyvR0w2AzTICbbEoq/t9M/dNwIUTDmDr:CkgUiIakTqGivi+PyU+runlYh63Nj+qu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000690ddb2747f9754ddfcd2626a1c760a96e056d0b4abc2b0b639baed7962f988a000000000e8000000002000020000000696b16e2add3207d3e84f9b6643455577a0a86632a3efdc1f2820c968344579020000000b3c6c3758d07d88a91f8e074e968d0c24b9f0a8f4fa934ae7554b874248b96f2400000004c7b6fa7dae22d64250f8173dde91c971ba8c42ed7053de66f2e66b19800b2f52521d99a849e42f19b80591902891620dbbfdd6d2b8e0f6e3da6950bd5308cdb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000f65919690849e3010cc4f3a0f45c9e9e988b35e9151c92fe2bf8e4491f4e4673000000000e8000000002000020000000ee3af6838ac562cd3e11790090480cb4b33e95044d3492186535313ff58a5a6190000000664d06d5fb588f19257fc35767ed3cab7139f9aa9657ac62486b36c81729f0a1cb2831e862f24d6b10f13e7a85a1a604f1588eac099ac7ea0e3781e34494f4aa77e5c51798e6116be382838cf3daf1ce31c8b706d9467733a2e1980a5a243cc1228b747864f6d08c4b12c09cf1c4c525ecd33abf776794ab6c8e97bb7648a3bce7de35a4c63563dc1e1287fe43155f504000000060b25e57d12eed572fa51d23c7b775122ccca8d975dd892baac0035d3a99c8f6fdfde793cd450219414899f521ffaec791b16327ae28fcce5b0d5bc6f7b13692 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A756801-AC64-11EE-AB16-D6882E0F4692} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410687588" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a024e02c7140da01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2340 2080 iexplore.exe 28 PID 2080 wrote to memory of 2340 2080 iexplore.exe 28 PID 2080 wrote to memory of 2340 2080 iexplore.exe 28 PID 2080 wrote to memory of 2340 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\61c7f975f7d1addae23752d94aeef644.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2236e04d5092b4b836375a1daf3a231
SHA1339f5139d08be52a977ef3cb13ec7864dc1d0853
SHA256db09615975b72ef3c262cd0cd5e637157a4cdf7df402f70dac01526982680b5d
SHA5126dc8651654bca1572fd626692f3db6a2937285c02c3ee011b84e25afd33c2fafb82c89233fbd5d91f2b2535ab44869e407ff822da61526adabcc233670a389a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3dea5066d3e1c03c32f71a6352889d5
SHA15513c37d4110f887d2877681c06cc2a0a0bc3abb
SHA25614bc897fa5531df20359d4e27da5a9e08a4624225a8bb286b5294a9eaef23f64
SHA51246c5b7dd9b83374e28614310b95d10ed8c1caf212e3d0d47465dfc801d91d006781538ff086b7726050c52d8b62f1de2a0fb6125c038d72ce4cbc4e7d6040473
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59374a367bb357cb881391165846699fe
SHA15f526bd1acd1ef3659e82b59a01b07abc66e443f
SHA25689779c20665432233fc66e9a55ac6dd369530e29e41d1e7b79f777c79a9088df
SHA51261e1cf95c0d8ec7069302b3d3870799437fa6ac381ed2ffff5db691fb46e4cfbb13e4d9c6f0d1344e825ceda1c41d3de92fca8c236e3760c8972d16685839c9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f06ea9ce8c4c29ce5a2b2d9bba1a96c3
SHA158714dc3b9c0d813b0cd7122796f02546fb32cf7
SHA25681b7c00960481b616af0889a727354fb058ebea8bab2ae246d7188824d03af89
SHA5121e31029af521a6d1380b64dc5712a65758fba94fd077e36c5b3d01a14b8e4509b381af7f7bd968f5facffd588e280a9383254981659b5259c35e1321ba3d0cc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56415647960c409ad7b6cf03f3761d81a
SHA1a7cd7938173a49bcf1612433ce1352565ba91089
SHA2563b3921c41e5a887feeb1edec4db14e246da37feb0ba3d6755a33880d945117e9
SHA51286ec4e2926e196549b8f0779a4b923640d7c98f9776c2333b037d2edcaee9bbbdbc349563fb951fcd7503001eb17c945f5fcb33019afaeb002d3793ed0ed5485
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ce4c9748966cd596ec803085f2deb41
SHA19358e0afcffde8ef84ec74bb51f0377559393a37
SHA2568b0a4b8a3e8cb753680ca3dc71eac23d019482d285c5659093244e2a927f3228
SHA512730ec0989ece25b1f777da3164001f4bfa9c59891950af2adfabd899a18d11178234f55889518f49b3786bb735801601ae60c4cbfda3b6660b02a0de4482a153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579286c6fa9a408405866edf90a5b959b
SHA1b0972b2808eba73848e12abf800e4355c83aafa6
SHA2560205a6d1934efbe496a59c689a236fdf138f6d8c2e8fbce3474f2c376a75e343
SHA512b3e8d89265ef4e234f625a07576bc69e71f4b71c68f03d99c20da99ad9f86a6275861c904c1e9ef15ce13d1071083e1996fe3b757be46d8a6de95712b16fc17e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5607a1c16922cb6d4e7e12c7aca646c6b
SHA11d02a5e2018ae74b06bd24fc1004802c25711eda
SHA256c0db84887f829dba7b8633a8056fe2ec00e2d73cecdab7bb16d5948ea235f7b4
SHA5128567ebfd39063c799538b31754950b46114db5373c1d0fd29f6e548bc0d57ed57b197943ce7c1abf983846e7d1a8116a4907805d5283cf89f01387a5d5c90586
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58279d12a4a29208b8e22b39f9960c63e
SHA143d30bee7d6883c70943ce3ff7a409bc7f184665
SHA2567f3d7e7d3d9edb666eb72e2461450e2713e7cba88b62ce8d724c998172c23361
SHA512fc3ce4eb079ef6eb3631b28d97a5e2e3a47e06a69aff9608c2e9d98a61e880f63f320ff9d45786d62c7085901bbabb29a0c05d86eb35af14f9871a53b0844f79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e91a4e95cf8ebb735e80bf85915fec9
SHA14ecc67c8e23348bcf365adf9763fc406492cf9d6
SHA2568640723464a0a99276356bf7689a1888e770b64a0cb2b55e23c924795fb629de
SHA5123081b40e6f9200a2f6f6eb9a0868889363abfba9ae9a997607d4e95be5f43b8c1a8394fd5e15fe27c57d8ad1eec128d3e7049185f652615991ba15e07a8dcd58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52333e1ee73f2a044e91a257334002ad3
SHA16064be2528f715ae656022a5c05bc893362dbf74
SHA256d6e797a769b2da13032088a4506a2d3f0591c2240bd428b40d1848db854f7541
SHA512b314b4bdca9b33a1c40ac8121b655fd21e0dfeeb3e4a1a435f5262d7797ba1cd8da91f2653b35f6becf77020f10852e2056bed53329a4eafd7bb197105341e71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dfc7bd19a593f58118e7042cc9f0c46
SHA1e98a71f7bbe04b6c5880fade261c3939d47e0c5d
SHA256339c023e2a7669fce37906580f89657e2591e6f427fffb82c46e7673919fbd54
SHA512ad603678e2e3ce59a4c5fe14e526ca74271dc0c636233bc15eae13cb36b2e712c1bef3eae40d5381b6568e62adb7b2e61980ef4102b2cd3b190fb73d8cfc9c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5582b2a463a0fd32251d1f30026f38f9d
SHA163398ea93154fbb10845c801769673605077a10d
SHA256690a1db1784c899439639f398fdffe043892b0d79f882d10aeaed57b1e11c28e
SHA51256f0f1b73313044c675d0c4d8fc6547471bd9cd530a07f390927c94b1dce9d5e5b452e01a07a8bb270f832596e2ea62380e6484e2299a7715c508059d872b33d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540a3dfa35df98871ec04e19a8d90a950
SHA16e66512ff7ef0628ab1cd6afc5df05d531b120a8
SHA256a8a9ce9c5b0d04bd020f45553b666a6ab268cf774336366be43df251f367f6cb
SHA5126b8492412c7c292a84660ec4439f718979fdbb3438c507828d81a9ee9d86125cd6e1969b18565ce2a060cbcedc96625ce782db66013b5aa670b394d96401f40a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568efe7cd2ef00972a3e192cefc3a8c2d
SHA19835fe9d65893982a72d1b6b4e2e8c238a692d50
SHA25660ef4740177e8622c2344e86e0020dcf8babe90e5be4b43e30b7bbfcacf5276e
SHA5122ce6e1b8d97098906fe35e78f0e52b14d074c4552ddc31d77bd9558f0e29cd2af3930a7d2131eab784a67fae50b782f134d34c36a53594c4c19447742a71e2de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531d0ad9fc82107b375ee17b8f1fa8099
SHA1dd0bbda04fa7209a43908d0c2faf778791b137dd
SHA256218f9c7132e9d4e691b277b30857e66b4932f1941e8804dd43168e3f148d1563
SHA512c696b8a71f1f9d4d06d2adeda865fcb7663089f42dd4d6d9488b43fa55734ec324d37c41b965069954cef46bc1bec1c91217ad52afca06ac71cd406955fb5280
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\R1EBDLS6\sha1[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06