Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
203s -
max time network
244s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 09:02
Static task
static1
Behavioral task
behavioral1
Sample
6209eb52f128eee2352d4f459f714e28.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6209eb52f128eee2352d4f459f714e28.html
Resource
win10v2004-20231215-en
General
-
Target
6209eb52f128eee2352d4f459f714e28.html
-
Size
3.5MB
-
MD5
6209eb52f128eee2352d4f459f714e28
-
SHA1
3434a6f6160e572ddf9178bc07a33148d7d0e39b
-
SHA256
990ca464a374dd94705096791586cb3ac145cbb9450adced234448316af836c9
-
SHA512
263285d09e7279c2f75d493b7a91fd627a66bd7d31f84b1612a21a6c3eab9fb79830b4e4565f10f040b282cb75f425a2326ee7679946e1c9f04341fd8bec15eb
-
SSDEEP
12288:oLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NfF:ovpjte4tT6NF
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000bc75da84757e9955697efde92e5e786211302df6a46d2b85b7f8039013be54a9000000000e800000000200002000000045c72f24fe08058737db1685383dd0d1e8e8084296a016cfdf1f47ddd3be36b620000000fd0ab98214c900dfdbcab60b8498f3857cc691b7edd24c11537cf91854a4336e400000000928ff03376581f40d474b273db854ca2a6f62cb4c4baa211394a817c0e66acc9a00a4edd7a36bb12853a088be9dda4f1ad18703af4d400f69ef8c5b70a6b0f0 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000000c27a66b8bc73854c87a47010323285f8751cf36a839cd8865fbff4426eb18fa000000000e800000000200002000000027310a0ee2ff89a7c7c02f491135cbd331790e166f7df1191e391dc8a0e32fd09000000049daa82408da729b5b8ff13021b0c7d0bec397b3b9acc48263eb089fbcf9bab38381ff5fa2022296a335c2e42a8570aa48237e0d0d96a5d92a9e9a70a6f954d0da0ae907dc42fbc7012df51e17d86caa8c325c56d8ba2802ff9d0c81aafddc32784508d48c2f3c798ad34efb93e92d8cb486569487b62e1b6045fcd048753c49cd294e3ec8b803b2e7500a6d781801c84000000046131dbad4cadd7133d8b76289999402b89c77c599ee39f99d54c886b0fff27bacecd71b439252142218bb8f4a2b0bd86140c001af7be160921953c8a2961ebd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73098471-AC65-11EE-82B3-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410688105" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a08478887240da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1180 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1180 iexplore.exe 1180 iexplore.exe 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE 1716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1180 wrote to memory of 1716 1180 iexplore.exe 28 PID 1180 wrote to memory of 1716 1180 iexplore.exe 28 PID 1180 wrote to memory of 1716 1180 iexplore.exe 28 PID 1180 wrote to memory of 1716 1180 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6209eb52f128eee2352d4f459f714e28.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1180 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dcdffae57cdf64100d1d974d059eb2bf
SHA17f2a47936a277efc28cbc43aea3e26ab46886132
SHA2566a834dd40f38f223da34d1ea3ffe54ae551274dbf0646891928376527483cce5
SHA5122ee095ff0016a295a0b7c9013d32b5f32d60217c3e456efab9975a70bcfba37a373c09730aeb8fbf2b2d06d1396a525391560b28eea9204df5c92dbfc51e79bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553a6701c986046d3a097deb8b224fbb4
SHA1369f592900bd1452e749ada5a7f85fbce21818ba
SHA256904d2c7e83cdeef799c83b13080f6bae7bac2003baabed404a05992bd7cea12a
SHA512da21956ae3caca81a74a227fda3d5e2bd0bcfa5f0128efe52e1140fb1d6fe3885103c076326879f932fae7ce5b143f95463b2541ad0812fc466f3caf278999e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b006263d6e74decb451639883291c6b
SHA19d83b9de463233f9bc27f5902724aa9d44ff1d57
SHA25665a899a48c1fa8fc21e9aa6fac1760f7f551274aa97702be63fa489c6bb909f0
SHA512ae76b5f44f4d3e4c592d7cdbca0ea9cbfe6e2a5d77e64c0eaa1ec586ebee3ffe2635a6f0d869c15edd7d2d975c9c260d69cb6006d0387042afa9e11c35c9134b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ccc23e3fdc4413dac15226b3a3da707
SHA1dfc9117694b524eae03fb258afa2b286fb996489
SHA2567a5f207e874ee3056af33c86779db0c8f5d5a7bf6040a1e58addd8b26a16e721
SHA512c9cef02a2410c35cc7aa8d8075476cbe9f3d25406ccab2806558ad37327f99bd031b1b275e3edc98ed7dde06253ca35263690844f2dedc60c070deb0ef8fb57d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a90ac04ae05e97e5df35aa9e1ae4e8dd
SHA11f6cd016e004721898e1014baa2dc2ef08b0e386
SHA256df64ad0cb255c9b97f442451476ee87ed9469018a355b2e62037eae8afbd2ebd
SHA512ef36a1b0e2059b3f9dfa0d70328806408b6e0c2f299e0a38f64ab9b139e307ac40c74f416e263fcab8e7bdc0649ac233f88f405c8d466545cdbb3a46be36d883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD536f8fbdcbec2c0e34f05bb07cbb4970e
SHA147d985396a7c66615cba0f9accaa2a24f57a3241
SHA2562b97b278ef9026f054b1af281474f39b87d01decd41b61b5dc53f129a9e35b36
SHA5127ce15790ab20edffa5ff75ec2e356ede246e96909a5bf0f1c536073d48bc432d741dcb75665f988748cd3a0e7d4f9b7ae6af89e688632658a2a38d7205bccb80
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51495a816b9d3cf53864f735f8f087964
SHA1df6373cf085abd30b32084f44a27208d457d92dc
SHA256a7e00b8e1fe5b27e8c181e1be38650e0c24523f734b35545c809f7ca0b97eebf
SHA512ac0b54d40622964333abba8da505fc65b0750a1773b492a64f742273398bb5a907ddeb3a19a0f1da7fcae9dc96dafa9af9e81e6ed3d4d628c50895b702acdb4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5788520b98b71afc2ad47bcfcd5f09014
SHA1e996f853770850cf82391904aeddd02c3aeb7ca2
SHA256662d25fa8735ea194479b5c27a3085e73d1d1895fb3f6f838ea9b2a94b0028d5
SHA5124832b9060635f070bb277177fe2f7a1dd359cc7e7d39fcc801e44c61885894a685f2c4d1cfd9de819629d3d606fc32de234839056bf9ba10c1e10e9ccc6b1021
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598c466062beddf0f7b2479da21940b15
SHA1143778345a1184d566f84ee071377b2b00941366
SHA256af5b0660dc88e1adce28fde55d07a2ebae03ae44c481f59667c87886cd46997f
SHA5129aa297f8d750684bd14f93a9fdada62f4336c64a7704ac10109884d12f85cd23ecab649b0188ac4ec9287a800fc63e5931bc80f53a7f670384158f832ce3a58f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561a793521e3d7470101a5927892b0440
SHA1275b1463a599b27648f9f95bb11bff2cdc0e6c06
SHA25655d644093d37827e3075f5006f0a6d62d1e9b54654f7f1f57d791ff967fed409
SHA512cda5fd4d591e36b9b6faa0f424234b1778a5f546e604fac6b4a5718ec3a91c124c5ece4f9e89e3b70a7d6b4a768084ea5a51362878dd1d0f6de4df0d07f60f96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558a67c7e5d3cd89228850820c4255be0
SHA118253e4624cb4dc71f417439076500c224cb3680
SHA2565bdcda5a2081f411adadec15fb02b9a25013785314b2da441656921652521f9e
SHA51284ee0ec30272e9d4f264ca2e967dc9fdba3ffbf8b1721b76556f6e4d7cb1e503bf3e69e25a8cf58475c23facb2740cda8e628baf0489740da619352e0eeb78ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f302758fa9e97f90e3a0ab90db319525
SHA11383ae391485b2d5909f246108b6e1e24644a4cd
SHA256e3c04bf50da677ddaff46acb94e5265aad8d867f14eaa15b67d8d53e47013ab7
SHA512261be716358a24fb9f94260ee53569996f03832c82428b17ed979de42fde6e1a81ae459ca52da50cb6e04134e7b1000b9b017dedfe0a6492451529650f1717a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d90ee06e7230a2cba8e9412566f658f3
SHA18c8132bdf2bbe368f5e6c74499bc8702f004c9fa
SHA256f97d11c33560ccf239e32b98c52650eee9c64e65a7788f350edc93d718a840c7
SHA512f9705ea8ab7d015d1b02ddb2d27b94825a2366cecb8960d18ed03d8538ea776e24e53a547c0605767a5e98ded6865292c434a9529606f693d3401c5b3f249972
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5473602b9f6f31ac3d601741ba2f1112b
SHA17034c75507187f5eaddc2e88b785e1673dbd7d56
SHA25679eab90c752043bc00cd923dc6d96e1bb19be5033fd94838351031f1adb5ed2c
SHA512f0138520afc05fb06bce498a739e7daed44030002789a72a473ee5f7a2ae6a4020f5270eb0986405e4594cc27e4ccdfe3584294fcfcc95d656775a8384d408fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5528f4d182adce43becf824cc1b3f9fe5
SHA18a03488c4eb1f913da39e5b7c20b95e36ddcef88
SHA2562a1a8a7894b126f4ef6f0b969d2536b9f03871e81e6d06e9b537766fb721a3a2
SHA51258b524e839727eaaa82fb4999fd6e623c9d4aac83df669143b42f8e838b38828d535cdf235bd22bed746701b07a5ddfb4011040f68b082607c0da4f15e019595
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9054eebb53681761f2c7f3b665e6bf8
SHA1528cd700e5294c1a065a61694bc2595aa98843c1
SHA25619a8103b788a57138998718258c556a47ec957fc81a95b27def9f6d90935626b
SHA5129b07b88288a86c2c8e5fc608e99a7cdcb9ff5def41d9b4d9a79d40948f025187e1c884a10f3026c32b838e62431a7850f03a7aacc58f17724bbe9c0861b9c520
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1YVWL6AI\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\L6MCRSFJ\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06