Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
6c6aabcc58818dcee2d11e3c9794768d.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
6c6aabcc58818dcee2d11e3c9794768d.html
Resource
win10v2004-20231215-en
General
-
Target
6c6aabcc58818dcee2d11e3c9794768d.html
-
Size
53KB
-
MD5
6c6aabcc58818dcee2d11e3c9794768d
-
SHA1
4b6f1a896652cfc1ce9e9a1571e017e092f2ef0d
-
SHA256
e2712dde7ee85bff27b3156cba41b3658b671ce09c80681e1d7d4bb4923d8faa
-
SHA512
79097fa3b5107f01e533dad235b456a3a61618101ec56616a0817a2d6febef36684f307adf89ee2d3259256f38946b552d01e6a24b5be5c60a5c1ee0640efaef
-
SSDEEP
1536:CkgUiIakTqGivi+PyUwrunlYK63Nj+q5Vy0R0w2AzTICbbEor/t9M/dNwIUTDmDV:CkgUiIakTqGivi+PyUwrunlYK63Nj+qa
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000bc2a537717c3d6d50af83e0c75325e09c2d5db0380afc3043c4d7874ff1aeb5e000000000e800000000200002000000092fe7cc82907947e41f047e45e797fb32827fcd7af39a784810ce70321b6dc17900000005ca3119ff93ce9c466c65f4cf77709f1c96cbae2f5ee9dd90231a3db5764f9d33236cf00b92f9a0710c0ca6f2aa0a1af622efe1e7b5dc757f4b3373de787a03b6092e52531bb432e7c45794f6b22342af4846d5ed737ef019332ff2fba49bb1291a5dd923d243abc3571998e30d1b3adb84938a3460e7b9ab3adab04f562e49c1e139fe7d65b77fcfedcdde36647ef1f40000000509ec5e4822093759dcd71bc31af4317d35583750a5b2e0bc92c748f34d5467c7b9f7fff4c345c422ee5d9ce9f8bc5799f975599fd265b0d2efbf5756e7daf20 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a009515c0739da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{742AE6E1-A4FA-11EE-B0EB-D691EE3F3902} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008541d47d7e157db26cbeaeab272c226abbcab6e847d0feb55d7be11906dd6f1e000000000e8000000002000020000000f2e6b482060d17d0d298c04da0318fcd51dbdfed4453723910ec9c0ec5f9e0ff20000000bd8e40cd4200229c9aac643023ed10f61c4011d3bc382c7d459222af23f0d3f240000000b00be030c270a69a6ab134e0bd769fbdf8062127e576e5e19fd8a8367a7fa5ffd3a3f84c3243e01be7c29c1ab4ebe88e882638cf519c6b2776eab54a89878871 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2992 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2992 iexplore.exe 2992 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2992 wrote to memory of 3048 2992 iexplore.exe 17 PID 2992 wrote to memory of 3048 2992 iexplore.exe 17 PID 2992 wrote to memory of 3048 2992 iexplore.exe 17 PID 2992 wrote to memory of 3048 2992 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6c6aabcc58818dcee2d11e3c9794768d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2992 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5feb0406b923dc727295ca45e213a69b9
SHA1e8d97acf49284c799d59ba9dba0764ce41847d58
SHA256d2a98cc5f8701fd7fa59d632a7f43084637990891a186fe4415128e2d7a97005
SHA512bf60f5bff98635b0e3450b811cd5788d7599278a9b2eeb01a7430d0e00533368477d241d8b8c165eadfc7740894e2173220863f91f987e5f1d2caef519da2451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55185f65bee0967b903f4e46381af4cc8
SHA1b1bba7528aaa1bbc541c0577034f3c2ab6d63a38
SHA2569667cba04c4cd76bff227c1161ee2bdb1af5b30e45641ab7e96d342b28ee3d8c
SHA5128497fbf88b37a2d38a71c40e9a70fe3c37cbf5e8721efac82b65b2985a314c2e9699f94c5c24daa9dec73af1a793316840025e2e7c7464c497372cc300ceb817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d74603bc631d3a57943ccd7bb8b1cc95
SHA137b58387f1c1cc8119837ba65b7d8e19ec4fb339
SHA2566c68e45c48e506036d7ce975dbe1991992339c4d0278fdf5d97cd8bd97ab7a57
SHA512824904da3dc5d8958553d4f8cbedfe7f5069d5d9a4e1cb1b409520c55422193f0878b903544b0bf5da65e38851efa66b8606cfd12e78c7445eeb40d4d4082b7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af1556f58d7b26642d3fd3757f241601
SHA19178d4c9853cc96a7985f048e89553016217ccfc
SHA25631376e6815e8d20c8c9d5cca99ad508962099c8f666e52e140f33aaca6e7bc00
SHA512abd513cab4e95ebdad970eb1bf2621d2769a983f937aaa5c126285edc3f36a3c0d1227abffe8faac7fab84dd061b6c60d8da62cc82262f3fa9179119ffc5125c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5054979a66022f4300127c427d8e24be2
SHA14d81d856642a51788712b9ba26935e51c92696f2
SHA2569dce58a8e665916461f3a5ad17053d05697fa135bdc5ca3d3fc69e3693b504f1
SHA5120ad10da920f46157913f2bab2886104437df45106ab598dc0f7312f2504e1ece4677a46148cc42f458f549702e13ddea2bb5ac8679dc38dec810d7150d89c556
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5500074234172a19a2a06692ba93597a7
SHA17acbe84c3751130bef629ad240f8b82d2e1b6122
SHA25639e494896865b7b78256d464af58db09b3f7d355800e9b00ab0f8c70383e4b92
SHA512c2d65eaeb674d93e0ce00c91f614904963501aab7b5a6c17d0bd289b61e897667d804d90762b95abedf55b6cd408077b990ee91ade9960d93aa6b6960a4cf20d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dda6b076bc3884b6620133cd25e1e282
SHA1e16252e8341d5adabe480f1d5e2f119a1bb3bd2c
SHA25698c7703c92a018ff71ab67705010dc27a34297160b5f9997872455d928b703c7
SHA512776e81e42089cefa9168c5b166031feb658c1491caa5fb6898e7293b9b08996e7e877305ccb2bb45f0adb3a1b5a4ebc1abe5804a6fde54dd1af05c0d732a7c47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517c7d711b1d01eeca7b690648b78dec6
SHA1dcdd8a1b0311ea32971d359d474e8c9345486a4c
SHA256eb485d04390d0cdeed15934bb2053bfca58b309442b1dfb4451c02924f17a9ad
SHA51272fa86cc1df911d5e777ce24b0659e95ba2d6f962b42e8d0e0bdb9392eb53dea70e8f78edcdb522adc871d62e07ed4e732317b3f920e6bd4d09dd40a42fdd62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b819de14bf319733601087ef4ce8caf2
SHA1f3c761da26a8a2f83d9aa2feb8c63829629f97ce
SHA25620d99d829e6208d93a6dcf47899e373cba9757bea5f5e4a4ea8c78e2b0d9647c
SHA5124ef6b3425b6ff3150d3bbebe2518d32945bc416b752e69d19ce9739aad1bec5ede8e082649b4372d5bec326669bbfe0b25aa7a830a26619bdedd804945fa6fb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HC4E4SVB\glossar-js[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e