Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
6b525519a1f269506b8f83d08518142c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6b525519a1f269506b8f83d08518142c.html
Resource
win10v2004-20231222-en
General
-
Target
6b525519a1f269506b8f83d08518142c.html
-
Size
6KB
-
MD5
6b525519a1f269506b8f83d08518142c
-
SHA1
70abb32828ae214420a7e8ad722223d131c18bf2
-
SHA256
e5dc40fb7d7dfbae36e03aa9607451ee9fa7e77ea0862e484a007bc106401dcc
-
SHA512
94584834c7334701178a12833068f2b0aa78729a1f1eddb46a0e38e8bd4aaa6563762b186c905906d66beb81b0aa475e8b7c04867480411929c79dd4571279d0
-
SSDEEP
96:uzVs+ux7SjLLY1k9o84d12ef7CSTUrg7cEZ7ru7f:csz7SjAYS/V7b76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38B49121-AC8D-11EE-AD08-DED0D00124D2} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000334cd4f59ba714786f152d0f889b71f6e5cc7e64e3fa4a231f41ceb61a7b859f000000000e80000000020000200000000389e1c7a1761eccb28d9cca869d84716dea41e67e43dff4ba57630c75f29c149000000040f3370d31499f5ebf1103e3d75c7ddc5d81071db2220254c26fdfed8b6f135a43bb327d8793319aa4ee9ff75ddbcb27bb5b96b6a42c02648133552de2eacad20a03e666a1180e63f76c6c5bdbe0629b6301dad848479bfa7de6806b23e8a09e3c7297819d9b60b143b2caf28c4114c76971a114373c69369eea9c8add85842685d9e47c50a35266fc8503bdf919592a400000001e9d622c0e345e6b0194c15cd4e0619b9209fbc6160d81e9db28ab122b0f574d16227846ad022330d825bbdfab9e9a2959e03dca0961a584703f7e7a99f5c91a iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410705180" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000001c8d560301fb6b8eb45f757bb0f310c5fee5e7222d453716309d202b44bac5c000000000e8000000002000020000000e699bf9adddbc04014089fc75dfc5a1e1e2bf5ad2a294bf7217f85b1ff00d4f02000000049c91455d08596b0ab4572fb85af367ba05972186491a55967e5e3e9e5422ff640000000bbc728584ee883bed9750c2b06c2e013920dd43ca7a654ab1ff0c9fa8eff23c2e2017977ac3225d6170d63d873910d622ebf78237e8f205d0e8551c6461f489b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f080ae159a40da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1588 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1588 iexplore.exe 1588 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1588 wrote to memory of 2692 1588 iexplore.exe 28 PID 1588 wrote to memory of 2692 1588 iexplore.exe 28 PID 1588 wrote to memory of 2692 1588 iexplore.exe 28 PID 1588 wrote to memory of 2692 1588 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b525519a1f269506b8f83d08518142c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1588 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD581ed175d4f538e52f0a7a3cfcae5f48c
SHA1c92cf2f7884cc048e0da7cae969a794d1d211dd6
SHA25641b0311133bf6ad742740e8136b0a2deada7c1420e0cf80b49ab2d80562fc882
SHA512d3ab798a5c517fa1cec0518a176c1e9b6fe73bcf6851abd9ea4e65f569188ee0cb122cc8db652668c4fbbb7a12ebb4d8e56227a14f4776d5aa11d4f1cfbad0be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb352a2a4802bed1043a56dfe2758b78
SHA10b3b99366eabda5c04466021ddda8e10128bd028
SHA256293919aa2c4acefa4151ab4ab829ba9bc26a99e6284fca46cc97d71dc70b3c41
SHA512c8ded016e8688c8c3d8408c114d6f47eac088ff37085450efc2d669eebc79539ce1d797de02c50acdc96565e1340087dcd2d359fe7095665ab2e22702317d372
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58bdc4a106e6ab017f5b51779e2dda563
SHA16cb0d60891bc5e07c6324ac752b253cf573c0c1b
SHA2569009fe821a1521521d7008369e14cfc743488b506b1acf6047b3977946de5585
SHA512ffb4aff8cd4111ca9bdac0f9c460a4167165f909b1fa016cb28793baff363780f2f065e80c7c5ac8ad8b73f2f79810a62a323bf086f74a7bfbdb151285580b70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5872be3c8fab15815f71e004731814869
SHA139e7f4ea1cfd2826db4108f482e2b1eb81e4b444
SHA256b16033086ca64602bad3f2527d85dd939773ac5c51906103087847678b60baff
SHA512c5d367e1bf3eb975729086d5a90f274c0258f756636592b602e20361eaf59feb460892beff9db2f926a8d2395e6efcc8d7ed384883ec949f90ba66c24d9d7980
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f3709d713d498a338dfb8aa0c8fa0ec
SHA1bdb1aac01f2cf39037715f90a9669bd0ab160ff4
SHA2563af75f578d9cc55ad61ac5d6eca84292ccde969b9de17439bbafa9bf09ce0203
SHA5120e60c30fe73905cb963446898ca6227e093d9a7ddb0594a9a48c10caf34c83185fb503e1b540074d5389e0fbfc62cd245a7740dc9455cbf1b7ab3146c5c047a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503646b814f8c383b0c3576433cf52833
SHA15d394ef28654c6a9492465d075a6ac41cdf4dd28
SHA256891eedfe0adb79a4db7ae0e59fb08eab69b5b32a531668ef6a2237d2d893511b
SHA5123f73db8cd013ea17f21135c8e2e8b3febe8961d74e7f7a3ac376df4976370449cb21fc8a24361da07a34ef5de63c877c9b56cd848a9c2eb748b66b19ee01a0fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cfdb35ee866a794c9ea3ddc574ad4cdf
SHA1327a60fd15f811bffa95928cab0d5daed3f4f9d5
SHA256c663e070b46d8b5b4d0d31f69d85091eba7941631e4b1bafe4ae066a7b2e3110
SHA51253359eb172e2484d2295f1cf8ed38fcd7aad031952dbe1fc7d082c8ed1895e99f7a6736108026d919bebfb6a6c8f02712e4a3017ec98700497087143082b3284
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa0ae692c423ee4acd72f3d1bc43677b
SHA188b8610eba55808ec4984eb80d79bf8a1c7c3cb7
SHA2561751d0242190dfa741fb9a2d24aa5b78e146bf33ec103927ef4a0ab7992befce
SHA5128199c2a44ebfc1bf47051856ff67a6485cea8f7aab34955b9e858ab418db45b2c02fbe5659980542c85972c7339c169ca8e4de2d56abba89d9be18c9fdf9fe7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b983a0196ea221fac5a87fb752368218
SHA10a559fc0eb9138c48e62dae1b80c649f25e4629c
SHA25618424b7d3d692b5d9e10542a362218d338dc6b6cbd977406ed5fd744c52218d8
SHA51213cc683b37ece8e7c6e94fbbf92ee0b1a43b0857f6eb1ceb0c57ea56f9b0ad77bbc5afe98f3dee23c1a628dffe3912ef11de26a358079b4699df2306506c5fc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD526ecac3b15c007d8ad3aaf81891a8a90
SHA172d53ce2b74fe7975cdb23253b820568beeee254
SHA256b27ae5f719ad1aa86213fdbd51a6d594da45b1abf4f467a7b5b758967e36d843
SHA512abd4b1fd4d2f07bb3a50614c3b5d0acac96a45658b69ee1bb72c33dc8c41979c5278fb478a2aaa2e1a1a7fef4791086bc35319c805a62fc8fdf6ba81cf32125d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2edd08b7867b514740b7f378c741d06
SHA10034613373b093eb3a48c7a72db11069f1bb3651
SHA256708a7f8f5f7608c0972fc21a90bb15f2e6ec82d503c4bbcaf403a420cc177cbc
SHA5125b97a7f2db40f94a3f720d27486e9c305463139a416c65fe377f0d412d347ac9e5d40838a614a3069328d315aded2062a80c4c30c973700d0e776195d21b002e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06