Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
6b9685e7b4d9fce3a22f63cf5585a4af.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6b9685e7b4d9fce3a22f63cf5585a4af.html
Resource
win10v2004-20231215-en
General
-
Target
6b9685e7b4d9fce3a22f63cf5585a4af.html
-
Size
99KB
-
MD5
6b9685e7b4d9fce3a22f63cf5585a4af
-
SHA1
a2fddc0e970d2423cbad452c7c93890e96047cf1
-
SHA256
e0cfe4045ee9d086ab9bdb365ce47b95e7ceb41cdd9403437b577451f3c616ad
-
SHA512
46577736c653facf7d5a62e677c46e2bc8f322353aac5fc8e0fd4486180a5d643c2e48a85e2586124faaf1758f044b5ab3552959640743adede00b3f84cd770b
-
SSDEEP
1536:eIPTjpkiiTCtbjceKcQZVRwt0bRSAt6WXQWOy+FYj+TxVe65G5:ecpPiTCbQZVmt0n/XQW1ZjGNG5
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410705648" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0f0802b9b40da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a7c8f4a99361f1423d255dec1a3401687d4e8bb0fd2e854399c59c789aa76c32000000000e8000000002000020000000416adb29e358ec0eeb2147925f8a8b352e470f4c603e6a20d9929b55a56b2fc990000000ef8d693ff23a1c06d00fb62bbbb4d3f1bf439ba249d6fa872990d813b43a53d2e3a28a1b4d59821a1e48de5d946c563aff5319925ed7da3d045831edcd8ec5010c164d2152e132be3edea541b3426d4d027085a60494e29ac814d0c55cc00337b518b1bb967a7f1b06ec7813bf2273201d750a8830e069b9ecd0d099990335e1c530e048f1321b038600515f8af5e7bd40000000f5e0de1377aa7f65331f4af09995fbcdf83b52e94b64e30a5bdab3647282b42be54748fe29e8b704ef79d599a9e1da17310ce41a76268e4d771cbcca7efa90cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000002022cf7a6b6f33d200dd8b65fac7f5a3395f46e05e6f7c3d0a137e6f89f21f1000000000e800000000200002000000089778f0b1e70ff9f3f81a6eb485c2b8c4a815af2fd07df153bb3fbdb98a7fc4420000000821fdd0f39ec63124118e127f662d5a26e23b263a46fc7e4b13a256c0c7a777f4000000005b992c099c028dad3b8c54574bb1e15b5f0588bf1cfb3029e67ca985f933bab32a0bc4601d82b41521c93581ebb23566ed1203358457ab67577f2cdf32d4778 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{50D09321-AC8E-11EE-8723-CA8D9A91D956} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2976 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2976 iexplore.exe 2976 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2976 wrote to memory of 2736 2976 iexplore.exe 28 PID 2976 wrote to memory of 2736 2976 iexplore.exe 28 PID 2976 wrote to memory of 2736 2976 iexplore.exe 28 PID 2976 wrote to memory of 2736 2976 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6b9685e7b4d9fce3a22f63cf5585a4af.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50dff8906a956d676b79b80172fa5876a
SHA1f739f8116de0e74c99364e28cdad5b9ea9159581
SHA2563d72c3a5037f13f3bc65a4bab32a13d366acdb4c385ecb95fdcf6fed97e6b567
SHA512b744c4ec6ed36943c84aa4c5995fb883850113b8c6a6feb1c412aee917b78cab79a0b90864673b99b36adf7347f9f508b34076bcf1b7dbf520376f0d30564729
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574688c982215f996f8c3b8d9c55010ea
SHA1b2255af9c30e0b7a81bad82e5ae7ba71966d4b45
SHA25604dfa33cc924f38bef1c5b050cd432e13e3336381d7c0bd4bd24792e8fcf5f87
SHA512eb50f8625f9abff3a0a0f175f0426dee795009b11232a955d4afbf7d758c869e509493c0a2e2d2a3745af7d93fe5bf166da89b44d299095dcaf8f3ee4a7d5ee5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc6793c5a784ea583bec1aef5f4ef936
SHA1b900b54e20c271a152ca5f0ac7d03ef6aaeaefc3
SHA256ea0c406e098a1ae126257d24c8ad9b798104d67f0d02c87ee780bd1a9bcb4ee6
SHA512c157a20aec6d1e9d0f0eaf84be96c880cde319fd9a33a9190a1378fec8f9b7be4ae46565d5b9e2f7ee5a570a1f36e7a59ec253d6386922bc82d057647df2cb79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5969832c02397af63bcf27bf689405f78
SHA14225274e5d3b50007e6f20abf1c704989ed6f451
SHA256e89dff1cc1bf0fdb309154cf071195b4e8bea56d7e05263ab4bb5bfb03112247
SHA51212da06204fda4a923e55787176b592dd47bd769ca2e00016efc845951b59fa2a885f3d1e51fc38e0d97f8d5ed3988a0dc0d070eefdb5383f9e70818fdbc90be9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d60546b3c731689bb766710e94bc96f
SHA142c3a625e839a1a461260a9978f324f1e9cfbafe
SHA2564f9ed7ee8264740771dcfcf73d26902de9b3ffcdb27013b0dac3383f1f5b4f7a
SHA512e9c6707622fa0baf313e0e3bbea839915be07057697eda84f1fd7b45d9a7bcaa5ca8b34213f9a18914fbe22a5c58985c79bc7b38acb50f2a49c05079463a702f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52523314185fd921e9717fbb4e8e1c9cf
SHA109d39dfc2bb5399fd0233fa5ed1371bf9fc98613
SHA256313f0d00aecc3d1c2a552b7c89126f158ce5258985c310fff79de407561a7e5d
SHA5123bdf83d228623120422b5b22a91503eaa4b6cd0a9c6489af3215662b209ea58b8e7db3a7c6a7acd2bafce0ed05c9f88b1c153b94543cf4a381223c01a2a0cda9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5018b76529f8df9a201fdf4f3e0e530cd
SHA19a4554c4bf5c6d5f8382b8df9ae79f4c986f96de
SHA256e0647ba780ee1bf5c989c0ad58f8fa978e6b4de7ad14db856a780d49e51645f2
SHA512e84260e95690db782b104a419d825f172c030e98c3e1d1e069d93419d4b335b3213792df38e9673386051f333b8759c1167a372a0eb29127ab0fa7c04bd8b5f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50339f9dfd695fe32c293979ad5d27525
SHA14cd5a5b3b2e83fd41029a73bdd495a261a505dc8
SHA256dee9784b0b8497c5d87b3952bde36ac82a96642d77f1ee2afad8b4879b06edd5
SHA512119a580e856cee20bb43840e60b419da5372d3ee4e7bea37b5e60ffa0298569bd43815dfda23948f597c1ceba6c131bf1f09a13f48997b2eddab58621e8427ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b66863ac325abf7ec184921a17eb4d9
SHA136610fceaa224fd6e01d10898237642104e47b94
SHA2562f6509d7f65c19dd1a840db33c43081b38b9390b78b0847f6416c9f2333da4a6
SHA5129d2f00d3e0b40819eb6bffe03db21ba29c988fff8b00f5c53adfa167e47c9fb0afd8449edfa01df70e8d8ddbc709af40c7bf1a975766cb0062d43c4fd78d4d75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6475f8e8129733a08653d6d54119efb
SHA15fbce2a261803c3a7032155b66393dbe7a873b97
SHA2568ab75afc9cd0150e04602c49e2b96f91c99d2ccb87316682d4a6b1c354b7a422
SHA51203a132b8982010601d70464f497eac3bddc6b4052b39b0ead0d158a29a4b42e4943b41cf555448c65f8eef966207157d4bb79be8ea94164a3297d298d4fbbf66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5584a46922d8ca6fd409ea602789e80b6
SHA10d78bb3a66d68b32b96f46d5939128729c3900ca
SHA25600f13a403cc9adbdf49aff0dc7a29da658546919bd1122e3e6b16e8e16d47e27
SHA51290651b8de3bba6dc5fcde70c29c304561b24066f3d449939781fb09ab1727a2c7bea12e962e181f7c7d167890ede77d27c6f7700736fbcb963c13a3b3e9a3458
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06