Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
6e09399805fe2188e0248365b868cd89.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6e09399805fe2188e0248365b868cd89.html
Resource
win10v2004-20231215-en
General
-
Target
6e09399805fe2188e0248365b868cd89.html
-
Size
190KB
-
MD5
6e09399805fe2188e0248365b868cd89
-
SHA1
452578826f8de97b5a019983b21ebe963a2e9a0d
-
SHA256
96daeeabe370ad9000a59f7c970b5037652dc48afb73a299bed2634c9d943e2a
-
SHA512
85953b6b14d0c7e5d4a6203fcbbefe69a0c262390a5ed4493dddb70902f5a71cb082fab205e31a5d499f7fc18613da163cad57ff71e04ae6e053a60552810bc1
-
SSDEEP
3072:SEhkyfkMY+BES09JXAnyrZalI+YNLn4Ezdc:SEhpsMYod+X3oI+YNLnBS
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{80588011-A501-11EE-9D5A-6A53A263E8F2} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a33b6df2e6b6b3d7e1b3de6a77f22d5b4cc01240a8965e1775c8a0f7269e8e50000000000e80000000020000200000001616e4f98433b439037b2024ed9341e42df43bc83c51a539469092921320d4d8900000001ecbc396b8100a44d1af75eddbbe95dec1c21e482a54ae0151fad72749fb9cbc35c1e11c0b85e57715fff33c58dfcde32c7c4fa652640f95e337926977f11d57b6cd156370a890b57c944cc84ef638e2a6326466f6fe22f6531582f0822a8ce40414ba62ede7c1c5017774c62a19159baf6487d75bf2157b523530b347e82d633079bd2dc21948f3f0363d98c3f407d4400000005952879f20118a378fd1c72514d4a13aaf51622f56965b660e51a66846f18eab17dc0f70a665a6dd21a04225e6be5b1e5faba541e2d6f2df555df9f9c97c89cd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000008fcbfb0d90e5959a3ac0c226b66b5c24f895d7afac95cda0f75d757ca535bd3e000000000e800000000200002000000080480d0d5ff1bc73902d1ce9ec70b074b1b4e4ee94ecba745531929067150f1420000000d456b4e36308b0dd34b43c7c4d8e828c8f16368134a4fe5f4acf6380e2f733bc400000007abd5952411ed62c82e12f9c32957dfbc53350ec309026e9333f6f99f8f44d2e8a4c81e2fcb5ef6bbd089838395d7faec35a93cd7487bf0096474f7407540e27 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3025d2640e39da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409875529" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1888 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1888 iexplore.exe 1888 iexplore.exe 1980 IEXPLORE.EXE 1980 IEXPLORE.EXE 1980 IEXPLORE.EXE 1980 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1980 1888 iexplore.exe 28 PID 1888 wrote to memory of 1980 1888 iexplore.exe 28 PID 1888 wrote to memory of 1980 1888 iexplore.exe 28 PID 1888 wrote to memory of 1980 1888 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6e09399805fe2188e0248365b868cd89.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1888 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5807ba38b3d21e38ad65804ef722f7254
SHA14dd1a004abfc066e7fce2d7114f2254b47a03570
SHA25649c04da5c554d278b30fdfc20294802ef9d5eef61e725bf6707dbe29ffa4e764
SHA512596e9328ac32342a1f1af7f2d1140dc3bde4dd916678f6444ed712790b027aba023b36be9a3cc6ea781bc0bf913503f3371dcddde5d08171d6edf02aa4c8f780
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ad844975c32df1c9e55f9b8f696824d
SHA189183f3fbc4ed478d4d5d9634b65a5217eeb173e
SHA2568eb79ae85ed216af324b8d2eb312fe3fab2d0e36435bda73674ab5d59aeb4781
SHA512f68953836bca6eb3142735452186beac89a9da445f40bda0f192ad9d71be501f42c194019d4f09279de1878995e28d58d61115742b3080cc242633b302a5914e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59acecc2f11196e2e847c8e86fb667363
SHA199abd7bfbaedd9f049fa44ea7e6a05bdd2307a13
SHA2569467fc6d76b6ec34e8dcdc4eda6335ed7ff81b30155a63a00e82eaa5587e5b09
SHA512997afc74bdf963dd66fb8c3d594e1e1cb3b4d176bd02f52d671e956e2c4ae9d849414d94bd56de73b234d1c368b8a862ff4f8ca194f20e34e932b63445792c24
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5663f511f352112903007e31f28fecaa7
SHA1f6403f8448769c3fbe418a94054a96c32c39e8de
SHA256746e59086dbfa6c410f014e8c0cac0279de9fa53924b92049dcec05d24b60cc9
SHA512fbb6f3b4fe6c298076f2f395f969ab260549bd2b3a7b9f0ee210f795766b5b10a6e2a29adb0dcfd41f606f703f3f1f42698bc985324039cfecfbe5bb748bde97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593095be6d524be6f2e49020d697fa893
SHA1ef49c383985011d4ae4d4d8ff45527ab1791c25b
SHA256fe8bc413e7ceb3da0433557cc219cb78a74b430b3602a47625aff236ebeee72e
SHA512319a54de0f44067311beda6f36e396fd2989c1310771233a8495cf998d119d59a3ba4d3c3d0019d6226ee1812a1c9934f9b3782d482060e812fbec9c22eaae10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50904540f1a65415abdd648b62d8764cb
SHA1aacef4598d9ccecbcca732755cb24c00fa3dc074
SHA256ceafc9ea5a80fbd6b9ff5004187cf0f2fb3341c2e5ea4fb2386841fb79840536
SHA512ff43a8ece746d4da8dba33ecb680fe0cb2781a3849a834fb494cfd79cd67fb52535c39c69d80dcf4f0f444a74208d6445bc63b9f71e96fb9e4ce11cc1706d1b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55784901f0589a266a5f6a439c4a69fd9
SHA1667952f526bc402872597ffd5dd8c800bbe24651
SHA2562e0e9a1d9499c27839ae56d72e2566670a55334c01a8b5f4be72ab0720fbfc38
SHA5127b359adfaec7eb32d4ec85bee418196927901c5a2089de7cf2b8783a6fbff6c585f17d83889e99adf40e9a0eb450feeb80ea155b1faf33720cbdf7c5e8b26b76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5270a058c7ecdad0f16e77c7581add82f
SHA19aeb6599a8239c6f40b24c4b79d1fcd430d40db6
SHA256a493ea8645940fc18ae3bee49d106ad7ced32c3c37f7a9bcc2574c8a97ac9ad0
SHA5122e9205e7e445b3d8f4385cd70d9e760c3936faa4f365bbf7f7000adcc38cf56d143280309deb8cad7fbda65ab4dd38a5b66b484d0d96edde122e4e25f21bc8d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c98a479b0943cf8dcbf3bbdcaf5890a5
SHA13695504a8df2b69ab9daf568386adb601d4ac085
SHA256ce196efc8fc79626564eec42b56901890e78dd8ad5a85fe516c88a8216d7f5cb
SHA512e566d43cf61481aa14029a749356e9d9fe80b739cb0c871d31f1d2a4b191bb0bc1d962e69bc7b444739a48210312cdfe0096c00ca1e83682a0f8805bd25b4462
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59fb4f6b80f0d955acd14b9ce8d47a48a
SHA17ae92335ad487ff573fb82d356f5229186044ba7
SHA256b59f1bd169cbfbcd0cf6b7b528924f15f42123ea0008cada5cd403e057da32df
SHA51298e783faed3dd5b8cb29073a36016c2cdeb197d79dc847db60eb6f3b20f8d5557aea9d2d02b0344b67e5b22077a4b7800e6b9df3bcdf71aea871f3bacf03580d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccc9928edaac001cf277197e4a42792f
SHA1ebb4b12b0f9725d9f1bfb6dfa1e5f911ae52fa9e
SHA2562f5441e254c2e2801ce373a9520049002a945061938c1dc7ce1234dd4524be8e
SHA51247438eea7a6c9d96526a9a0e347fe75735a05770a380240da0b6120aec8c77a8395e662b09c8d72b81d3b64205f7149e2c92076d858104da12d7dad992e486f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc33f7d87eb15359ac824e45f811c5be
SHA1216b6d7c9771c2dd6e2ab5c046ca04a69058992a
SHA25602097d1072123d4b86a2a5dac9643a021e0e760a4abd0dd478c79ad10b7bbae4
SHA512619fc9ff0db294baa9646313636906c46b45d1b640dc90346d80957c709278204942dd56efeb55e465a76b56017b042b60ab39ecb08ffd468ea580045254b75f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2c300cfe2a773d08066f9f5b42c358a
SHA1749d036a7fb710754921148a598483ecc114fd79
SHA2565e0449ae8012b1b0bb17b9ad820dfb0cf801a8b183d14b5273143dff5fbed8d4
SHA512a1a5827a6aad4666868c329f6c4e29d24ba1746541aa0dc169c209c92a5e7b31a2c14495526e999c1151be0d35321dd0f92181b58c0a703e7fc92364c9891541
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bce9a221c80a58793625f493406bdff
SHA1057b658aa1eaa7021aeea0e549a27179f394eede
SHA256859a330b944dc4909c7453668721100750e6292433caa99b5866bfbadcb6c581
SHA512c15e1015bb917412a29a3b4881f7dd00d6a038102a8d23eb5adb630195a5596e4b670befc072500a3e6c16572d5666fe3531af4604947757f24105404224d7c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5651e40d86efaebe93446a767d4c80d27
SHA1065ac05c3c187838a072e56035954ed1161bcd2b
SHA256d452ef3554eb9ad6e457736d77d1f4336719fdb53f9b1028244369d812976900
SHA51208d60699e8174341abe26865541bb05dde1a94273f17bce6faf946023baca0889b6193dc8f6a57e39a1e27401a1dd51c228486e032e16346d142280a951c5e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52584d67f0bb912c4bbb6d174c1fb45c8
SHA199bf8c7671f8162fd617b59141ef13090f9828ff
SHA25648dc585dc689020f29428fe217963a5a54efbefe3aec9b08f66c745a52166d99
SHA512f17b64dc217e372014b4918f56b860b1bf686ab1f464fdfc5fe2a041537f6b096473c4d86cf470615cbd29695e441f4a1a60915348afa8af1ec720ca2ff35c61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7dd84f28b7bb09da3898cf12ecb041f
SHA13876d6953e10f960cf11d691ccc572635c613b33
SHA256ff14c2826e710a82d35c13c95e556b9184bfe7483240b5fe1a25babbe36c1f14
SHA512eeeb1b220bb5d41bae209f7f319f54c6a55c209c9a96252b4aa60ef43a38b661007128a96d2b57409f0006e8c09d0cbd37caa3aa0bd065b6212cc1c48ee2295b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5430201a1ab58b8ceec4c8a3325f88921
SHA127e38b7fa635f5eba973d74c5e3cc5c8c7f80e58
SHA256182244f7b6da5e777fedc5efd92e9481a327f6ccc2a26938e9d4262c843a3056
SHA512cdd983622a84a403f6e9e6f4c50e9f0ea8fc3293d489f5e196ed1942f65c8096d1ff3b626545667f6de6b0cee65462f1d0b6dedbcfbb93cbe6628e84928669b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573d88f904ecc8f90926bab5d74195122
SHA1d42ed78be64bf7603914f8aed81a69b1f2bd8fad
SHA25693d3fe8332cf0e5c5665a25ecbffaf8db95d668315cf5480293b9337fe27f4cc
SHA512890a307daab1b9e1b634ecae8045cd8129940cd52f73c96972912424a7ada5978f6e2214b21a1dc75794983f08c839f4a5d14690dffee09b1c9a0dec218ef683
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06