Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 14:03
Static task
static1
Behavioral task
behavioral1
Sample
741c8b26f83cace5a7ab9f905cc57f76.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
741c8b26f83cace5a7ab9f905cc57f76.html
Resource
win10v2004-20231222-en
General
-
Target
741c8b26f83cace5a7ab9f905cc57f76.html
-
Size
17KB
-
MD5
741c8b26f83cace5a7ab9f905cc57f76
-
SHA1
0873fa529577b9aa5a69f7f91b807f003a40cab9
-
SHA256
52177b22d498a2a4d6be3e7d4c5fd0d565212ce6e9a11e427171c4041955f2bf
-
SHA512
29c4b0af42902290b43f6e153d4b89a46a26fa06cbfcdb8729b0a3f0300443a5b537480d20e4fe17fe3dde9baa1aecbf2194ae389cd9a31b3d1d98c89a186750
-
SSDEEP
384:SIyWkZAOkNTglgrZlhI0/Su/5m1mAm3l1buz8i:SSkZKPhzCz8i
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002fca8a37aec2bd5952ab6ed32c746050a54a654d963ea3c9cb47212c09817f1c000000000e8000000002000020000000df7daf507168b3b9f69acd818266083bde08c8a20562624da02a7ab4a1eea98990000000346cc22709794356a7541f4eed582293fc1db6f322f8d6aee1cf46c02e625d936f46ccfcddcbdf3e23f635b73a579a63b595c9a305e86baf434690ddf055612d105b1c64101c548c4f47ec66faa7b503c5253c3840538f86e3c1835a20d3d9c46ff274252162acd8e5e87df8cc957cbe2c7340f53f8b8bb2c813aaa8d025c1b1f0ae077faaf6b635fbb9f17a559925714000000086c32219a86349f5d0b1f2df782854915dcc422a4732ea1201e89514bae2ee4d88bcf1371e82c58994e5ade0ade1b387b72746f3e2044748e0d86aecd633b337 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000072924a9e49e92930816fe3feebd2428ef584268eedab078371274d9d4b1a4dec000000000e8000000002000020000000e12306ce5595c7d1acbcfd6a8dd3018f76b223bca366333ed3703fd34b5bdc31200000000070ddc00de7e0b76aa1ba8de01070b699cd16895d45557da5207a3dd74b447c400000001397459b31733407639e8703b6167ffca9b80eb8c8b20dd0f8f55c82629cc55eadd5c00071bfc8e302e3ffd415dd185348fb10903a68a19735ea774a051e20ea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0fec8c52839da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3E8A451-A51B-11EE-9840-CE9B5D0C5DE4} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409886867" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2332 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 2332 iexplore.exe 2332 iexplore.exe 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE 2268 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2268 2332 iexplore.exe 28 PID 2332 wrote to memory of 2268 2332 iexplore.exe 28 PID 2332 wrote to memory of 2268 2332 iexplore.exe 28 PID 2332 wrote to memory of 2268 2332 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\741c8b26f83cace5a7ab9f905cc57f76.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2332 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2268
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531f4b47d1fca0274c769c76a9f32237f
SHA16e9b65add80d4e4186b3bb1bc00d55c16e2c0250
SHA2566b7c33eb697ab8a00391dc3b9515677195b87333e116dd86ecbc47743a6d1291
SHA5121189827389320ea4352b79c8bd3c0150d053c3a8760b96756769dbc386d4fe148b3baf94fbeac0af7dd53f51770a00aa298a1ea093d05fd173e3da27b37a80b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502ebbff58aeeaf22532d78cfe76e33eb
SHA174e0c8434bd2f53667228d89fb4cee690e18f234
SHA2564ae1f70892d3575cb6bb299c77421b4a4824fb36108ff5874f70f11370b0d42a
SHA512c580686ce9b32e1037b2d50f37e0ca6be68e90cac9dcb982e6053eaf4587e71ef7b6898a5023ad18e7a77b3bfb4909e578de7ac4423c03166cac5b8e808c345f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f17fe63a9f0e5fb1edd32a0270bfb69
SHA1bde11709bb763eba2f2f8eddeec072a09c00697d
SHA256efe435b128f8a1e76ca2745ef54e28fb7cea11d1ec3282bdf854703f85f793be
SHA5123cc75aaf571f987b622edb2048355bb72f0053ac303de91cf7a511efe85b655d3b3b6e42be1adcc9c017e5920ff165409f377c17a3bccee637d31e5b76f98f53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c997bf28fcee989f496c389c2ea0a973
SHA17658c31828ef5dc3fd7ba4a82712e1dc48aa271b
SHA256aaf053f596418d40f405e590aee0f119079a8b02e9159ae6b5f7a8517d58573b
SHA51273e24657f34a041bb69c5be6e8ae314b95c580ec48d276cd275b0279b0fc1e4352f0b7f488534ddd9c4ab811d8fabe5def138f81a90b22192e04b456e541061b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538d80e3569356df364e6c78316f1f2c5
SHA18150b4c9f5bf0abd71c323905718cc1237e24f56
SHA25687b19225c456caf35a0f607537a0f2feb7a04e3ba4576a116b26353d2153103a
SHA5129d9927fd15108cdd2a185f267beea40a1e63486cc52b68354dc0226be7436aea087c530baa917fd33573ddf597ccda49d77f160efee972e2f18abd666d60b382
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb6e118c2f0257e3ef5103a16940828b
SHA17fab74379244b9f8c3ab48b0310e09b8db459b1b
SHA25658bcf23fab2ec8b3f2256121c0752f027c209ea2be3ec23bdf664ea9ca7cdd1f
SHA512e22f3e692980e634fcaf1adfc336b53024253fb1198e99e922295a9c9d86171b744a8235b896c71319531c56190464ff27d610f3a08564d6087200c8c9502f76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58580a52c11f1a4a0abca39cd5244d178
SHA14347206b3b7abdd0566c70a9180fde5d6e339222
SHA256c034416430f0572e594c6e6baac4f6d40bf42dddaca23f3cbf454cdbfbe74923
SHA5127440fcccd36ab68de265e4e22e25094faf34bd1b1a3313dc0d4c711fd1babe51727a068323c2484d06eb40b85e46afef932a03d0dea96250f4b1393822e42568
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578d1f95b05c825898794ea823e214425
SHA1f0f8a6c6ee50688749f5776cc3e01d6c3c7d7748
SHA25668f17df2a7b3edab911fa868b16f0a95b806bc00aaf7e271af76f37fb1139405
SHA5124e1fb09d151d00acfcdde45e5f82f73a1ec05817eb85373e8329072dd7e18db24d55169e888e2ff1f528e253781e4ed105cd37aff28a3f4cb79443e1f4f3bc11
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aec913f7c7822b34d53bcfa0d870549
SHA1d2d00f16e412618294f7f4f3f0112fc0b823ee90
SHA2561fb5835dc1b1449a10a04f315862f49a6cdd361ccb20a337586671c359eae0af
SHA5121067a9f44df741f4b0a7bdc678f207dfc8161f801d768afd98a884889addfb6aefc44547de621de780874830e1f782ff92ec2244f06c57fc6769d02e3f3c2c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae3e3880f9b31da9c0ff975415f173ed
SHA136c3553a0a64e610e3b088621d5cb3810d38f3ae
SHA256193e6109e4e94154ee52dd243d7fa4dca0f8ef21eb324532cb36ad6b6af94a02
SHA512d5e77338577baaa108b99360a5f6605ee066fc74e86f2cf5fda34086d03dd3d6e9977a2d28f9f7d7c271637c73abfd0c05aced5aa372720f6ab39dfd4329cb63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e809f15f55ea65f4494ec927cdf7671c
SHA11f0e67d127112e0fa825866b38fa138979ee81ff
SHA256aa840efcdef95931cea7066057965da0871a67e2f6944cdbb402f2d9612ce081
SHA5123104f3f087967714e5e610419098427a3c7882893b62ffb0068b3598793800f3ee72b945472e69d69c985c883de11b7a8c5389b52edc3422366ca9f036dfbd3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53690be7872ab207aa1a4ca142bc6d997
SHA11091f3d9eeffb80c0139a6f17a0808eee2ce5488
SHA2563784c0576b1491d3bffec418ccc3e894a04c7687a3bcea8f8ab258ca17d1a42b
SHA512442e0745b190bfb271a1671219dfdc11d3c131ef52b8c976135b4c96dd28f087f30e7e8baeefa4f2ed986fa5b454bcf5ebd855466307283c96237123520152f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50baef41d90723a2dfbdbf7f24fad3c50
SHA1059b5ed7b48ca3ee7b703f2e983f0e7b03a9c321
SHA2564397149c951c90fee7f37148ed41e22d939a8a2fd7a36bc9c7f7276618aab9a3
SHA5121ab31f665156ace147325b0225c2e470355b7f2dde91e93d630ef1bb0bd556a2733cf76a4ff44e97e7720bd152d201d94e41d74d658d75c5b9676b92e8106371
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510e28794d5bf4bc403b166b96ca67885
SHA1e5669bd3d1808ac68448afba9c0d9f967d3dde4e
SHA25605d6f119b61d361a958d7964e5ee1ad0c36500d7334af8120ce5303c34036b39
SHA512bc44062744c2c4331954596bed1cdbf16996f1eabd849fa136796a899fbf46f6c89a67b603ceafe7aa1b0c0328106fb6b257bada77091f9e47d1aee80aabd683
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e86196abec7e8bed5867bcd79548eec6
SHA1e0b75a99512460ce98cab92ea6dc0ae349fefe7c
SHA25627fd54282c385a5313c34268d303e6cdd85bd906f8581e464cba80884211526f
SHA512fdffe5e0b6dd529a918459c977112c1007afe6d012400eca51b4fcbe0cfcbf7e4a2e9dd4c4aa25b642593afa2f9bd638b58e16a61333e7ce6657efc78bde6919
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565824cd038de52fcaa4d48ffbb7f133a
SHA1e2881335e07001e39fb11f2689ff757d9e6b4bfd
SHA256ed57a8b9f89f4ce5879fa21207fce3fae683e170ea7c46ac4c827f668e918dc6
SHA5129befe4ef0e0142fc26985addfe910ab9f67407388aba000ada8b0426019101e0988c3273e035e7d3a70933fbf02f8d2496af55af482130d1c1a13af273af541d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9901566d1fc36925486f5d4f4e740aa
SHA17740b51e959a2c9e6e06a2630148ee052457aede
SHA256670faab8386c3e7725fcbea48ac4bfb2361181d39decf7cfcb73665e20623411
SHA512569edd21559e7957ddb2703b7541aff5ad9319350a9953bbdf2370bb388b1777843c08041bd781e12ddb0f6b405164f26b8cf535baa197b23fd4b5a6628744fa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5882067e927cbc83487cd22aba92ea038
SHA19110a599467946f6df47f986f268d277a18e83d5
SHA2564b377e332b6fd8e44994a1961116689da268504b79c1e80fa85985a4b0e29030
SHA512517927c71ea82e6b2246c1a4b9b1b658f62bc7d1fe416eb5ddb6b23d578349fbead51d28157a6769fdb1c40b1e4978d965eb8aca7dbda5b7284d176134989a5d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06