Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 15:05
Static task
static1
Behavioral task
behavioral1
Sample
77c72b99463d6e366eb4694121530949.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
77c72b99463d6e366eb4694121530949.html
Resource
win10v2004-20231215-en
General
-
Target
77c72b99463d6e366eb4694121530949.html
-
Size
118KB
-
MD5
77c72b99463d6e366eb4694121530949
-
SHA1
947f36aaf11dfe85c49e9dbdc4e2796fade80057
-
SHA256
4056ed4c7ffa4df97b5d291d63b398744e785f065950b4645063ec0f0ef63802
-
SHA512
07de2736e328f758b2c5194f4071b7a217899a8fe37d16ff6a7076d3eabbf574d877798946624cf87ef5029bb8e041ebbc4fa3010d1613d7a424b217a938a4c6
-
SSDEEP
768:StyDgAugpXJ1dUFCbXnD8rX7ad1/SDDT/QDirW0qwPN+r9V+uv7B9ReOfFT4aRCN:StyDgA7pBD6CwPwV9JelOeF
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0117ec0ca40da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000008a7a6cf3f8e4034a6d1e1e855c5c59d7f4b47b29b9ceae3cd333e0bdc10e080d000000000e80000000020000200000005065e70ba2339c596ebd7ccdb80eff2e4aea7a83d101ea9f43df3e5f700f979990000000caba2067f3a92159d733e5d9a41008279cffdd3c7afad96c82b4a40a0f2b929bed9e2b30d39f1db4d2b180cd9b376ad666e99996077c5107d1d8c108dbe1deb8070103ef2be196aac0818b5c160ff7d116dcd58d98eef0912355a0bd411ee94fb924676b87d2930c13057bb824c7562c8813c74d5943bb3b5ebb8743a070709aae13273767498a8366e60f1aaa938921400000008a66dfad5183d41caca84c44879577d8dddad0434a8e0beaeeebaa1603840e89c06e2a12b5c24c7c110ed3b4bc6e6839929b63e416faff05561fafb2a20335fc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE4CB6F1-ACBD-11EE-9A90-DECE4B73D784} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000f4ec0a992d9cf3454ef7cb7d3fd0cfcb92761bcb146199f9fca8f14251168955000000000e8000000002000020000000c544d20cd30c41323c2d1c8f8f29810be4d8f60f1cb818d069b5017e972affc920000000a6c11e8c02915d3a7cb4b51141fad4ed87dcfdb8fcee8b358dc46f54a0e32ac940000000a1d6ab43851259ac3500a93a49c12aebd551771327e1c2d0adf342b431c82d6140cea0d0fca2d5b8d001a72f5456641fe324d6adf808d6fd64c0470fc11883ca iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410726085" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1268 iexplore.exe 1268 iexplore.exe 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1608 1268 iexplore.exe 16 PID 1268 wrote to memory of 1608 1268 iexplore.exe 16 PID 1268 wrote to memory of 1608 1268 iexplore.exe 16 PID 1268 wrote to memory of 1608 1268 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77c72b99463d6e366eb4694121530949.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
893B
MD5d4ae187b4574036c2d76b6df8a8c1a30
SHA1b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA5121f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c
-
Filesize
867B
MD5c5dfb849ca051355ee2dba1ac33eb028
SHA1d69b561148f01c77c54578c10926df5b856976ad
SHA256cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA51288289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d774ab5413b950643de2e86a2ce1e8ba
SHA1ac6aca565aa57e9e921c7a979e927d86c73c0890
SHA256701dd3998f9a3e0d9c34ee954edd86234889a1daceb618cd438c3e52f2b3d80f
SHA5120476db4095dbd4020864743ef84a4ee47e6516a9444fa89aacd87789cae3912ba30b38b449c2a471515325d2ae1554802fc631110bcd7959fc6b85406241188a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff5d880a4a27abbe2a9a9d927b155cff
SHA188086bce47793f032961c167c5288866850c6749
SHA256dd6f27ec05e66009a0f1f930e8592272776319c0e96cc3b0ed8ad963a3da9f29
SHA512b9ee93bb730342b51a1f05b03bced225efc45e84ae6f932cd5e9e0d32a332eaea1cde4bbbda6f44756e91e02814f57a6988fd1e3e5a9e2616a4a48bbf355cf92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580ddaf4188090ee66c3f18507520cefc
SHA1c2600fe65db1ced8b1ab33fa1c467ec7e8991bbe
SHA256aa0b36738031051c89658252c9a57392209b4a02efe8eb234c5191c979d2ed9c
SHA512180d6ceb0a2f36cae274eb9e566abb9b5b712b922172170e7ed2ae617e6ff8be9589a9e90971d630664e6e410bb2c02a6d7ed1c3546659d418c4f30f87f33420
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d52c117253c29f864ea6809d8e36f868
SHA187e14b3944a4315ed17434e25c25f32f4db9687b
SHA256ef489c5a60d4eed480dd8b50ab5a04be6643fd2e1ae24688687f9146250f5014
SHA512714077684847ce9f1ffd691df958c39520fd4ae3ab73fa49b780925409e172e30bf42a1009766e34aea43a07169ddd19fd7f34fd24bce22c0d6f8d3d1af45853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c88bf2638916ae0fe5590c84587ab8ce
SHA1b11a091a0e008608dc1953d3ba650f0ce0199e38
SHA256bbfb15a0f2d95585bd834791a63a4d78283e32597dd81dad99835af3622b5497
SHA51246c1ab40391df1fa430b3817e44fcbf4ffe9b549622fc5b35427bc87290643ebd3b1f61c8e55ba9c67bfc94547328da7056b4c13ea712b2579e874634b87820d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55be4a4d9608cf27220e8990aa26869b3
SHA11cbdb39941b4c3c28489ee4283c04bd87eccc8fb
SHA256e0b5dc2e2015b260d1a8928568fd4c641401c7abd9d51f2aa6bbf869cd4e0d13
SHA512f56cb92a3d49334bed66de2d6611410b9c5eb9874202b3a5436878dbd449448b30cb9970ace6fb40c7fc9a80ea32c18fb01bfa7d6ff3573a788d4bfb92898c57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae2ab9d49413c7edb0c69d8f2e4568a0
SHA1e9d499da8c604ba16222b5136cbcae40df6b85f2
SHA256b506449b74786e1653b6682a520cf57d1024d26a82a7ace56b63b84234a80087
SHA512055c47642810c60122751a8c9ff257d2ffbc3282429cf8b9aacd60b2301e303d76cedc7a76a30a0ac7cc9007facc07a4963da8540a8c76b99f5945412f7c905a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55deb39386ff1bebe53c379352a655897
SHA1efd3b115d31ff744d871237ab2ed9f85361d7810
SHA256b1839266fd8dfde981e59c118056c142da25b1d6a5f80b7c209bf4c9e10bdc42
SHA512bca18abe48de2dbdb848178f9f826a8d22114379b3fb144a9364c800faf9d01d10cef811c0c3f3bd020997f0a6f9756718d74e48fe36910cac34ef16ff0a38ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e35d50804b9c63ab777c30190dd6f04
SHA15f2f55050c08fa969680e3c47db3525ea0b278d5
SHA2562b76e88a9e257c92ac4a52ca91ab417778e0b1e7d2d55a55ba7ccef34bfb6943
SHA512e1102c560dd1d98a37886c218ebfb46c23e2c3b028f2bee58457fb42062ff89437f8a7fe00e22256e505d30da7780c1217f5c941c0ef65f6333988030bec5194
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5061aa3e7710977dc60ad9ce3799fcbf3
SHA18b621ad8f8b22ef974950c0a49f4bd337498216f
SHA25614efcea2abc94bbf92abb029aae727a5e367824aa928c27a81de463832ed24e2
SHA5123c98379766ae432e02bf1d29d0f0312da4d3baed58bba8a9d686ad869321d575efb23a7eee45bbc9ec65793bce0c6127e27c26fb28220e2b2e25bb4cf5c0333d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a513c35a2b4224eb43ff25ee4a83c333
SHA129b4798a8e600d95ce4d9fe7e142088942487120
SHA256387983058186e8b7433321daab97fac7650d4bee097ab1ffd9e00bcd8a79300e
SHA5123d222b83ef50541988a85924ed74e7322470ce4553fc882236b8587f84ad4a865903e6fa2367b8b2872f8009b0841611abf29e4e9dfab4052fd9c295c3f744df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5342eb85c12d5e55ddeef8892794b0328
SHA12481d9e4d869349bbe120051bb63a9f8d6cf6fb7
SHA256253658555a5cdc77c53c88fc6805d9a5bd3339466ed977e45e414c2c49555e9d
SHA51226b4cadebfa702543576696a1e4417efb46372f9646c35b55d7218b1cc9178d19128d8fb847a2c6c42a6138d4d6d1a33555b3488c0f8fda864a842f2fd53ae0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b87fa7ba3d18d3db37d3c118e991637
SHA1c758315e12fb341ef1f9976a00b0c0dd553ae9b2
SHA256b20ddff3ce554fedbafe73e4e1411887c5394814e5bbf3224e98070304935bd8
SHA51213de33ab94837d29ad6c2e7658368f94e4c4b35e4210a00a5f04bb2728de9297df72c1bf36eaff6e8b4d50a1addab273d36ddcca259d672a79a2e6e38ca60f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b45f8f20338d861004b75b1242b13c06
SHA136e3a28ab9ae69463f473e912fc0c1c748f7dbdc
SHA25604c8c01fc0aa0ba68bdaba0ac3690a6bd5b4973b0cbc1c979573839e8db912db
SHA512edce3c71cff0d56d11403e856c9ac27d8fb537903e1d324fe6d6fb76a220b5d92a4164869134cacbad8f00ac172fef9a5e86e6af904e34195bdb8e9f5e5880ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize242B
MD596e547463c54f0a34b8e8eeca4de9a78
SHA1d3f14f89cc73bfc27c63506483ec1c3ff50ea115
SHA256bb76df0063ada807cee92113c288a71df99d7800a5867a25f6440f0b6c7ea072
SHA51253813243864b39f4e633b06d2a6f3fce03f6b551abf45feb554c94bbb871150c62c633a8b9199d65240329bb4acd4602ec365aafa0e7a5ae01f513304cf725e2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06