Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
78e83a248abcd5492a1bc3d152c1bc64.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
78e83a248abcd5492a1bc3d152c1bc64.html
Resource
win10v2004-20231215-en
General
-
Target
78e83a248abcd5492a1bc3d152c1bc64.html
-
Size
35KB
-
MD5
78e83a248abcd5492a1bc3d152c1bc64
-
SHA1
b97a599c88cabfafe36f639727a422b323e6b273
-
SHA256
63a87aed3726b86041a8945f6e5786883bee2e6764ec6072fbdbe8f57f63b77d
-
SHA512
78f658af7dab709a94d3a1646dddb426853a66f9d4be0f1a60ec6a26234bb5134fdeccb97483ef317c3b42ca316eda4c049291824af39914e4c7fc24b43296c8
-
SSDEEP
384:SMZ7Ak4Kwx+WcUH88hM03FDgeJDR6XooA7TAsEVkItVRNyBU19BJ3+L1/:SMZsk4Kwx+WcMaX5PBZU/
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CAC8E71-A52F-11EE-BF73-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c933865ec50cf6aef53ad0e459afa0ffc7394d725ef29de23553e8214ef65300000000000e80000000020000200000008a21b3c370c3046b228aa8792002ea5e5f3e1c4137be931e1ab6a8a265b38a83200000001ce7ea1a41b91c31c455448d1b07978c2c169615a263452b3a0714428c502f4040000000a50143c7bafa003b914d06d4b1ca40220d2dee4b27b1b98962841529dee5785dce9f2c0e925e5b6c0a4f0533268103899b77d336b89f8800eea43e4c758e52e3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409895229" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400eb3433c39da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000002b4eb5a8c4a9c0ac9767778d7a879cb5c4845ed0c1b3c072037b696332aba5e9000000000e8000000002000020000000565319d13fb0bbc6dd9cf9483547ff18969b6c1215af08058b9ab4b0107342f390000000dd39d3f3994a75df22a8fcb632a0d83d8759564525d83c97e920557cece6839cf02c7fb819badde4ed4efb20b33b677aeab1e6d8f51825a9f5b18d9bb03043f72a2d6a2ae5a26bd41c39f7509f83f1f699a1671f3610483b08f6547627feeee2c8e53ee8605a9d1abb6f38283f61502effcfcf7fa3f8edd2702913425c1d7cfbe4d73eade69eecf9b4f5dfe7e4bdd5bb4000000097e8adf3442c30bd33bfea662ddc4b51bda3aa6a1ae1166b372386e3fee589ae12761471227b080f0bd5843ab6d019aa6626368ab375c34cf2adef949c0dc62e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1424 iexplore.exe 1424 iexplore.exe 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1424 wrote to memory of 2388 1424 iexplore.exe 28 PID 1424 wrote to memory of 2388 1424 iexplore.exe 28 PID 1424 wrote to memory of 2388 1424 iexplore.exe 28 PID 1424 wrote to memory of 2388 1424 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\78e83a248abcd5492a1bc3d152c1bc64.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db4d28fbbe2d7ae56bc62ae8869d3595
SHA1af3195310bd57c5de0b17e3ddac27a72a84ceb84
SHA2568fb636635aa1421762c1a4c58596767f96c5cf198f08a57b28b86d7810bb6266
SHA512f49f7a522c535ef76367d04103ca18699d78848ecce37e21061261ddf03d32fa2b7b51a3497400bb5851a85e156b61087076c38610f661e5d0da2eb311f9f989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c4df414f741ce7d4707abab7cb474caa
SHA176dddf9c004086cdb4f92a3616e500919a6f13cd
SHA2563fa44377a2a2ed794a8b82ee2cb5a656c6df7539a215e06609d19102decb6ebb
SHA51260792e00f0733d2bf35e59ca62f16c12dc2a602b909f03a411b421faa6caf68d55855d61289dc54d833080e460e14d96fcf5845eca98034d6befb205093d4b22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab753acb10926d523f786bbbb26c272d
SHA1cb2cabd3a43924c1fe00830f8e715a02be6b4d5e
SHA2568eab0c958adc594d0f8917211dda8c116020d97a56f0e0caeefb13abb0c1de7c
SHA512076dd76eefde8ddb166e55c159d940a79ef1a7b7ce24e70413df703e419cb124f7d495d7e023fc3e01cff3befd037121f62b74141f3a316050a4b45a34d31470
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51110bd899b83461ff92fa7407f6664ec
SHA1b08cbfaf063c2d369500361fa82f29087072b05a
SHA256ed1303170bd0eaeb1f77bb161511f27ad45c3129d521fe5a76f3d760e01fce1c
SHA51295f8b127f624fecad83decc5bb5eb96f4f1fc07b07078398c5697a14ff5b5d1b647fb025ca8aa94e1844f5ad401ff421537ff46b50438bee0a6f1266692d5a1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5478a875f82db6054eea18464be06f7d3
SHA17e4bbd6922dbcfebd076d3bbe1b39771ac0a0c30
SHA2563cfc04145bf1f41dc009a03c58ed82ab2e07a925290c13be84577a3eec6c7345
SHA512a96505c9772d5d14508b8b9cf0cf08a476dd9701ef416698265bb65752133acbae3a75dbb3a1bca2f1a225069f62aecd448c60c86230a20ae555236399cd3efc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a932a99711cb89bcc136f8b868ec8fa
SHA137a641251394e9f49e66ca1ed77485bed0e1c52d
SHA256b8dcff26b26e8aeadb1d31033ae657434aa5bb8f25ab9d61c2292795a1bfdd9d
SHA5122f4e5f797b255b3d87bb3712827ee2f1281b0b7afcf4538b71173d30b297e0b373bb23ee83ac8406610ba63e8b000d16ca715adcba3de41ce728b9a085456a8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7c9f91a6062089161788cd1de14c202
SHA15156f2771cbd3a88c1e169bccb1e5bbb0db98140
SHA25674775c05e39b0873c6b251c7616354872f7148570856574a209cce23690bcc9e
SHA5129db288f4fda48928427bed5120c6ee7579073ba741da706bc669e8961c21613d536706de090bd00d8f3a372363e8fc6854aa2729f014595eae3d070f20db756c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b671a8cd7b3f216b3bb9f38b60eb2dc
SHA115f194b2bca8dc67a74d389c55642c149387ba4b
SHA256b455f195c0b64d33c2291b2503ed2dbc9eaee02688f6b1f831a84bf6ee443b81
SHA512870e43ac52c06a0c6e335e05542b39a7b3ffcc82e2b7ecf994d83c756ab3d06fac75a2d4916c43274d890a5f2872657be98aee6dbff5b9e59a23eeb7ea540794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5298a70204d81792acda3e8b260eca670
SHA1357d974eb76cfe72923c7c49cfd432c4e1e27f3f
SHA25684b7f006cbd514ac93f1db031dc744701936df4642c8a0dda75255d85b8e4c72
SHA5120fbc2b7bca61f1d63dc9642f67cf28a1961401a9f61aade1a793315145f0f16defd2716a8055a01d3403778cf8e114ff91f62ea5e95676821caeaa1e73f3288a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dba27a284df7d600a5cf314ed415fad
SHA12a5f3be58b0f8e19206266e3f8cc86ee8b7ad74c
SHA256c8552d7e896583d000091de9ccdbc9fd3e14402486762a5d2098b0085610797f
SHA512509022c6a7fb1397486aa459b1c9c6d82344b8b2a922431cc40753f26f7367c39f0dfaac65a70b3141e4d83c4ca6101f34cac64ad4120e174283f8b169965492
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5546d642cb0ca7169906be19566bed5e3
SHA17ab1d6880645f9966225a545d7531cf3980938ed
SHA256beb0597c0c69e1b8934621349f509bb040a946ecc7980b4c007a5ddb9805c9cf
SHA512d11a04c56d369111452e7f7ab0b33f505a9a60ff842b171060a783dbfdf7f794768f744a465abb208d5570527c6d7a5dc7f76527588707559709ae3fdd377311
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5056864affe5667eadd11ebd530245509
SHA118163afa5b4a5fe69bc9d4e2fc279a626b777f9b
SHA256b7898a3657281fde8ba87d53d66d3eee21dce13fe327fae18d3cff7c4606abb0
SHA512de00ef19e5b67b9a3f8eacf0474f8e15536da029790101556b605da2e5dae304295b2b664e78c05aac72af6f363bc316d2eed1b89bd3cca41972feeb28245148
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06