Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
26/12/2023, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
7f52b292381a57a6ca749eb713e85502.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f52b292381a57a6ca749eb713e85502.html
Resource
win10v2004-20231222-en
General
-
Target
7f52b292381a57a6ca749eb713e85502.html
-
Size
33KB
-
MD5
7f52b292381a57a6ca749eb713e85502
-
SHA1
fbdc26599f058830a4b0473f709903458fa03097
-
SHA256
22ac6b1c13b6c8f5e7f7bbbed25652fd6dd5a948f519534035ae699869950d62
-
SHA512
094548abd795bb30a6978a0f5961ac14c96fef345a9d66273c398ec0f692c76dc37b0e30f88574c3036e0858ab67f430df5bd966582bc6ed5f093ec5ca2cbe2f
-
SSDEEP
192:ShPPIlAT8kCqJmsXuWHGXfDpac0/tPHzpBt9zpJC+tCTzpEa9/tjTzpmtHzpOthq:SholAT8kCqJzImmqgqw3wdtfPW/E
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{09166691-A54A-11EE-99E5-4A7F2EE8F0A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50960df55639da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000319a4938a218fcd5dc26e74659fb4858d72bfdcf22d6b8fc420610e83c764ae5000000000e8000000002000020000000399b79753b050dd1453d4c0365953cc51c647046b826b424e0b232fc30d9373c90000000f43cd33c46310ab43bdc06c1758dd083d6c0ddf910cdbf39cf28475830fa051c9e91233c97b101a84887f4641f081bc315ca4a117dc02467651b5d369c62a282b1fd5020872558cd602dc35e5482cbf9af929a2c7bc3587ecfeecf6f2232c11965c34a36ea758bdad0ecdf6e71cdd5c31b23a0225ac3fc47ece6431afb29ddb422b3c0e2d9e21779c5dffbcdd96f16de40000000e5c7285a583cff4dbd98861ad3cf5415c5c58a28d26364d60cc6b686d315e2988df379e09212e7dcb90fed60375ffcff8a0a1488261305bebd9ffb9964d47c0d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000089e57bdae1253f705e59957290142935c59c9c9a4a044b63ecd3e15122da84c2000000000e8000000002000020000000fa4c28e26c4748712d72151dfea431ca902936e439f0a1eb029e5407c0360b8c20000000d6d8c3a7692f2cd5c584b872066ae959fb4845bdeac25e4ecb36bf313a5579864000000019c3f8d4ce522df4d1999c5245a92e7a5da62e073eaff9c50f907316149c7334772d58ae4d153d9eaffd336af50bb9632f4502122f7795894a0a1f140bd4fa29 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409906663" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1996 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1996 iexplore.exe 1996 iexplore.exe 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE 3028 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1996 wrote to memory of 3028 1996 iexplore.exe 28 PID 1996 wrote to memory of 3028 1996 iexplore.exe 28 PID 1996 wrote to memory of 3028 1996 iexplore.exe 28 PID 1996 wrote to memory of 3028 1996 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f52b292381a57a6ca749eb713e85502.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
867B
MD5c5dfb849ca051355ee2dba1ac33eb028
SHA1d69b561148f01c77c54578c10926df5b856976ad
SHA256cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
SHA51288289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5314108e719b3f1aaf7141ecb97944664
SHA126239a6aadf08582bae77fdd3ccee1d83f836b0c
SHA256bf4251e2abb932fdadefce23d6c66849943c11d1ec5b3780b9821b3f008e486d
SHA5125b2abfe28b20fc59ff546dd7168e9165246bbf2c18b719cd6f9dcb0afa1a925d7431585cc19869e4e6d6b397327be12948a9a1cdcd49b8a74f5cb73180d4c75e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7001b0c84890d0e1a9873d4e82b1a28
SHA1d97c971adb6d9e15ad045c8547df4853fb03da9b
SHA256876b5adb0177b22d930e775df8b5201074ab42f74f3906e35d8792084c908011
SHA512d3cf9f6fb8225960dfcaffd9633bc1da55901448b8ec9269dfd4c108e8d59a9675f1496f1d3388682927d038c99a68757b9e057d77b89e833e0995f6ed4bef6f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59571dc9798089603e285edce9c88c8b3
SHA11c2b62ce05e876c85846cf04d3430f2241a03660
SHA256b255a6fd4600df079d347a379a70ec9da4fc90ff614044f657f60d035f982279
SHA512e068c713b060fc13af290f10701abf9587a8960580aec49f9478051584f6d201586189382201bb2a7387b91c7801a3300d50380128c2342008f256ca73bed068
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d38e294a388b7470be3b7bc82bec472
SHA1c7975d4bc90e547748419297189369faf8aa834b
SHA25605a73b212db7448921e5fd71bdc1706d4201eed70d708106e5dee1e059c36b7b
SHA512bec4ed607e8874527421c24d860b795e7bf7db35f7c528f0c6025aa5952086dbb35b136b869a59ac25b75b1474045caf9bee096de2cc1e33d815c9e12367454b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5596ebc0ba0f967bd34317676db4406f3
SHA1633ad4705667a5ec7b49b6240144f98c4b42d33c
SHA25678e371d779f36659b58f9b5d6d739b790fbd393f1e12c0f419a36ac06f31487d
SHA51209d7b68abc33d2d3b1cc2439195c7ee64290c88fb2e15a5149ca9bb67f9a5e52048502bef47eab255c0837f82e4861786aa30c8b8d383740321cb34d18ef500c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd5dacfee622622102baddb22d1d0fec
SHA1cb6f46e28ddcecddad8a4b3cd0560457960923ce
SHA25670529e5d665163d1d7c14562c8dc947e8881d6b3fd99cdffc28b842057ce9ae3
SHA5122c9d98399b46cd29d468b92fe2821b9602544d6e5e449bf0af1a48d00d2eaf8af7aeed2a64e879266260306de2b68093d0bf91f96e3abc46374b18ad88e52126
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53af48dc632bd8c9820c8bc41e713d121
SHA1f5fe3106330068f174c6ddebdafd4c6b0206fb34
SHA2569e4f4a4cda7d455e576476ce33e9d71fefcc8bca22aaf9bdaf40a45883316b66
SHA512edf119600c3ce4f79a339c1f7bc910bc0254b9310430db4f7db7357e8232594a7f45a8f64cb393aca5e8a6dc962cb53096c80b96021042f4982a762eacb7ae72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5613e09a6fe72dc433894aab4e3373334
SHA106585ba53672b1e66ea2235608f7097c5b4b36be
SHA256e01431309d3808334c773f8ac3b35feffeffae61ecc76451316172345e0ff2ce
SHA512a9bba02cf80ee599c67dce6ce2c5e541f4f09d74f379ba06474824b7b11ab5b699d9030329e5f7e1d7e14921df08071da0f352e80b0426643c74b4bdf3717dc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5787d39599728b9409092ee53d3dc7a17
SHA19d3eac39b117c1e0d98908477405e54bf0f0de04
SHA25659419d48a2c0beb9e158ae4442179e053852a28c476112179003b2d99e98fee1
SHA512dce98e35e3c14385b1dbd6c69924527e04748d17ca027ac27c048020e363877002e6c60fcd7210e8915b5f86ba610d12c599d57d8352da5512c932e92ec5ce96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55f0057102ee791e5b6d67026a56dfe4b
SHA1fae2b6eb5019f6724e7b80893db85b5a08610281
SHA256c56025ebeb4b33f588d7304c6078d61641d6645f7c8d6f497365d30f2725c51a
SHA512b1b1bc5387420d7dfce74a24be8171aea0a96d2a9021c0254bfbd86ee904dd1d01fabd38908722e4762d235aad0124f82a80481b095337ac0a4567ebfa963f03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5099c9763626053ea228bd7452cfee76a
SHA18dedc9ea42de4dd560aad30320c1e6b707681161
SHA256caae0c7d468796de00b85794129b0dc8c73a7056e1a8f61b53104c50903f0d0c
SHA5121c2e4234fcd10b73adbfd3f88eaae5434e8c68ce6ffde164542094c8f0bc705d0b0f01eaa9a40da488414a6406de2c1cc5a2b935c7bbbfe7af57a54c42d1cee9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F59A01A8B782D93EA6991BC172CEFFB1
Filesize242B
MD50c9495936b0a2bfeb6fe6de2d3cdfb70
SHA1225e6fb32cd350ee9036c609a5bb4680d9303021
SHA2562fbfcd3ad08ed7d28be108c2ac3d4be2e74dfa606946e7e4261a23716e9a63ce
SHA512adb2441b7b2e9a1f03e07c47aeb2e3b3209ba8244cf135a72f5644ba77efd8e7377f5eacdd29fd7453aa8a79df5592790309c48ca051437a69201f439835b1dc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06