Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 21:38
Static task
static1
Behavioral task
behavioral1
Sample
f9f0678af43060b1375f56a2f1702bf7.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f9f0678af43060b1375f56a2f1702bf7.html
Resource
win10v2004-20231215-en
General
-
Target
f9f0678af43060b1375f56a2f1702bf7.html
-
Size
6KB
-
MD5
f9f0678af43060b1375f56a2f1702bf7
-
SHA1
96291d9d8b55b3cf42ec76fa7590e61fb9c37835
-
SHA256
f920a19d42da2852e496f70e905c0ce29ed7c9d02687f19a5d2a46cf1919386a
-
SHA512
c5a1d6563bde199de031e2abb6b3095516acbffb8fc2b1b581b23c48fe2c663857ae3eba5ce94ed18e0de9adcc7d3cf0d814b6651a8f1b7124220ead2a57d6f1
-
SSDEEP
192:Zy/O8yw4RlDEvHLgszgA0cydXDChxiqEuf:8/O8yXRiLgszgA0c9iqEuf
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410995925" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000098e41b17cef3fabbc48ce3a4647a39ca9f7abccfa1fcdbc4f670bace2e08d765000000000e8000000002000020000000d092c348258831b573e3d4f09f28398e8a7c6ef0ea07f5ee6cbb8d404bad56d020000000e013fa9b9f57b0ec127d4bc3aa2662d0fed17f4e37333abb103fe37b9b354aaf40000000281cbd5022f68814dab5cfb77763f4c8341648c95b4bee842a9dcbe4830ac9da343aff71b7ef33356509ffa332fe32b5d546e41712f370813f6817f4f1b3547b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f662ed3e43da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000e18c5800aba3366bfacf2c0b2eaa334da5a443eb596a3cc058a10db212e56ef6000000000e80000000020000200000008dd3949ac0cec7829c6c3fe59b345ec3b8f4cb1a692e044db0e11e5f930bb9ee90000000d535bf2be0e8651998c7acba9fccead3db4a592ebcef64525e6fe023630df417ad84cc582dbdfc9f9fda812870e7234d937bbe97b3ff52a077b2dfb4db7495e4b21e81dafb482f2671cdbd221d40b21f25412a202352389a9164488182fef589c2cd2a44b40c76fb01fd4c9e3cb8286879767a5f6952ef38ab537ee02389fd54b0a0b924f241d31b03d69d9747cab3e94000000085e8d9ca27beffcb6ab891f307937822635e0d3d0e629905c18c92454cbab95b9e7b620fd0d870ea56d5b20f35f8226c8361fdda543c78447d24c6e0c40a89d9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{175C3AD1-AF32-11EE-BA23-F2B23B8A8DD7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2960 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2960 iexplore.exe 2960 iexplore.exe 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE 1348 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2960 wrote to memory of 1348 2960 iexplore.exe 28 PID 2960 wrote to memory of 1348 2960 iexplore.exe 28 PID 2960 wrote to memory of 1348 2960 iexplore.exe 28 PID 2960 wrote to memory of 1348 2960 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f9f0678af43060b1375f56a2f1702bf7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2960 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1348
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9ea8f987053e151c239f24ff3e0d9d1
SHA141106b4fe9eeb07e25a8f951e3313eb1ebc416b8
SHA25696145e1ca7cc966f61727e7147268c59b9b69b30c063146db781d19e6db5ce63
SHA51218dd7458fbc4f0d952a877b32b086eb7a95cd497d80c250dfa8c81a6e4070e7528cb4c3ad216d9fc73149f1f7f5d4485e7bd0ae7ca49414ff498cb6bd31536f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e18bf3f69f68761e7e7ec2709f2539d
SHA1f4823564aa9bec40a5d47cc1a0986d649a27bad7
SHA256933284401e17d550c0ffe7974d183056fbb2ed75f8c3981723bf38a6c83ecfdc
SHA5124325f3195c067d7bf120c266b4a7352e9ade8b816cb2372e13c52a3ba75d3f429daa5ae36093cb91ef0717dd8063029271ae386b70d8627b8caa0d9bc54d814c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa596992e71a3efb3fa5299bcd76e12a
SHA10f98925a33737ddc7a4a59fa9ba8e73e0e007791
SHA2566f657b4ccd78633e41bf697afde1e30698e9a358ed8f1af4a5b6a3ce614091e6
SHA512666da327b2e49ef84fb6495488e8ead3f7f397fcd09bda434d957e8d179464bdf9e42aef705c28f75d5a5ac13bdb21ce4cd12b930cf402f935c7f7aabf4458d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de1ab1aa2d36bee33038b7c7ed5c6c60
SHA12816862751a7483976c95c27feedc7b6a1c19da4
SHA25622ef39afbeba32e8f13119ac17199d073ec99705d4ee0a0471a4463542a76329
SHA5121327c43421c1abe9da1b3a5708ffc141236aff69702e852ffebee049a3e0e593e60cfa1dc9912f0225e56269c4075622e0928704f7d953b8f8d1fb02ce94235d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50753cbaaa9a6e26fe7357be20f914a82
SHA1836112ff010b043308ceb4d88cb12cdc2739f264
SHA256b3d9a0d1655ee8a58d056ca389f361738bc9a4d03627241ddab43abc322552ab
SHA512f86337a46ed1c29937b08162d075afc1eee53baa07328712189640c9c6bdec745f75516f076fbbc8045aec9a4a7b28e05d5043e731df0cb08a3572f00cbddf1e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD514ce0d101181e5bc562f9678f5cd1318
SHA19a3bf816542b02de46e50b55ccdbb6c992c90b48
SHA2565a9ba650e495ef88ac018371b507b0864e3fb88161e9ced4f4cbee0672f55412
SHA5120e0f53d486c26c1d112dd6ef589a2db8719ad842793cf47d37af4915f43f0ba6ac77fa31927716f89c6d7eed61b02ea4a0ab8fc1ecf972780bd2b5a2f44bcabb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c25fb5fa96974f8ee87bb4cec1adf79d
SHA1196d432993608678c7e70cb482665810728e3957
SHA2567247c584242cd265e7b04f521b30cd3b8bc1310e847d45f7a6ecf53c13c17a69
SHA51283c6606279ab1dfc8839f59f6aeb31b4016a22132620500770cdb77d50ffdea44b575d00d1c6f9b944550f37c8f822aec869a5222aa239d0f306a82726a92058
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54268933e0c78972a615da329d35b5d45
SHA18eb3c7a45b3dc6d088ea07af174c57790d962f24
SHA256966b84052783048a947ca5f37dc0857b67effc49f2932b0133a757452ff67f4d
SHA5120a6b693fa38e3baeb5129a7627ef5e0aba9599e5130efab77e9dfe831d76443a3c44c98fe86a79f666b5d25c19066d91e2f39178ce64e2d848f1247ee7d57ce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5128246abfa0c4b8596c2b31a65226c31
SHA166098036be79672f2f691ae86d3013238a85f765
SHA256db6ba505beb8770d995a00f738caed194ed6cc2b82464dfc1b5b45a218a689f9
SHA512ca6906002fd1accb7203bbf351e88d016a6bfbe2fb8705cc7d0c39ebd34835987295194c8c9b7726ba3a339b0fc24c26aae6cf3df04af146635fe23bda0f14a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd2600d3d3773140fb67b011486abc71
SHA15ae1530897e4e8713a3446e18d3a96884eb6b074
SHA2564ac5c16cab54c406e7755172b18bdbd9ea30bcaa6ec8d9d37b8cd6a90e0708d5
SHA512cd2fa6effc14f6bc4eb6f0a1f5617ce9f7084abe7222d13c242210bea913dd2725143fa00e971b6c30387c9ee924b49cda52d49fca918f1d21c89860e25bafaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573dbd876f487fb5c0bf3d45cae1d042b
SHA1ce53f66b9667d923bed924b961aa1116640720bd
SHA2567b0e4876561f9b8fe12e1e95dd533ae00b5d27f883ac683e207899eb6f931a31
SHA512c03b151993aba8ef43c79aaef64eb20d4f07c394b0babcb6c5e118a5f49612c7b1c74f67bd6c7faf3ecaf1713f01b8f5304ce26f36c7bc415886be9807456e77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8003250ca5e70001397d1a9431d75cf
SHA165bf46603576432a171ce0bdcdfdb62b4a7f0a9e
SHA2568e2ecefd0d4208b50333919025092849c9d5abb4fec9c501396970dd3c9e6502
SHA51292a37ba8adad2b744d8bb8a623356f3e570020c050262291fe887301ad10660f9b2fcccf6f6e4c901bf2a148845c82781267adbec0f6381df868cfe83175732d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06