Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
fa5b96776ddd76be60628ef26edce9a4.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fa5b96776ddd76be60628ef26edce9a4.html
Resource
win10v2004-20231215-en
General
-
Target
fa5b96776ddd76be60628ef26edce9a4.html
-
Size
98KB
-
MD5
fa5b96776ddd76be60628ef26edce9a4
-
SHA1
a9497a2d95642bc8e8cbd3557d70143c05f4d5f9
-
SHA256
e60b88550256b026646e5120bb0e1cab165919fbb4b49ae461414f3fdeac2187
-
SHA512
4ccab726fb077c23a1eb1320781be7fa2bdcdded39b5bde5f389de4bd55abf5bdb202bead9753ae5329444f6990e15abf293942f8a2921fee73997794049d50d
-
SSDEEP
1536:SZSXPzo7S4KjmVCwzZ2wQzR/kFZWJRigGEFhH2csw:SZSrCVCbTzR2IigGQH2cF
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000002c4d7248d6153bb58093c658b2bfb52da64961410cf0eafd7c6f6a27bbf5756a000000000e8000000002000020000000eb3a89a32b99f40cd6451fb210a302a03497261418f45c60f73ee992803fbbfe20000000e35bd9f8d6489c5ff035ec28709c98d4c4355eb3138f9c1c903d4482a6d979a540000000244382ceb7fe1dd2566b8e181446005dc8bdcff55808f2afb7d49a21aac0ed6887cbff9ce48e24abf6c34b9fbb763ec73ccfa277d6345a707f2860821ddb56bb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02ceaae4c3eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000013a6fd1f08d3ccf761e5b9b7d1570d807340cada5fe1927d85f97c9e32ff7ccf000000000e8000000002000020000000404e84b40f2ad2aeb082c57331de28187526ca894391a4a676556e1788e1c4d0900000009804c44c938ec5a21613898252418b6125adbf54f1790179c8c1de79d58c5ba204765e3975b96d6b324855af69cd932587678d9de58408b1f465ddc3b2340f217fc9d8d1a59096c5f7b6d179d2af5ef3d223cc4b3957727949b327632f2e8b2c18db852a47e1d76f1eb2af7bd52528078b05e226606dda0e03d8635035f91d379ad83b888693968e8db7a38f6d876f3540000000f9f47c54e2f12ae8068732e343cbbac35f430ef9da6e1d7a633e5ef49a931c622473a4b8b48d80034862d9470bff5d5b5a0dc8dd7ba14b1074189682249574e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C104E0C1-AA3F-11EE-9D00-76D8C56D161B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410452003" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2288 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2288 iexplore.exe 2288 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2184 2288 iexplore.exe 28 PID 2288 wrote to memory of 2184 2288 iexplore.exe 28 PID 2288 wrote to memory of 2184 2288 iexplore.exe 28 PID 2288 wrote to memory of 2184 2288 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fa5b96776ddd76be60628ef26edce9a4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d3b39ce61ac5bde2a77c10f4fa979ba
SHA1b8360bf0a7a23029ebca44f41fdcfeca90579ca4
SHA256bd65cad1feb657a7f77e7aedd007bbb4aa81201304056aac788e62a4938b74d1
SHA5121c890d7c29473f295045635da3edadbda9e8d963dcfd51f92542a025ede879aeef1dba7378f984daaa75fbacfe9d5daa008ba71b3b575784ad4a8a4311e396d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f7ed028abcd06e1750f86f4013026bfd
SHA1e70134f75e5d454a2a684a1c13f84258c9d9770f
SHA256a1bebde774ff51e1c695c0f70acadfbcba5baffe30408636b7a7fc0e37a669bc
SHA5123b4491d18479cf6f830a8175d5d2bbf7fa1dedb8d766e586824993cbb877804ddd59ae805fe93f9d7cfa50dcd7beb60f2f596adea1683ffce3e303feeb4b5147
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513d19c08ff0bb7bf681b4160674e286f
SHA1f37e5f61249f05bf52e27fd52ab064271c1e9f70
SHA256a8906c285c136d255c0f65fc392b7e71c40fb5560f30cebf75352101f7946317
SHA512d4539cd1bbed3f40e02d18e9dd532b3b621c262dcd8d3e54d6b1c22a43ca2990121d42c22853283022304d0e8c00a80571a9aa290eb2b8dac2098bc61d22c804
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f551bab0cb0c124d40fba64d40b72c5f
SHA18653ff68cfc6f026811bd554a8bd0fb41449767b
SHA2561217f74d826164421e0e85ff151fedcc1e7aefa934c9d44adb568f0ae6b35fe3
SHA51226ad3b4c78cc416cb45dbc0c3a2f4e38c33ee17211708ba014d8df2ca41270bb6c2b650eebf9027d49d085e0b12b0a2f124e0b4cb725582cf444828d8fbb0c6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5038209d24ddf41108081e63039941110
SHA1051dd82b88a8ad5ec27bb7993f4e3a1184d4185e
SHA2569f5d5be454110e70f76a44d20598c7cdbac7099c76ed6f062c94cad74ec2e384
SHA512d5c18e9934ed57e51f47d5cc895295882874b21b7e0c0208b972c9af502dd8696aa741d0364664a4fdb39277dd8907ceb22cba1d76697aa8ae5408eab48ad142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ced8a1d4b9f7c57253f49d90c4ed1b6f
SHA12a51df6eb2aa400a87696b4b721f4715bba2dced
SHA256d6d8bdc3e6a756f6895fe086739e4724a9d24286e5bd889bce5892a62bb9f255
SHA512b97a99611396b814fd91f4432ad62967a6d8a8a09b97c05ea9a72831cc020a4630d5696f98c70f6708af78175e005900e46a9dac4a7212cc05f892a47241a6eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59131daecd357db8409dc731dd7f7c9fa
SHA16310627d04a3ccd36fc6142f0d2a928d63d59677
SHA256fbc30eb26d5ad94337f7979167c1fb31951d3af33c3d5d7e6e92fbaef75b7abe
SHA512a7a81c9169b397e45179a949eba6b09601c525985f91ac20524fcced82fac9fc339bd5ab015c8b4863282ef85d435806131012d267f451886339b1b447ce0551
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5066aad40ec1d5e87c7dd7b278f9f2527
SHA192e78a0b85c40cade43a81698368a74d815af998
SHA256eb0046f86291c29d3fc5f3f2802b1fcddf2cca29f3d51ba1d7d0ced0e9fa96ec
SHA512c29bdbc6c792c85600e3a1219cee560a92966d886be60b72923d3099f8e3526afbbcf3b031f2bc9b80ccb444544a10c69e7d2ae00a5e09abd45cd672af825794
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e6242a898d437eaa63fc910c8d44dd3
SHA187a3000d3bf920443ebd839d91cfd07067faec4a
SHA256836f1990dc66ccbc8a1eeec1322d9669d1052930bf7d9c896e3ef130587f4a0e
SHA51204bee801197d872b93dce2163b1beecf22848df7818b5408949c3c6297246ae26ec3956e6e0771cdbb5b7b3315d2421429a395be36cef7eb8d138e99967c3163
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HJ0GGVIM\J47HM31C
Filesize5B
MD5fda44910deb1a460be4ac5d56d61d837
SHA1f6d0c643351580307b2eaa6a7560e76965496bc7
SHA256933b971c6388d594a23fa1559825db5bec8ade2db1240aa8fc9d0c684949e8c9
SHA51257dda9aa7c29f960cd7948a4e4567844d3289fa729e9e388e7f4edcbdf16bf6a94536598b4f9ff8942849f1f96bd3c00bc24a75e748a36fbf2a145f63bf904c1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06