Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
fe63833d5a6fe3bb7dcac7cb7cd557de.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fe63833d5a6fe3bb7dcac7cb7cd557de.html
Resource
win10v2004-20231215-en
General
-
Target
fe63833d5a6fe3bb7dcac7cb7cd557de.html
-
Size
3.5MB
-
MD5
fe63833d5a6fe3bb7dcac7cb7cd557de
-
SHA1
35da7c10d9c2978925b8fc4f9e027fbdd19b1fa8
-
SHA256
c87a81640d5926ebc4a2593149bbaa36f0cbeffb63e52a8dc6a73d610be652ce
-
SHA512
72a21d36cbeafecb11ccfcc22c2196c80dabd1be99a0e6bf80b8d0602643560c60f53258c1cca2f3d42b3b46a35b8a54792988c1a31c97fdc17bb4f384bde76f
-
SSDEEP
12288:jLZhBE6ffVfitmg11tmg1P16bf7axluxOT6NAg:jvQjte4tT62g
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5BE92FD1-AF3E-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002c150adbda497a0cbb1105ab3764c00db204b68ffd4c2ffbf64cd2886ab918a1000000000e8000000002000020000000d69da595f7a04f5fc53c640ece1b9c6b343d58030d416d02a940b12bc125a3b490000000f1c4c24b4d0b8579e7c12a9232de5d06306e410d612264322f4cc16e4ad1002d5d8827af1bd3ea40f0e65745834af0d98ee03cb06aa10ba025b8345be767903416bcdc903ec05cbbc33fba9b97546e1734c8dcdd07d3cdf9b32a6b669720ccaf82f9d6d54af616eb7915e69cc5e872bd76205beda0e6621fb9a2ce8998b33cd2a165c2140164483e8757d4a61f5b78cf4000000047954da2a44718d422d616262741862d2a8c968169bf3f95cb41c823be76b0a33d6d82e1b14cd5ac56e30257e68ff4a9dd5406cecabacdbaec820f462682b24f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000005097291baac4d4da698b5a0fdc3656ff0edb1f7faa7863a8220df0dd65ec08db000000000e80000000020000200000007062be669f072280d430f9c5a87e88b796b57a7f6ac5e5f820c5843d53674d0420000000a1b6d5d1b48dd540bf594b2ca83af2d6518fb6c86a42a21e454baef08117a2ff40000000f5f02ff1dc89a27e57af0c0d66629c92e310c29b0bfe734845f5fb1eec99f8c832f041f7971e2c68040bd5befba357d8f3ee0884aa2d1f3ae7613a3e7cf13b6d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b01f4a4b43da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411001184" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2372 iexplore.exe 2372 iexplore.exe 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE 2832 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2832 2372 iexplore.exe 28 PID 2372 wrote to memory of 2832 2372 iexplore.exe 28 PID 2372 wrote to memory of 2832 2372 iexplore.exe 28 PID 2372 wrote to memory of 2832 2372 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fe63833d5a6fe3bb7dcac7cb7cd557de.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b412ebcda3214cc1933c5b581f62901
SHA19c2ff4f77e4945ef8898f349656f32514c1e622d
SHA256cd76624a9a4aadd3797c513ea3c232c1ca0256b1c60e1e629dd1d6a1a1f9ea78
SHA51229aa50e517ec15bade397c6f03d16d9ead97e37cffbf65e4ef0e0260a745823e4eca721ef202fac7546fdcb62659d810ecb5f0d3a4c4f7a85a56085dab720c07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5440467591a581f6b08cb50b4eb618c24
SHA1919bc5adb77e73ab2c90e6ed0662c978bbbdc260
SHA2569234c2ca7ea6efec843bd235c584186b434595b2db4637a94507fcadc7c011d6
SHA512edb3f3e5210ccd6d2a0c20fe7d1f3c32b4b52aeb75f231614d47b20fbc813d535a486f375bf5c693797676757338162eabf61c0f18494359b87d8aed0e978e55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5527ac70384fa90f57840f3c793975f0d
SHA11034a36fe22de6ef4015e4a28c4bf0f01fadf84d
SHA25655214cc2e6b50380734b9702501080b4222aaef0c1db819da80a746e31bb505f
SHA512d0e41b9f3712837c780d105e0957cbcaf47e039971e50732f9d8751721a9fc5f75495903aed7b1ec546d04ee15b514d757b3d5ffce3a9ef0bd2075929453b281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5bb7c95ab907a758d76fc52828a88ed
SHA1ddf5ab2a80057307a751767444406b69c3bec042
SHA256abd9b6075f920aae8358711f8f56a32d0a0f16eb4b8b8db9fd35eba7e674c23b
SHA51275cbb08ac05096e32fb56fa5e5ee1e074c7438d42321816547e53cea5a11f4957757a41904f2f6296dea2229ca8f816ea2993ce14b27733c95935711758271d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f34ddc3c5cadc65d11d2a3b796fe96af
SHA1c932880c45c4f5fc92b6e4f2e2dd314914427032
SHA25692a682fa628602faec7de7f9145c82f855fc323371d53e774da5979e71f913f9
SHA51263c8968f897228d0c9265fba6e8a1ee394b9b6fa5a00e35c6633865bcfd4a0838c1ccd75ebd8c1d895b9ad3e574f7ae2948b8d61f260292fa49f7305bf92782d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504a35209ed2ac73956e95f1871aaea55
SHA13fe898b7dcabbaa2f395f8ad3712333a870f3655
SHA256ebfe1319028d5b2dee5128601ebd32ba77b71916925c8a8f6c19dace3478dccf
SHA512e529fc5133bffa0472dcaa46b2710fa6772c0e1ba983fe22cafc3940b50419c5b9e63a998a683304c5121fd0644f93c4704af5e27036857dd0d00593e1c45627
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab0b98c3ccbc501a9a322361b1dca380
SHA1b222d9b57b6aca052cf115b606107cf94d4a1858
SHA256e3f4905dc881ab8051af3530c04e7a51881755ceca3a9a274aec38bd0b8bde24
SHA512f522f1c5450d52bf227487966b4bc260c3046abdeca89d680cb0b1118178b2acacbf7dc24872a1008ad2e4d25864ee26398a1db4cfbf24af7f95b7d28b89021a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5624fdfdf565f79d20ff29a8fcf003e91
SHA117df64102dcf99a7c4adaec1816ac57f85283db0
SHA256836063253182fea8d47803d287ef7883009fcfebb49d622db3500c9376d9110d
SHA512e8cdc020df1464327c07d5fa0c5499f392897abf14d2adc3c2821c810639e0370017c5ced26594e1663b3f55cf816cad795e37511e6d53987a85add98ab9855e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57cff20777af8dfd1cbd16472646f7290
SHA19e6728e7b6f67be13328a2a8ec5ff2af18372b7c
SHA256f9477c8ae771d77df9266ba48df2d454a4c4411687eef4b41e4d71cade1604ce
SHA5128d0e167a819256c326b8b42f512e81b9696385a977b4291df7111e01663ca8c3eaa113d8cd01ac92396566046d538c81877424ab2188a63ef90ccbacc7b4405f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564d64bf2652b128162dcc2615910cf2f
SHA15e1280750af9bc0fb09455218e94435f0ccedf02
SHA256fa4febae53d277c92eea34bfa1daf66d101e18a2c0076d3a4690a4202bd111cb
SHA51268bae548e2bee4775f9212765669ebc5c60e98f3c5aff0651f6811b60fc144c43391410138c6ab2da71685aa87586fdc507ec782e24bcb3c82a89f276eafb463
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56abee6b27ebd447e44ef21cf15d3eda3
SHA1b0a3b2889ee2abf41c5ab21c29948a332673f718
SHA2565711ce572f73eaf94627aa7bc62f2fd8419183dfac5a4177f0398087d535925a
SHA5127db1a02c4454764efeb7739c8fedb8befdbc68dd23beba07ac14f1f8871fcc09163750c025cd28644d1620a4135933af222437724f3440f27bed80973b388f37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537c75e7643be4a9606e391faa49ca27c
SHA102a004a7a0a6cc1065331d229c44496e83e4c3d6
SHA25629551df82bea5f04f9846d454ce2d87eebb1b318a9046531587cefb314bef909
SHA5129d50a1135a17b851421633a83a0bbc3ff19e2dc358433f6ec2c3dab07707218999b47a7bdf344f31848eaa9fcba3027fa36f123cb9ca38e345c971ac072f0f8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c71d8a4f777fabacb96cf4be56fe870b
SHA1bd300912cb482acf6b8a44a270d924a611aaba52
SHA2569210646ae0338431c7535e5bb46f89533ab8a0d6b7941f8d508be6049b21710b
SHA512ea9dc965a82301e15d4fcf661ee2d2d849ad074111338e24c49882976d5c9b27f6890f6047374b67be406a3dc234b387566e4433d0bd65e6e18fa033ebd346d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c67b77bc088ab64eaadd773e3dd72cee
SHA14a7d55e88ed58c4bbc9803d33cd6f7efd01d9195
SHA256ad1ed4c397d0783c34ed8efe3b3755c568418362737cf37903d29b5ae82dd512
SHA512836bda8445824171b29c55ee0dc81552f31cf166c1252d7e13793cec0924f7dfd3cce53cc6ef6e413822e28ef23747acb1945972529a997d65e3208c2781889f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dfe74d18712f3810b8a2b0fa527191d
SHA1611bec33d31b9b659d01723f690e18d28d3aa3cd
SHA25605dc3221d95fc47f102f76777854cf8d82bf46432a5711dd3e0ba9ec35b10246
SHA512035f8af5660e3395bfc5f7098ae7ac753771ab9e5614f45e43d4a04ef771a6d906c9ce157974ff3243f840ebec1b74c119845d793de8391a0a7cc9c7652e3084
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533ca308ba7b180493d538f2abbc5752e
SHA14c6fb239ab9be27147403afa6778c923b1a850a8
SHA25664195feba4e3d07f0c7184744217a8adc55134c23c08ac9542c724d5d460163a
SHA512fc45172b9f678b2f172c7e6f6a82881a731af3aef40cb699c5e823ac9a4809d46fa1f743c0dca533e1ba18768d459997359fc2881ca27ed057707df1bde45bbd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U1J1BPYJ\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06