Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/12/2023, 23:30
Static task
static1
Behavioral task
behavioral1
Sample
fff5d119d7ec3decc8a2949d91654104.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fff5d119d7ec3decc8a2949d91654104.html
Resource
win10v2004-20231215-en
General
-
Target
fff5d119d7ec3decc8a2949d91654104.html
-
Size
32KB
-
MD5
fff5d119d7ec3decc8a2949d91654104
-
SHA1
9d72ad3b8ec715a432a22fa4269722512e21107e
-
SHA256
02cd55999477a215aeff45d32ccbdf248364d09c3a03bb314544748093abc672
-
SHA512
101e917d29ba325f9ed487d4e9e54cab636410519fb958e288f8ae246095eb89284449da263683e5eb5b3a8889b8b988c175b93601a9cfc9919e5f2aa5cb8304
-
SSDEEP
192:Xc8li2naObFpaR46LveFyO4+mka4Ws89iLx+aoTbZc2TtEWEkfqFTNaD5Z3g0/a6:MEzUEqtESalDNN3Vd/O
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000c04e0cb8952b838bc99ec8bb95e8bf5caf282c77b360486baf86bc48c39a46fb000000000e800000000200002000000059db60776d1b70c7e39cc5152934dc99a43e700a300499e1577938bd3a2719ac9000000013465e5f5c14d53e47294f7bae26f827976de5a0e52627509d3bc1363fdce205966607df4eb8cff83bb089b5c7a9a02ef87ce2c39b3d7c2f524702efb33eefcffb58f651d48c7551e9455c45e8a9bd0f17fd4b2ebb09ade1d4eb407986b189661529f80d71054fc3861f07d314fa2a33e11a4a6e308e740ea9b3fba18e279ebc6382132ffa7da0ac28dce93a7b0221ca400000004713f6cd69bbba3ce9311e2bc656625d9c738883568c551f9e160e4bcf09ea48a83a552de1eafb2cab8ef6f4812660e8a4ec94fb9a679bb6e97878ccc6089b60 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c4d5996a3eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C45CF191-AA5D-11EE-AF10-EE5B2FF970AA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000db2a7c75523d4d584d1e63b32d8f1bd7b7354fb5ce9e2b71a0b1b1d8a0aca130000000000e8000000002000020000000e95edc67a6f8834d702be9a83c0339912d1605a39b88cd34fc5fa3f5c11c6d8c200000005252bedab91dd59d9bdd4f52fccc6ae37d4a97744d549456fbb2025f020ec0e8400000005d3a78e57d8af960816dd44472a7f3b72f193a8f232f019af975f3a11ee7ba28a1d423bd394a5f747371f63f42ee2378c806a50d38c250ec946a19e923fcf169 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2476 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2476 iexplore.exe 2476 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2384 2476 iexplore.exe 18 PID 2476 wrote to memory of 2384 2476 iexplore.exe 18 PID 2476 wrote to memory of 2384 2476 iexplore.exe 18 PID 2476 wrote to memory of 2384 2476 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\fff5d119d7ec3decc8a2949d91654104.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570a552bf135018bc12d27093b32847d2
SHA1f0a8e793274c4c02c87b875dcc5c5acd09931eec
SHA256e76de7501a30b3b4355029f7fe580741f19a0b7f4c50c92013046cc702a72309
SHA512d872847de859d8d2e1b55af4e9422359d10d289feda4fb59c980d06fccb67d5091efaf0a18ee7b1d8354f94541ae1dba10b2b93594f988c7ed8946d3275af85f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6148e69b6f8453a0e76e1bcf2daf390
SHA1787fff6e6b3051b51326673b94af18eeb6c87e3b
SHA25686058410d90dbbd161377d1dfdbad48fdbf2d674b6fe40f47f0c53e1c71acd71
SHA512eff95b2caf29528bdd7fc02031432d5e9e77d400a4cd3254271c64b314efa0f4e913b39161d9846e279b33e903902c4577ed3f35a0b80197c3b0a652a6945900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c472d0f527f798d250e2cdfad53847f0
SHA1bf968862acdb100dd39d170509763deff02a3c7a
SHA256e0fe1a7950e0967a1311ddd5b785d45540d25a8ac6949c32ef04cd9ce2c0127d
SHA51213b130f4e065888c633844e3bc53e7f6214df1c7ef2325a146eb17ffff18d72787f0ae78322b7158a98c7bd1bb922a561410af5c003557cce1024f4f289abc28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5192be3d4ce43dc7a4299f30148c646c1
SHA1394f9fa20a2e494f4ad536dfb85f711aca05faeb
SHA25668dc7201e4945ae39cf7bf24f754705c7487dbc8c9a6325cf57d27c9c205844d
SHA51246c106dfe16379a3a01862e74089e44cb8cd0d1ff87b84ac1e463312e697882130957bbceeec0260dfb4b61de89b0a42f888faf5c25710aa947a52d8c0f0a751
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b95689cd4f287456a674bef419c7ced3
SHA12ff93bc34a169a15f09c7adf388594ea6a268a7e
SHA25628ae1929bc0c58c180787d607cb332a32565ff76b7c80b8158dee236040a4a86
SHA512207271ec867648dc9a60d5a803e3823ba2f00991abcb7b5f36de9a049149fee904abb397cea4c1e654bf7aca17870bb4c436cbb91a4b1345293b6bcbb5a7b013
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e1651fc6e76d8c613d0544b5124a86ce
SHA11a905b27ffa4284ab0308a89986b2245297de103
SHA2567cbb8e1a48164824a73d535a4e9bc511d2d4cd04ff76ee1520de3f7332020b6a
SHA512b737bed06a136a124a5bdd0a7c6af0c24b3ab4a23008bb9eff709c911ba21cb6876c970be83d51a996debf3d26bb37d70864fbc645fcff27ea3a5e3d805266f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5389b7ed971d671cb0f17fc0ed2309b27
SHA1900aa22d730adb0c4b92fa436ba0852314ac512d
SHA256298be45815b5378f23e16031bc1ce6c9e4f3a542933f52ab411444190dbeebbb
SHA512fe14470618aa4583b1a0cf0f5d85f728a12841fbca9a682e4eb8b12e8fcf59d9f88421002806d9b78dbc42b211a76bb440e16af2e207254fa7071630d0bddfcf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06