Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
239s -
max time network
275s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
04f8aa14155c379e35172d544c6ed5ea.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
04f8aa14155c379e35172d544c6ed5ea.html
Resource
win10v2004-20231215-en
General
-
Target
04f8aa14155c379e35172d544c6ed5ea.html
-
Size
41KB
-
MD5
04f8aa14155c379e35172d544c6ed5ea
-
SHA1
9ca34608e1bfd79c2cba976c014f5432fdb88771
-
SHA256
e029018a7b3ba5372a2d51e91691378be8898bda07701823b82c4d4c0a9fb755
-
SHA512
c79626ad23d48acd0196d5b9b843f23b8e3f9e836ec8c7a52427692dc185eb503354171d40a09b56c91f87cbad1df92b4a30d8460d70dbffa1e703134544f372
-
SSDEEP
768:SZyyWECGJPTIOuF3SQzUajNPehPmxhhcdajfGqqa+qDVJIzVSs2QlsLoHGKeU8:SZyy7tf6SQzBjNmhPmfhcsjfGql+q8V4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410067726" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{05C91050-A6C1-11EE-8AC5-6E556AB52A45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE 1924 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 1924 1704 iexplore.exe 28 PID 1704 wrote to memory of 1924 1704 iexplore.exe 28 PID 1704 wrote to memory of 1924 1704 iexplore.exe 28 PID 1704 wrote to memory of 1924 1704 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04f8aa14155c379e35172d544c6ed5ea.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1924
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59a092804c093e849e8b906cce300cec9
SHA1d4526cfb0ce0242b639e094ce60b1c8dab10fe47
SHA25644d93a525d41bf235f56099a2009a7938207b4fc68648340787da89ca9c86a3f
SHA512e9a6e0b8f1103575a71f98d9823603eae06f93075dd400fe46e35c5d690c7458cfe160f2deae1eaf82a5ca228b92591bc1fb806fe41420985fdd37d0e32c3d27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc86db7a817dc04f7e902a26645d354c
SHA1fcb28b14349172350481fa53707cf515e0d09126
SHA256883c996db5e3d9c2d66b0506937d6b4be050f1f0be3612e73417671654174358
SHA5123ca843747c1a78e833247a8b028a88ddb18f9b9845f77fe672f073c80174c189dd47d53b5f3b29da0b7fecc2852637647f0cf6122d5bc048f2c5c4d164577d51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6d4569471d1654423f4e43f3f735ded
SHA187a7ffa6a23bf3913f456e50b33176f863596e9c
SHA2561038a002b3ba6c21192088be0f3a1f1963249cfa60b970f6a92cb274b2edf596
SHA5121703cdcabdd421d79aa688c3d4efc587cef1082dd5eb04bc100af381c9e8c3a901fca9e3533ed251646c3b1cdc8776f3faee684626341fe0f871bd2ca8d74637
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f35f8f2b812e8aa9f46a0212a9bea55
SHA1e5c6fa8a9592f24c779c2360dee6a289c9a66cfb
SHA256688989d32b08a4734ef80ce3798db558c2901b380c986da1a7a6408179076da6
SHA5127076dccb09e677481efa77fecb614fb451e28a70c67355c6e4b85c8cc6bc115e96930019f79687d545de5a9b348311ae3ce5ee30e5c52b809cc9b58dc48e07ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7bae7e2f94964e58f1c8b966ee2ffcb
SHA1a3514d0621a4e3de7cc1c0167499383ffcbb6d97
SHA256f252f401ba101338475f9e1ce79a6c28631c2b4b54f2d4d3566a805513bdd037
SHA5125675535bb83e2b410275852196dd0a59c73d025d3ad68d67f1ef774db2b55fdcff5267ec04831e370e3c104b01084a3c594f6be064469e2e7fecfa3f10058712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bce61da79470300d5d3420b78f2d43cc
SHA184a776a7257976f66fa601e121aa3fcdcfa3d770
SHA256c92e94160623dd61a4ec5258d81c367cffb47593a0501aefb5c3542b8a2f7f91
SHA51215eaf4cf5423787ee3154cd70c9b859be8fae0686bc20386d07c4ccc4c19702baecb4e068fe79687ad4736782b7237799f3e75b62562a109273b580a1cef4585
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517d38bc9247cad7d76a9c40d619c6c0f
SHA1a668cbcbbf0efb5e1d52ac6e0baf5d5102d14cca
SHA25649cae1e3e98d909f449e5aa72383e28146785e326a56b8b9ca6fdb933e468413
SHA51255891bcf195d8a349a64ccbeef29506c31883f57922b65ea95633312e8683b3f0619a492f32647808ea98b854e1bc2c54174e6671cf5559e3633c012ad8b041f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506aa2526e08420f0b46372c6b75b719a
SHA1fbe3fd38dd410f0bb35a3d7a94814ac5cc5ff853
SHA25683f8e688a326dc0cc396becdfade4f02e5fd4f1cd6a69a862a288cf71a520ae2
SHA512677eff28d56ddbc34a169465ed5c52cbe9680277fbed865d02697c2a90aef82b79ac054b0dc1e74af819e2b119d3d026db6afd7cfb62dd4e5783c15862bb0f0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e36e799c69631ff4f37ca19fc2a7f42b
SHA1fcbfe17d206edcf33ff692de867c10fdf997a18e
SHA25697ca22441de899ac31c0e66ceb4f06e64e502279fb7ad9a0456297169d74a061
SHA512cb04e7ab7a5091be872c6fa644e6cbf198283acfa2e530572a9ae419f74f8bc25bcacc2e6f05f00152f86e640166c92e5717061606e14988e8355c212a9cffa3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b982279058b167b6b27e86f870016979
SHA10e75d9b1c5114f4914ac025cf17fa84dbb1e1162
SHA2568d604b93b42994109279687788de6f9093c9f0ce2c6e53ae4a858f3f73a907dc
SHA5121dcc4d3832bae75a803b0f55d24bf205e8d8c3b2f047ffafa3cb149b388ec9beaa3867d9b8b88726e273b96d6851114734e292cd07a13318a7329f726be1b77a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d20006801867007ebe7bf91607d2a01
SHA1743317d0cebf03d2adf2e5b535ac41bc349784ea
SHA256a27abd04e020a45c4b4088ef75746f29aebcbfe086db1d57c704e36787c277d0
SHA512574c2003645f8643cd7f58dfbf47faac6120f4ef2ac560633d0400976eea3efc5196ba57deaa81cf30778fe4fc14cef8fa3d67bb407b6eb9019516fb3f04a938
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e30698f5b9c187e4e0cca5115bca5028
SHA1d92aba920f84044a3a86766d7a19975a824823ba
SHA256937cd5911e5b06222698928846184de0618708e70c25f67351c2556f9567b594
SHA512c7da32a8c429ec4682f7d4b19732bc1b6fa057590791df019342cb3b162200c55817db082bccd91185282696ac1fab5c8f4dffd28f6497e8a2126d9f2148a8e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c11339e4ae082dbd381f8454fc45fb17
SHA130b3db8672679bb21c38be6b9c0d729880480cea
SHA2569c9b9631160547eeca2653ca102c63c649ea553050802051e1dc252e50fbca69
SHA512af866fccff0f246ac575523a02bd19d11015268695a62fcc346ef18af3ddc76de84515f5f4d0bbc7e1875541a092d8b31ee9551d59f93ffc008e98de10d7213b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560c2c97a6a3d52baefda015ad61c1800
SHA1a0706e43a676760f11a199062a102a10276ed90a
SHA2567df8df6a1f0cf1fdc76d56b5bdb14856950eddea941dc670ed056db9946935e5
SHA512cbcac82fc1a1321a8d484ad846ae412724a0f4285748ab6b35a26e0cfb4a01f1b10f555aa82bfab06153b2bcf427bb0e3758d95bed6d634355402128b1a32d14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f8f519ad304df31a0af02292b701b94
SHA1d60463aa51b9acbb7e7a845b9facf058dcb3af68
SHA2565500af5d95c775e4709b4a77ac3e616ba25b19c0a277e5f6f33dd8988ef59fdd
SHA512f41316070e0dd63675f941565b5a367fe9bca597ff3b24b37a92fb2b4e1404cdb3a7a5e1e1fe43162ff70d1c4490fb0db0fa65a0bbb3656d1e5a9a80c3178193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c03f4a387705a4093952b95945cd2c5
SHA1a98e4c6764cea2cbdbe5170ee72d3af8320a8a8e
SHA256ebda0d0c60807afc9ec10dbe6ce32d6226d4c6896074b6b9c92a6eadfd9ba173
SHA51265bd7a5e179c59a9f90074594bbca28512634e5a368518ddc0a085cc9df5a555c0e4881616f55892e6a85285df2baaebaeb02f20599716890a8821ecdd55bb65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b103b450cad300f24c265ceb4f61b34
SHA1828738683cced771ac090d3e3770c1a19d93bcb6
SHA25695ff4c5a364bee00de119cabe2db4509957b4766db91257d78272aafe5714600
SHA512e6d842aed3a50e566da90ba3f8e59941d62d499b3b0f4a4f2be2559dcd7be9b251f802befcba31f5419824bc21d8dbd58644e576a85eb9ccd6d5125c088d0705
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06