Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 23:14
Static task
static1
Behavioral task
behavioral1
Sample
06a1788f1ed43933948a6be57e63446f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
06a1788f1ed43933948a6be57e63446f.html
Resource
win10v2004-20231215-en
General
-
Target
06a1788f1ed43933948a6be57e63446f.html
-
Size
35KB
-
MD5
06a1788f1ed43933948a6be57e63446f
-
SHA1
a082600d6c089c0995309f56ba89724717bc0cad
-
SHA256
e93fda1d9bf8616d5c5f0d754af31057e2e8075179badff99b22db5a3c87d217
-
SHA512
b674d225ffa20ba63608ec27d0a96d0c7c08f3bca7a30deb50e700f30646f21adf117da225852a03ad39bd732bf4b54df3b2c814fc303fb63803354fe5e313e3
-
SSDEEP
384:uoD7YHFrggug87NqyioFrggug87pq2HYFrggug87YqFzACqXFrggug87/qEAr1OB:uoPUrVuLrVuorVutADrVuRdj
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a072daeb2d3bda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a1cd6a8a717ed0027d7008b03b5b2df6c781050fbfb64a37635e4bd44dd42df3000000000e8000000002000020000000e2072f18b0da66ed5267306c642fda313f55f7adbb6a0869065e074c6fd3f60d900000002cc981a0995b117059956b3bbc9c5f61e20ea9355c65e6ac990df2e92b10e944d71e23866b6748cc923028eb83243821f47a6702a8a2d1027427c100d13af62858bdeabee12ffa456d85c7f8b6420fb6dd17607c90c69be84db11023e02e8eaf6b3d0adc8986ed4fb9e380802d3219a45a08d261d0cc06cf261b4488d5ac56799b3a47b5968c49a1deebee02304d344c4000000012d39c16ab45d3f8b59946d85ea734a8a5dda4170651b548bd676453e06707e7eba78dd2fde4e53591e2d49ba30b6ab341e83c77a30af6cc1e91e0559bea4ba7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000292e8d72187fe1022820491ec69fdc4e18fb7f4e9735796c1d4e1549c5025c02000000000e80000000020000200000006dac2ec331910b621e8b1ab6aecf5dfff27f94167b1bd8c6aba2d0b9acba583720000000ab2891015a5ae47be4381fd67ce472b8f0c6deee1a6e4e5cfe9782b48baec11440000000abfd4ffea5632dac9a2d52cfd52e61c58c16a629896280a109e29ec52f3f0ad7e6d7b0ae79b83c48c94c45af752db73c6b7923fa46bb7f31d10fc5f34e835e4d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410108970" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12916571-A721-11EE-AA51-EEC5CD00071E} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2520 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2520 iexplore.exe 2520 iexplore.exe 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE 1692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 1692 2520 iexplore.exe 28 PID 2520 wrote to memory of 1692 2520 iexplore.exe 28 PID 2520 wrote to memory of 1692 2520 iexplore.exe 28 PID 2520 wrote to memory of 1692 2520 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06a1788f1ed43933948a6be57e63446f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8c89a17e307a1112a96565f93f02cc8
SHA127b7f2cacca8df228e74ae6838b243342da196d0
SHA2564ce34197e3b9bb7d76b5a183695219c8abd0542297d5aef6b40f1e882d067966
SHA5120803404cf0752f4871493093cf5cd0b9456439684700ba09b3c31ae0b0dece6730a66f262a22b08335b69865624303d5febe20ff0d50872233f9571fd3c825e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b701a143d1ee17ca4919f7163a0c88bb
SHA1683c2ceb9331c3cacb80e215771ce079f9eaf1d1
SHA25606058287412f620038e764d27283d09c44e604e6e601a363c2d0b6c19997ed35
SHA512357c1a43bb8e5caa3d0774841373c4cb3aa6ecc3e9eba1876b558133aad9828092f120489cdd7c760283bc2ead44d2ac7547b486bd4902ba77cbfb01e127eb5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5565e256bfca487581a62fbc4c6930579
SHA10406244edc4c4752c5600c8dbde862db5a5f981d
SHA256b696f77f7b133ef1df446752452cb3305bbd741a12deae205a3c011cd6c00238
SHA512756ce24342b75d208fa8522812a1120fa412f50c01f955f5ef860ec224eda3de01aa1d0d9cf5743a3ae584413827762596ef0fbc02da24cdfff88d42eef62174
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a9127656fa172abf369d2df34f2c70e
SHA15014a7cb2ea27001b62bdf2b33a1c9beb8742817
SHA25651800ba7b091a4f5cd32da0cd37934a82eb529e2a1228ff0cee6611006ae204f
SHA512bf62a659030e3176018b286c1797b2374d87bfbed356199566d46bf0d5936b62e8e5713da2f929589af26130824d954abaae673dd3166fef114220b31854d1fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515eeda0df117c2a499caf2776b25e69c
SHA16624078acff978f5415d1e5053f12e70435f8f4f
SHA256fe178b13d4bc671778e6806cd055ccdca239ca1cf6e788c8f6f87f865887c502
SHA512c17ff71fe70a83f2ca6ba82169e824b8f6fbe7c0c6b70f41ba31e8be7e303b20f73a26c187093e6448dd597b0080e3172d53fb15504b3cf2baad38915d9fe9b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d6a362735e379870fdd7058a5aad676b
SHA1310b079564f90800f7f752c5fd7b554c87a3045e
SHA256b5ba6f75a54398dc1aa3c46ec81a256c6c8ef72449f16af5526268e527ae59a9
SHA5120cd699a6e14bfd28e3797a746effadb660d5e6b76bf8f14ad153e3fa530cc09c5724ace0c8d78d095c07840097be204ec3de1079f402c14ed2645825417665ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d71679574840582e71415570c6d1d255
SHA1628b0f1af59a7a0974c225b410b61e14e54956a5
SHA25607e2dc114064d2185ade9f359d1176649ceacf5270b23c1b4f92125e99aa04b3
SHA512ec34bad0642aad7cd435b924d70c685e882b2155345142449c634696af06a4a8d1bd2dfa0914abab236855def25ac8c5b43188f2c6adb0e4a9c52e2f4e26e837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2d48ffaaefaca2f7abbfe5008974cb2
SHA1265b7a14da2c36e7eb6852c646aef8b474c8c7a7
SHA2566d301def7f50085b2f2526e1a0ed1c73fde37aadcdd965f4104c2090895c4478
SHA51241e2911309c5b229fd2edc521bf9bad59c02446bc7c3a1c56a8778482060d638ba058a00cd74d96ef8d51fe2122b47d1da4cfd365c8bf319509588b0a2f09502
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fae1f9a28d3187dc84f5cf20d0d396da
SHA15aefd889ae47b6beecfca2b2f09374c31aa96551
SHA256999d8cec493b9512caa7cb40288f6668557377572df3ff8a3d5840746eab582c
SHA51265fdc73498167775fa599a55ca6bde8f2a37875fa7802f25a6018026e862504623c98e1ff2c4f1b41882498a87d13507dec27daf0a68f289e8bc39d84f1a05a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59765a61bc29ff792a9009c4a8a16310c
SHA1b6122555d406fc479afb769476079b1e96212455
SHA256d805c7b6601e46025999e48057ebb080a22c6c354a2125d6cbb8aa40a4ea1b96
SHA512749dc77faa8c53fae88e8ea4da13e924270312f678944296a5e702d613eaf8aadec05d77aab976357a4ba67bc1c568f40f667dcacafb9d04c50357df9f25b1cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9c261e3d7a1423d20e27775df53668c
SHA1ad6896414e6c82e5da27908baaf8bd0b6f6c8282
SHA256585a02d973f90c514d7d26ad560f9675b75c85ae551ca57ac348d0a218fa23ce
SHA51212ac4c1f63f8778d96f3cd28a69a98200172a79b19301c24de9bfdc37281510cfb923f6a28763c8fa3e746e4597a0c471adfb4b44a01daf58ab61b58efb29e88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53541c4eecbf244a4fdc4925be494ee1b
SHA1c515afead4a331f5438b498ca561411e091ca1b1
SHA2565a21e6f2ff4468c7292ab93ec98339e764ffb5a9d25dfa7ef9e98a6e8b36a3b0
SHA512c8a950d1fcf2d6dc5fd8d5e479ca59f5c2dbb98fa6a23262c30458b9fa87958cf529f9b3ce928ae5fc25f08277c18a4a604958877f70836c0da80300e9cc48a2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a69715487ba3c76ff291c97e9e5be133
SHA15555fb941f9fc8e6ba53ee239cccc52fc62eda5e
SHA2564d6f024c56f4bc72933bcdfcb0f50d40feb954811969bead497725d7a9e22e7c
SHA5124ddc0ee6652d369bce631c84a310ef2585f1033599197a7a6c2ed9283c0f6f09337725e79d1918a005acce73b412186b229b727d6781223d11dc59904a0fb528
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faaa9c270c0cb71d0017ded7f8ab4957
SHA1ad7235d035a0048d3752070bf529b2b8bb8a3171
SHA256b5a88859cae2d9c7ceb7d3ecee9fefd7b1852b75e8a1a42a2c75584718a392ef
SHA512584561c58cba5ec1020d1ecf1c32e872d9b4af662575fc8c9e02b63959abb742ec7f993001ac4f1efc3d4881a839f85264aad54f8f2e883893f7eb20480baabd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f569e7ad789f54a77cb81f7f75dde57c
SHA16901618099c207e096fa1b8337b1afec04cf2714
SHA256f09f6ac3f25e7631dbaf11f9351f239e877ae675f63573cbf1d8517f1eccc4ab
SHA51231b1dc8d68c1536bb3d35c88c65408df827e1bb7121e2a2aaa563608e9f0e1336cb71806ee662ddd528fc0be57614762d1105f69b813541c26848f652867d674
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533654f0ac34b9917d361415036c3c6ed
SHA19b266cc295a267e11b921bb28b1b8b09ace45585
SHA2562637b0f894c43c263c478604e50eed8c58942b20daf8ef13b978bf762f868bcf
SHA5126ebcd8e8440b5c16d2441af42da892d3255fe809520ed3050220a15915ddaad90530e1c90944dbf1807801353543f390dbab0793e4bf9e144c6044b85760671a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdbf982e5c12c1aab4cebce645921789
SHA1099a134d36d323bfc4b5996e5bb526d0feb08410
SHA2561cf2d5e30292e7a3fbe46a828c393e35a846371849c22c2574c3add5fb6d087f
SHA5120806fb777c77dda17ac21e943d37c4db2d751fa430df157f55b3a4545b575a00112c47987fc47de51e467f13d4281b578b4fb811b55a1eb728cff2977fd6322c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586244e8449b2160e3a2daf53cf2e5b24
SHA1319c6f84397cea534d0b27b8320e0adf4a9dedfb
SHA256a7b9a52a68e38e86a4a67b3a179417b409e8b133a5938f062c172c8ba3ad7009
SHA512c38d6785214f582751f01a24c8d19e2c8ce6a69bc63abf38f2c04802f0af76c7c76f2f1e461522b114fae7c4630d4cfad31f87db2e70aa5c5216df8bfb8fef60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a85f57895944ed5a2265eb8a793f1ff
SHA10c2e67817f66bd89e2571da7e2334de52d90c9fd
SHA25644316780144e355f3545619be998ccdb635c663b9319b324658b369510048cab
SHA512570bd928f2ff4aece4176ff0ae0de3f440fc9055c2bcf7285442f5c2b7340ea0920a86eca2c7a3b53e8f7621ed7515a3bef859635860cf6cd62f7377adf9167b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06