Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:24
Static task
static1
Behavioral task
behavioral1
Sample
005bd25e9809053b027dc2566356ba13.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
005bd25e9809053b027dc2566356ba13.html
Resource
win10v2004-20231215-en
General
-
Target
005bd25e9809053b027dc2566356ba13.html
-
Size
18KB
-
MD5
005bd25e9809053b027dc2566356ba13
-
SHA1
b66dc3659d24a1edcd67f5bfae604bba7fc1c36e
-
SHA256
a7898522741322472ac91bc027d83a2e5548bb8e4610ee01b720b5092faeb305
-
SHA512
d61bfbfe797d3c2ab06ddf008e16a3c12a34d98cd70bb0cd4d4078d045f86e1d088fc9aacb6dd56580c2ceadeb098128f8e3f14848b1e3972fbea59b09aa8647
-
SSDEEP
384:VyKzCDWobI5EnqYNOulBinbO6bqD20pKzCKqz4J28W:Vy59I5Enq2Inb3bqHpfKqz4J28W
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F84B20C1-A7E3-11EE-971F-6E556AB52A45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000645e035922717aab9a953e5e4cd89fc1e5b91b7caacae6806efda433a6f55d99000000000e8000000002000020000000849381ae44e8e568dff02e8fc322191c5836488cde7f7a82070593b70d5214422000000081ec27b16b8c1460f6ad0255202e960b001af95e6b2067fdb038525dbde1281a400000007375da575836cbf1c912a39844214c1f6ae6febc1bd63c8a0c615a6796b175117c73611a66a2ed45ef8231915963858baeaf79739adb432c1dcc7dfc01de2e22 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1092d2cdf03bda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001d9836abe6250269549ea03bc049d22e437a5053ba80fb2e2d048be98f2377f2000000000e80000000020000200000003aaa7ac2ceaf9ac85bc669a5ab48571fdbbdb9aa6f479b8bc070c1af840feacc9000000017d3af36d9ac0933b9b7d24ac09469251f0d80701f5fa02f3652f20a771644d70ad14bba0928fee3abfae5df573d6f998c9f68141594cef7f1713b486f5afffd5ac37fc624d3988ac8ea59e0fecd62e7c9b5bbcb56b5ad115810db5c802a8a5af1266cb1f3795c874f2f8b13ff03c49f6308b70ac920ab0c667550c9180a5b7e16803e9b6cb97d48166b2be812bb934040000000f93b410b390eccfbee6906c1518e4c16b911d9ffb7946c1d657f55af0afa8917bfb77d4eaf6ce88bef17fe090ccef39ab751ad1178c1997230763fd1044f7e6e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410192678" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2004 iexplore.exe 2004 iexplore.exe 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE 2140 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2004 wrote to memory of 2140 2004 iexplore.exe 28 PID 2004 wrote to memory of 2140 2004 iexplore.exe 28 PID 2004 wrote to memory of 2140 2004 iexplore.exe 28 PID 2004 wrote to memory of 2140 2004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\005bd25e9809053b027dc2566356ba13.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2140
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552cebafb271098485cc96623fc2b2a86
SHA17a75ef7b5dfe8c9fddcf9871fabce6f3b85e96cd
SHA25646a7a7d6bbab1b0ca05052b6c3acbc82e431fd0dd9e0d06ad088ecdece63e914
SHA512144de0f32b71f97ff2d18291533f1e1846837696265adab04a75666cad22013d480d7d98e79cce818ca6612d7e2b3982406e4dae791b6d9dfde8fa33de8f2179
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5814f3d1b3c9b975e7cfa3c5db8de2c90
SHA1844c64bc9b2409792bc68e96d188612a81a02ea9
SHA256d70df6777ff9b53affa1e1964701271e674bea962ed685ceccfce2698bc8b7e1
SHA5123c5356ad362979a8a9257cac15e795145d14351b5524700c5337efa2357bbc83760c40faf4e2241a9914ed9baa0a69baa8643ee65da07bc8d0f47de18775a505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5634a500a9fde419c3d44c53e454a5b69
SHA10c6131047ac2bc1f31f690ac8d1fa4a61b1a33d1
SHA2564553e7b2898c43694a14dd2f94dd6e01de9f62518c4122150b5319542fb67a08
SHA5126e83bf29b1c5bfce37562a6904e5076e9f324e8c7ad92fa06e47bb207513adf2a7c3f0e6f32e350863e16532bcee9be133b234fc8654a7ef24d4b8fdd74cbb54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5050d53543559e58ae19181712257d3b8
SHA1d1873e1854f75cf4bcba7a3e2974bb3ba5121bbb
SHA2561227784aec94bfbb1a77d2dc1d0ad6a68a3c13a5fb27475637f55ea8cb407fb1
SHA512b2d33a9900456bd7795294ac974fed2e14a97a8d31622310024c98286ad9fcbce7c76931959fee076b7498f50559776606ae78ad584c7674fcfa2f35af001dd0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ecd1794a42c0c0551ac884cd37653e7
SHA19430d4f6da908e670b19affd7190e26b2dc6c28b
SHA256270748032b0dd9aebfce3d9f94aab384da385bd4b7cb9cfe484eddcffe7fe8f1
SHA512c3e6adf9a71e6ae51c752ede3961a9ce467fa4178a085df58f4c6473d4a92475a24d874dcf78d2623d6d83db81f6ae06b7a4599a1c3530cceceee844f883a2e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3623e125bc44334a742d5ab9c85eba1
SHA1d84e1ddcb42c1d04535e77eaa816f9422f178f06
SHA25603a880a4c9be2f72c32f2292044d0bdebc842c6661948a0749dd5d604a5b2264
SHA512d2178cd98696b9f5061f87bf3132f1c0778264d002e74f47f05c65197a2297f3b0af1203cfdaa61fe11765d14443c39222389499c42bdd72bf18b81b403d1b2a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c92478d4c637a13eac50c0fef4b86dd6
SHA152629a8e15d23694719350fd85c608688f651cbd
SHA256469cbc2de35a212b4c9550d77e735333cffd16d2c0102a4ddef201df35c5e01d
SHA512886a1b337f37e7a45b292760317a99c2202e067fbfca6471df2a302dbb3239c08681adad9cc05a1e99ede04a2ca1f15479dd3dc77174301aa6a84ed911ae093b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5168b7ecca4250ac9f0e9228288e778d0
SHA1d33d92460a86566c6e34d84f4523f620cbdc7a83
SHA256bac38db88bf0c9821a51dc07103325264b884c2ecd8c867d758d7514110c4fb2
SHA512f071c840f39c639c35aec0cfb710870cbaae6df07514238dccbdd98cd1519110f4598dfaede12473d6b9cd1a16d1b5934fe66e2eaec63ad8baa63953f78149db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acc9b513f35366a2fd215186aa32ef4b
SHA1b5e5fbc5913b1d6886c40d6d83e923dc81496a5e
SHA256fa7cc0c9c3fb39954cc076ebe6e50c8eebc122db746606d46276a7ff186ff673
SHA5124944bbb743f89910891110dc7e5e5f34008f52d4dbe098318c4993a4381ffef595f366ea83d781180e26e1eb29f827f098098cf265070e2cbc107175656d0010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e39e8e8d9af3eb4bbad5618359b8837
SHA1fe644f32f39f2ce1bb771fadf60aa84e3032b97f
SHA256bf29c88d94553bc216949564b7e4e94c7d72ae364357b7ea15e0d3b0753fcb7c
SHA512e3ec4311a31325762273eda5f0f74e20f095f75da05f6b42c5fb419f583656a427d814f14e7d9afe744a208264f6734d87081aa77951b408ead161f1b2e0b89b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a59077c511b92b3081059c14b343d7a6
SHA165fd33a3d9218c4ff55cbe4ca1daad3610088ba6
SHA256e8d30533ccef2459d4d52582a532f393aac136bbe89b834afe158c8b1b9de1a6
SHA512aab594bd98cd293e24aa7f556a9195d451d161506d413efe2dd4941d7fb9344efe9b72c6ae84c20a86b289225bab8002bb9b33f4c6a9951812e223547bd3c114
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dfe38576c92581f68e2d208f3cc96fe3
SHA141761ffe076008cdb4cc450497adc9acfea68cfd
SHA256f5566d8faaffc023a312fff881a2cfed23d92b3090e959fd37717d003d9fd90f
SHA5123ce1095d7f80905f34cea6d18359ba4046faee2ee4e8cea2f4ede575bda0b00c235c4af49ccaaef72ee6aae7e0997dc6e9504a686ddbe35f2a4e948d5b32297c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD518d7f76448cecf70a5caecd6cc52760f
SHA1e6625bba870bf2e948d9d33cc6c3aab6357b0829
SHA256dc0b9f0eb488705cad2a9daba5722e3241d22af46af5ffa5aeefad78a1dab0da
SHA512c81df339c9532faadc71b03b48ce5b0fa2158ce98680be2bbafa05c05e3b640701d1b1821dd449a2821fb58142ace45c03ac1ae7b6e2b40fd8d1372bf7981d94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c30c571111cbe19c446e186979d58a98
SHA1d9ff9367db576992ff87597bc73bb4dcf9141209
SHA256628008d1e0fed1a7056d9f08c67549c00fa8c225dcdc50d60fccb13d4a3ed1dc
SHA5129b30412409d011ffc64150635c7e14fa641723c6ae084092851f8ffbd145bb42e29f79045a3fe03fb8f9f80612f1c3731ee7cc85f75998869ec441901136e886
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572008744ea432b6b7f359cce30490054
SHA14a0f06e910e1b16f5f4db4732324767577743def
SHA256a04d2bc04a73dcdb6fa414d237ca4cdaf451477b70033f45382e3efef42b2149
SHA512af5a39a936492134604496fcfc3ff9c2fac114787cd4d7c5c0d404c2b09548a26e8c1558cd0b210b7fe5d20b9765d6a21f3825c1f99172eca5eb6c17e95a2daa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa913eb5ec7a4391fd18c5a7b323dc0f
SHA17a65aed9bbb12e7d55056037b102fb734f3b7756
SHA256f995ee8db3197834d21be20c3204adb09a474d5b3abc92783ee20d5f45a7889b
SHA512ffb7ebe814503281cf2269823d3899509e321d4f62839a771e7049450b09975b912ea173c65ed08c04a89c5cb38babdce789335ac43e487cb2f756ddd3b79dd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53bafc8401382361cf3c05116563d0549
SHA10c7e97ed69d851292e2aa6dd49b5517a230550c4
SHA2564f8f763d0b202587b1e393edea9bfd228cdf6bdf705faee5030599d880918433
SHA51245e0b8d2c7ace39cfb516dbf2ff57bac0edcaf6135446745bf31f465b08cc90b6c8ac8871bcdd6a94dc0354b81c536e9d8251a3079b77302300c3ce7259de214
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f76ae56a7b0d0fbf8e537381fd0ca24
SHA1a9aa1ea41b3826bee2b1e2667de49ebbebe2d2cd
SHA2566a83b130222340aa8dfb45ef2b497ae75d69f25858189792236788d181ea753c
SHA5125bac8b591b5b738ea0b0332b2edd2007a471202add10800033ece745c54f6395022aa8cac69cfda6a2a85196905317c008166a0aedc5dfdb54a863defce4a97b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5716763e4ffde1d32f4d7637747117125
SHA1d53fb9d02942e67fba488608aabf4be6e10d9fcf
SHA256680ef1b6c32c3810d8cb0dc3746d79fed09305c410c8704d189b9564ac71e48c
SHA5129a461dc0d2ebd4ecae7d7fa5c48f5cb67bc6620fa19f645af3caf9f77e66485d26df1f419e1f1d728e7cdb479db5ef315c6bd7165b568928483800d0b5cacef2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06