Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 18:14
Static task
static1
Behavioral task
behavioral1
Sample
002f629a40e84e6b31ca8a508cab1ec1.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
002f629a40e84e6b31ca8a508cab1ec1.html
Resource
win10v2004-20231215-en
General
-
Target
002f629a40e84e6b31ca8a508cab1ec1.html
-
Size
27KB
-
MD5
002f629a40e84e6b31ca8a508cab1ec1
-
SHA1
83025cfcbfe967035313f7ca60ebdf9c858a95a2
-
SHA256
ec8abf8a6c322833b84e5b883d873dceac82d4e6ee07e2b33b5623b4ba5f7b3b
-
SHA512
162b1389b7430f3e7ee3788f425778322789862c1aaad3bfba3a107bb7725250f952d960d9736b53189e1dbd20704caf18defa1914ac9960970dac81a890067c
-
SSDEEP
384:u9uQnTsn1o/je2fz+944TubjHGZPWBMd8EZ5JVX/NGfzGuRKcq/J:muOLe2YhejHGJWMdBZxvNGfagF6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f16083893ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000dae0ee7c9a9b0dda2cf744f6f096dd41ccb598ba2a289c500d641ad34eaf01a3000000000e80000000020000200000001d85b76e7c0ca128aadbc63f42b2c58221d9fae08df3945a743e5df4cad5f20690000000490ecc0a3cb0aa222be6f2454571ca1504160fe0875b53f449aaf5caa63d429969f538fec2333e7866f86a68879b39dbdc62ed16b03eb27a18c3cec90a140c99cbed9f28b1ac1bb72db380eba8be337ef6da51beca94fc26d1a7a43bf6cafd9b71a86482ad154fc8f6a8a0c6c62c3d988f1e293708459c1c889b58755e11c750484f1b07673418d1941af6e5542cfdcb40000000ad455d438a9e9c0ec2a326e2310babd8b98e3e8fbb9b14513f15d060c316765a9453433dbe4ae6042422d600b8bf26bea72c5059952aece4a062415fdf5b1f70 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410038362" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000032592bb95ee6db9a3422688a828e54d933581205b6707fe43b81df72e034b5bc000000000e80000000020000200000005c62a8ede7e5b8a1202c93b349e007069ff9b5be80f6213d32958d937fa75e482000000055b6b5f86dd42263f287d9af3bd9fdf6d5dd8600d8394b2d667e07f12db3af2e4000000045913114a823c6d67903fad836bedc4f23c437b21be6f01cc07131216d0131835e5e9ccf32d2b0dd3627b01daa1b367973c73c799b04d626c11758d6b7431b52 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AEC93EE1-A67C-11EE-8951-5E4183A8FC47} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1748 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1748 iexplore.exe 1748 iexplore.exe 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE 2340 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1748 wrote to memory of 2340 1748 iexplore.exe 28 PID 1748 wrote to memory of 2340 1748 iexplore.exe 28 PID 1748 wrote to memory of 2340 1748 iexplore.exe 28 PID 1748 wrote to memory of 2340 1748 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\002f629a40e84e6b31ca8a508cab1ec1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD523533934f70adfbf0690c62ca310a6ca
SHA1ecdaa3f07689f35a7f9da82639aada52a8d2b6a7
SHA256064d9e96154aba066c98dc9366a5a73c443212f51de566325fd8d1929f187ac7
SHA5121c667c98d153d758fc53fb458f5574c0ee73a71fbce7d7da5e2ba0f860df41851e3adc0b37ee0363b8fe97b3fc559638b7b7a20c172a8d0e701c611b6033ceb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524900aa070308fa61728d33a6cea0579
SHA1b38527b0fa173df91f79fade11f3169254eb42bc
SHA2562010f335853af9a68fcadf9d6757e694f07f8527c002e529a4835e7187ce380c
SHA512d7f7695225a81419badf46e1314f16942914f1d4735478d1793ffaea8508e70952cfbba5ee5bedcb84f492b8f939cfd9bfed03c6f598585249aa733feb0525ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51361a67ebf78c07251443f0dbf424994
SHA1f4881a64d474e35a76464a65c8cedaf4afe374f8
SHA256654771a356af815b0d24157a2aad82245839ea872cb320df254b8458406f24de
SHA512a099b12337ac5bd89cb48239e102062159a426144f4df040fa8d789deb83b5e110c12d558fd4710a8fd5f40882de75d7702c464fe36de3ae414fc8879f07bbe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593a5beb52025eced07af769bb6961111
SHA100abcd3eb43071ec2f7acc02beb5127715eae195
SHA256f56c271eab7b059213e47e84fbd5496316a2da7f2b713e2cfd681950a24978c4
SHA5129ca161ea327d691d4235df023252e349dcfd6d5fca9be0815767034d4d6b8ea5cfec30674d9a77db93540079060c8bb11ef56779ac37e6943a40eeefec03fca9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3d2f0ab639e9ec4f8d37199b6a989e8
SHA13ad67f9bb3923b1e67eb4370150105f9efad9dbb
SHA256c0fafa56f348af10076925c6e13a2b15b89573a6159b62c9201890891ef05e53
SHA5122df43cc5dfcbe8cf97ae5bc25b6e19556ae0ff8be1679fcfdf638fdfc7e5d68e5bdff4aff66ca63f7fe84d5c637e582fdaa88d40254dfb73ab3ad1c0f83d2020
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a99a447bc500072f0cc1919a00c4ccf7
SHA178c7cbae32f085675c6505421b663195e9b4c16f
SHA25630b057c5eae025ea8609be28fa532331c94e538d0d78d408e89a93653724c9b9
SHA5124661258c29e7612ba890ea76340358b58b5b63c56c8499ecc5dc1be6c7bcae1ffa8e0ec994a2e0da7a8512fb9fda9f89c53e98ec1a84900e42c4e2db06bc343a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53658a5f2299aaa7b2e6c083b506c605b
SHA1c0e6c1f4f8b5dd2c7b1df8b2139a9d96ff0d9601
SHA2564236ddc3d641c5e4154794c07a9d0aafc0c255ce5c2a02f82b56655a21a81caa
SHA512e5ecedeb51553e0d10f33fd9f4378b3457797274df5676cea1c303e3931767bd16716e71c1df661a74631018546b4d91f2262f5c805c69161691cad6dd0deb3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50743cf3dcd0ae855d1cc3968633e0fb0
SHA18a29427eec71085a5aea8abe6b8acd5acfba5453
SHA256586de811f9c83e3d456986ea97d8c6c648f2082b8f2a2de6d68226fdc291b188
SHA5120f6cad374540ec0adbde9339a8a4fef52a6c18820f07c1f27d838e735555ff2f490ff53f29f05099c633f11471443765e6e6fc1a3df4928334e213fd136468f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be4a25fbeef758dcdeeb136a5d9e0808
SHA15f801f95d74aeb72bed115a4d1a1b39d05ecbaa9
SHA25684c2aab9edf4f38f8a835df6970c01ce0dba5a8fee870a1a0fdfd4137ecc49c0
SHA5129f26219653892e651770681e7b11656d64c7911f6f51c1ebc673bb42e4ab894ee5bd854cd3ad121a148c8747c2808b55f33515853dbbe8cc9ff342bebd220c9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5ced0d1f4b60ad5ea2b56d9035161a63a
SHA1a397dffa2ec98385ac2a1138e010d900b2dcd046
SHA25673f082bcaf8804a26de9f0c56f9520e27161cc0f2c481fc4b2323b34a01e27a0
SHA512696fbab1d60c8684aa2f9db59b3991641b062eccc03e8e0a2af39ef3ef2724cac307cc4c599c6b1eb1011e161082ea3d4867dae313e064482ee28d0713cde245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06