Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 19:29
Static task
static1
Behavioral task
behavioral1
Sample
01c248963f3208012b924454607b5c01.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
01c248963f3208012b924454607b5c01.html
Resource
win10v2004-20231215-en
General
-
Target
01c248963f3208012b924454607b5c01.html
-
Size
5KB
-
MD5
01c248963f3208012b924454607b5c01
-
SHA1
dde5f67164db9ba5b29bfc2864e7fe9ff47dcbec
-
SHA256
a0998ccbee4c3702711a2f88afb4554fb0ee92ebf7fc319ebcdf856359bd630d
-
SHA512
79bed1d29afc5d6f3da5da62734d34590cab6709be73de579065b90d2057f9125b1fc24ac69daaff50b050009d87feeacf9a504aee3f47f67ee9d23f6fe8c796
-
SSDEEP
96:1fbea8h0jlIItdydddddddddddddddddddpnlIwh5hrfDPXfnsq6gToubNBwOIEs:1M0BlyXrfDXfnz6fsNBwtWppZBR6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0545b70963ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9B44DD41-A689-11EE-B6E5-76D8C56D161B} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000fe7efa2cb52bbf808464eba877ae8d4fcc89c8b7706d55c88a4fb25ecc2e4b2d000000000e80000000020000200000004b9de1418b51e86db9a80a0b8ef5c22105d0c01180a5e86ffe3b556f3a7e9d029000000072049fe56b5f4ab6d11f8b1509551311cce51bde7de167e54693f11f3d8b35b815a8d5ad247239803a9f66736b04a7cc0ff68341950252731e244a5aec020db4e44cbedca2cc717cf8d9d0a7777e065ac037f0b1b8fb1700bc59a697c324ee7c65c4b8221ebed6c7984be13ff58b7aabf11785f35ecea3d773ca64cc6b4436c40ca3e820793f9fbd9b6109bc575c3e3c400000004c5b27f280d17c77d3ce1fff6cc090357783ba7bae2d23a0fd380e423b752a9c54811722aac9b5ea8a8dcdc0f496565323924175bbdb0321ef8e726001ace5eb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410043931" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ad2ba381920184a3f387a64bf31d5bea2e97fcf51fca47eaf7df0e84b866c0d2000000000e80000000020000200000002becf64ec57e64aafa516c6e360b1924b3c5a56d1f864d233be6900a6b05b32620000000a2df693e3ceed9129bcf5f3c9d214c5daccc8c1d1df6550ff7106dbfa80c488740000000e3af27a044c04cbb508e287955ed33b4cc3bc61ae67d1c8cce181e08fae75a3fdf408ed7cfca7765a79d015ac544a693a1d6b9835381079e98655f6223b13894 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2192 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2192 iexplore.exe 2192 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2800 2192 iexplore.exe 28 PID 2192 wrote to memory of 2800 2192 iexplore.exe 28 PID 2192 wrote to memory of 2800 2192 iexplore.exe 28 PID 2192 wrote to memory of 2800 2192 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\01c248963f3208012b924454607b5c01.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2192 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a32962aa440687e73b8c0d4f767bc62f
SHA17bc59710134c860ce173d594f7d455b366521a3e
SHA2562746d79cccfe3e6d093f37a13ee2efec1fb37d7f124b796e183b4642a858dfa5
SHA512da710ef89887c90ddd2bfdfc2fd726fe337d694361f3aac28901bc17743d1f9dea44b621c52a7a8a4fc9aa7713c4ae296e680482f666c5cb3c56a05e01e18fc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555b973d26a8335a65091dbac0fd42ebd
SHA1fef145542f980082c0ef114038802eff057cdafc
SHA25639987db08a80e63b3c70cd2e1841738268c0576db0fda5803d253cd717b14f15
SHA5129c5f40b5f0238409150ccd8205233bd831c0b86f3ee45207825751d1974abcb7681dd54f3729e4c6d00e6a28852c7d1a240982689748e149d7f553f6bd36f344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a2ad08ae936fc44d3ff211aa4bc2acd
SHA14040283235f7348a56396f9d6eb7f1c0417f6ab2
SHA2568007b649ad21ca3b189cb32b11a075af10db96e18978e7a33507463a8a550419
SHA5128940b28e51ad25d18b53090bfc6a2b8f6a5bc69a4bf3f064d7aa2d6c2a41e9a0fc7fecf9b8543b0b76effee0c9d1d78721fcb063702404ef4a5e25a1a7ae6dae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea45f30f5b7e0e3312464b3840a3241f
SHA1881508ac1733a58be79416cdca72a6abdd762658
SHA2567026f625c13745c5f7f55aa114a494486877da998f3247a1cb8c4ad6064da7ac
SHA5127de7115fa5f052f98d60c52d9448e66037ca96cc266dd0efc05573d191bdd29f8df5054f15c61d9f8a83f8def8798e5768eeecf3bbc5b129a3549de516567423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500444b3a3874902261c08cf25e66f611
SHA196aaf520707222ffbc109195e0de1a6168bd7cad
SHA25660d83605c3139df06a9b3ec8cf106e5bc18a2c8d667762b39d5088abedcfbdf7
SHA512c3557af392a52d3038060b01e8aa41bbde516a6d2a947d8306b3a27d9d078a7c93c079fa18f79163d921e86499b26fe3d688804ae412ed4aadf382dbf1887714
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c9c7e4dae2b99d80f2c72cec704cf92
SHA1d2522aee170e6a7820732b7bf22cce49bc8bb00e
SHA25622f37fdc7724b8d3588fe9bc95a20236767dd0c841ce1920759a9e0cf39ae76a
SHA512413f9f06962d11ccf311b6630cf3e55d60023834d69f0ad84c9f103b820b8e7874eccdf9250d8e5210c4b696dca159569e6e138ea0c973f4a542b22f8610fe50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582d02f15dc285fb361872e6244d25d57
SHA13929578468258bcee546b9845e68a947b155d6fa
SHA256a6476f07e59bf883d8c3409a4d09698bbab80dca3f6e2d36a266e9fa2575ed63
SHA5125f907bb455b782e4ad4d1041ed66662491c5873c0a45aaefc8e0e5bcd8ea515097d5f638de71c6fad9db1c6da7c35341101a185a07a429efcb36f68060d71b44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528ae439a7c535974a231a16565205132
SHA1e41d3550dacac38f85aea8a02df0f1d51d62d349
SHA2563b7815801bab0e1531c12169d91f5df5be5bd835b39295d47e9d4c5e61f931ff
SHA5129b0aa10ac253228d9b5b701cfde75181fe16ea057cfdf8c54e042b4a8c6814b4c3fe93d2ec54d336e790af017daf4a1dd530fc81584f086edc1d377812dee306
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55a2baeea2df0dc3075da22f3c149957a
SHA145f26e6dcfd4a3c7ab3b42c9edcaafa4fcd43663
SHA25621aa52bfd5d2c7b9d30604e3074c4f2ceebc87a8e33cb87b5e077e57e0f77acb
SHA512fac6a36a12c59d98abcd28a398cf2a8452766d166d6ffc10b3613c438fcd65967e272920db600e461ffc3730fac27e539884f2fbc71278d437684ee5f8e388ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4e00be09cb33d10743e2484194318cd
SHA1ed49eac6ad63c93845910223f136fe29e38da1ba
SHA2568efc58160a9d15e8312131a22ad5a0295b663ddbd4ccc28a1d831ebc43d7f01e
SHA5121f7d306b93827eaefd186c538c141efc12488a68f7630c35c7bfebc3dc2c24a2fa9db4fef0ce9273cf0823473b80289b937f9716166cb2a8ddea64f49882519d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f72b86bf34f758068bf75c4c9454584e
SHA1049340832f3f6e27202aaed91e3f4a8a74a24d92
SHA256f8350b4e7183ea0d09490f9629f926b3b8c75fdb564a180a234b3ab778fc5480
SHA512035f805aa7a249341b0e2f5f16650154f756910203cbf33dd15ffa433aecefddf1ad68a8a65c71c469cdf40f606c20bb7e31b2761aea9d0157aefa86b2b7fd53
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD504792f16595438ca7d747824331e25c9
SHA1ffc84b235cbb9858cb93ca586fbc11b3eeb706a6
SHA256d0c0a7d5826825a101daac38fed079001bf1ad2d6bf9587b9b6fdb8388a04944
SHA5128cf153e4f1f8b6be9f8a19f413d32aaa0bd240cf316f5fb3bd5f7a6f726c6be0c8b2079358c4da9f26dce3d4ed8a1c0968fc26f40bcf5e1647f2e1b3227a0ac9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06