Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 20:21
Static task
static1
Behavioral task
behavioral1
Sample
02f182e9febaf5479294b7bcd5214928.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
02f182e9febaf5479294b7bcd5214928.html
Resource
win10v2004-20231215-en
General
-
Target
02f182e9febaf5479294b7bcd5214928.html
-
Size
859B
-
MD5
02f182e9febaf5479294b7bcd5214928
-
SHA1
f5faded8f44d7137ad4b108e0fc097f500d61370
-
SHA256
819ddb6595bb2e08e21a8e5a35c2e03f3fcdc580e9531824757e4f9581446cdf
-
SHA512
170309152ae38b90fa6ad0b2b9856404bbf6d8c10de4cc6e9717ea7cf8a05b7a13f430778ab4541ddf00ce421340f2d49d6120dfefe2fee803a1a16391419d28
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E2AA4E1-A6A8-11EE-A031-F6BE0C79E4FA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410057210" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000095858664cc99dc97551e2af6387e3d81e6c322bb21e1c61238e68f2379c3fcca000000000e800000000200002000000063dd99c77623977bc3ed198e204f251eea67b7fd69d778ca6436b1bd3e70dd6b20000000ed378ee6dd243f48c81cddda47717cde21cbfb9833c26976b84d9924e3a7377040000000f90e59c884b454dd9a51ae7dfff58cfb19bf2a3a2c047ca522df61e0e45b191fd1cdc890d54215652b8870c0b9cdcea9cdf825326ca206cb115c10e5e0c651dd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03e4164b53ada01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000063d0e2333308a66b53ef04efcbb6e255ef2640e659c48161185f9c8d7b73f3c2000000000e8000000002000020000000b21588e458e69c06139bd03b7f154285a038d8b29f9bd682a5addca757a46d71900000003656624ca790d5eb3b2e4c122cb40742a2311a2b54d3863ec2aa92dcec670f70033150370b6842c2f79e26ff42b6542d5768627f5f8d47735bc845502f55cc41199f825d390c22d2b23a9489b142d26b9ee95768a2465312fe4c27b4f91da091c04d7a4cec55c5c366c34ece5222232fbb614b208de45df6be70a6a2c8f8d34b4acc94a2b3a127f1f20b1a8c5374070c400000005c834b44db81a5f66432f3103629e3b1cff5f4c158300afc6a2f096f92a468cf5393f5d551a3f31d51ec0a70294ea71f92b62ba6bbebd2e3a98b5d8ef2dc4496 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE 2692 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2692 2376 iexplore.exe 28 PID 2376 wrote to memory of 2692 2376 iexplore.exe 28 PID 2376 wrote to memory of 2692 2376 iexplore.exe 28 PID 2376 wrote to memory of 2692 2376 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\02f182e9febaf5479294b7bcd5214928.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5888883a278c4bbb61e770fd5ea928774
SHA17abe7163514fcdebae511d58a945c09a619377b6
SHA256d3590574f469ddfc020750eb4cec38105921cbe5ae56b841cccecb5f6305ac17
SHA5126c90f7169436ac8c2e18cc6b3f5f6bea474b931a0632e13f7e4bc39e329e2ee50a2ad25ab7552403bb646dfefd781beb6a04e75083bc02e88415f06d3d37bd8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3a39254e22159b1557591e7937afd12
SHA1f6b7e7f2d6fe0551bc141591fc3295629c435dcc
SHA256c593675407f602fdf9baff123b6f8f710ea148aa76bd4bb0d2de1301e0e9d132
SHA512c229f6b3018b66b00fbf208ebb06d0ab840a05fa1d0032c366673d91ef0ef238d63af43742171b5f27359523db1d0ff8bbb55cf2c1ebabe3331b50de5afa64b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5324ee2983d07e96d6e3417db6d2ed755
SHA184c43db17741d66b1b8da475914e54f803cb3207
SHA256fb899b0ff6687de607b5baadbf96e7e401b666ce9a7bf1563b75c606a716dda0
SHA5129ed8f9a5bf8750905623dd10e0d7b4e27e9f8b8009e752837361b14428ea096ee980722ed3e66163594d6dcd8d56ff5b545405d5da7fdcf0ef803a6dcd82e7cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544c9d81d78cf87262b9566aad934781f
SHA12e6c2818458e680d565c7272c245d9c8ce567baa
SHA256ed9c1281651ea69799d9b0b9de3fbcfd35d68f64a38704758a9df70c2dbf84c5
SHA5127fd472ab4087c0f0f6074858fba9ad4c1c6786f0360680f553c0ff62e7268e9f596607f4b8bb5f49954df0d046d1015ae5d58b0723ec9ada598a6a37af2a9d85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52570ed447f2e5826cb29163a9fe742f6
SHA1cf25234e2361671495bec646fbbc538453031c00
SHA2560fceded8fe8bbf78401eaf885caa3f51a262d994a6ded8e803f09acb74e44e99
SHA512c158d6d63a88f696a1f0bfce0bbf0cf1d6b77b24e06d432a3069e4eaf3491a1ef9235199926d74fd78fab7b03d3aae2e08d7eb1e48ba44e512d8253dfc1e8aaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f54761f4c9c5202948430ae95d14d328
SHA15f5ce3ae36f8416065088b4aa2ce687a6430aa4a
SHA256a309426eb2064ba98efaf38050a434b75fce4f6000798200f5e4f62fc0888a6c
SHA5120895d77cf24e54ae843adeec71bb88d339094d4cce7fe30bd505189411fc879c430ba78602509e2acd26ddf015fa73c49c013790ebab7413ec122f7eaccd6372
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5593fc7baee560ae5e443cee96c0dd410
SHA1dd597a8592b517a6c1a5aa936eecf440b2dd68bf
SHA2568c8c7d79a17c2bf34751039bcdc12ff806e4daf12e4e710c6e6ee4ca85805421
SHA512d2f2e06895db659fec6484edc3b07c58e871ae20bd88a5b46962f25ad1b4d3e2260821370fe8f3cfa451960e554f1e62b7fbe49dfefb2f9b8fcb3b2b678076c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52de1dd75982a955f9cd180aa8e71d86d
SHA121a0bc6b054b74edc49a349cdcc5e01687ee3190
SHA25679bd12299fdd6614805347fbad5a104598165ee749f0f20ac97025ce2b930809
SHA51269b702813a4bbddb7710f030745e0b349b41545bc54a277a9d83ee669cb58af30aeca335ad96bc79fe1c9c94c845e3f49bb3ac790e41ca99ba1f46e80b077429
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD552543869989d2c395a77788c09749651
SHA1c4fe42e4e86ac3bf051b26c75450bb4ae1063707
SHA256e432ac773b002876f38924ce3a427f328a2af4574688ebddc603f25ed1b3825a
SHA512b1968c47344604e4f1fcc4ebe5d027b62fa4a66c3206afb91f186aa5aa996d1d6f371d69df841f9519579018e5724f1859884a91ffaa74ac20662537b6e1af2d
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06