Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 19:40
Static task
static1
Behavioral task
behavioral1
Sample
020926194651d6fd7db69c676a3817b2.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
020926194651d6fd7db69c676a3817b2.html
Resource
win10v2004-20231215-en
General
-
Target
020926194651d6fd7db69c676a3817b2.html
-
Size
8KB
-
MD5
020926194651d6fd7db69c676a3817b2
-
SHA1
5b2b7e0f0a6bfaad791ac819d644b908daeb5ff5
-
SHA256
fab20375e5d320a19553418c9b05f83a1ec4a964599fb289f5a155955eb03884
-
SHA512
c9cefc7c1d34c08bfff17a2e0b6ac81ea85bdd38a7ec11522c41e980f1b61e37afc60fdfe35d961f23c2252d9eb6f123e1bb4148dcb218d9b9aa64e027d08620
-
SSDEEP
192:ln8uqnGDSSW0nqImUyD+zUebsWgyRexFD/z5VCrEgPoqzCJjm/Gy7m+r0Az+MMOx:ln8uqnGDnW0qImUC+zUebsWJRQFD/z5A
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000008e230ea7d879fb096368cc8ef1a8cd6dd9b8cc2eb00d911b90cb894467d77c7000000000e80000000020000200000002213acba2cb0dbda0ef3e45b11e192c102953eddf44346ef76f7443f4025ea6520000000a65d45251fd4839a1aa5f597dfe61db71726388d7e75e962ad1f907f0757a9b6400000007a6c78ec5b9c7acfb700e60698ec28192cbcd5731cfe838049de5eaaff93d5ae333780930c8158143a217fb0860501d7e9e718ac852031927e45a94779cde08f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60c63f38963ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410043792" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5158F1D1-A689-11EE-B1D6-C2500A176F17} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000005bf32cb261d66906133509a273cd20305fe768eaa59d45be4411e79310f60084000000000e8000000002000020000000f969670a197c6027c0d5fb7923cae0e10b84c67318edf89d2df43e4b3c4aa06590000000beead1b89dda8cf26452d5146b3b66045b863e8965a4b21760ad7fe85dc90f75865ec48b9de153fdb344a9416ffefcf9b845a034ed99d5ff628e8e002bd6f7e36c1e86ec477edfd205eab2685ba0e01b73f4d4864e8380a78de21becfe81b159a8339110213941d704fa95b4e935de945d1548c2d0908c6c7507d3bef5e5d3f67f9b5b3ffe2a51d97e809bc86d8cbe5f40000000b65051fe8b8aabf51c64d8c962d0749a1efc953658ca2fdf15b228218ddd4ccdf161ba25084d72228f91841d0871c0819a5c1021d04b42314f846dbc011ed8dd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1728 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1728 iexplore.exe 1728 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2384 1728 iexplore.exe 28 PID 1728 wrote to memory of 2384 1728 iexplore.exe 28 PID 1728 wrote to memory of 2384 1728 iexplore.exe 28 PID 1728 wrote to memory of 2384 1728 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\020926194651d6fd7db69c676a3817b2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3db83d120cde75661981d4d5c25cb73
SHA172709688560f50c5f68cbdfb97a40d836f049779
SHA256bdca2bad8d98953f7f58288a8c3c0edadac4b52160bb0a446127be4e83cdba9d
SHA51277f37e085ab1d767448fa04f4d033541c9719874ad01cc7cc682bcd02acc2a8afcc84c4ff3953e4979baf93f5bd65947a4da4b21a80a69acef273adf81cd4426
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a31101f6dc684563bd7e636662d6bc0
SHA156107e7ce0413d529bc5461981063d8ef1d80302
SHA256fdcdff49cb1d17d484b520ed8202d8fa10793d7ef0f3071750976726fab4cde2
SHA5127b365f328e129d7fb5d33c17ac00e2a60ee70765cc2c0b24e0f1157790f2a466b77edab15f5560233d70a66ef92536271dfc488dd114f328c7459ee278839e0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549b55d01a1a42499d5842e989a25e952
SHA112d2ae2ef3338cd58f9b46dec1401c25ee9b832f
SHA256b8e51c196503e2c81cccd2e511387342db57fea249ec54e9eeb0e177ca90c7c8
SHA512b084c0200b16ab3ddeb60f37d0f94f74a33ad4663f6461a06e56b3ad6247a1fcfc8b8b32db1e36b6404bdc3539233c9237e5d8adcd3603b0d683cb2e368cbb9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ceb82166e703c333fed378f29102ca5e
SHA1985e2390423a4d4777a17400a640bc92c0a92fe1
SHA25687e0b6cb68cd59262f477f4a24d43bc00314357519fc5e0830b5184f5ebc675f
SHA51295be73ed30ef5d4c805715c8bffbb6c280130f567e2992f47e6a7d3330b54d1458238441c3b4f5f7041f2d58b4f44a792aa18a434a70c8ebbcec3bb2517d22a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56250c90fbf9cbf0b5a9249699de8c05d
SHA169b56dd58a28cd9d2b5662d5374f6234e358def3
SHA256397940522d5362ad2e346819f4808abe490ff7b0667c7e8dfb5938d8b2269126
SHA5125fd585248c0be8143b5d7b63f14590469a862c5bf63153e7ceba353e944fc2dda05a435d857769cde0ff51a351610d90702c4c29ead21b97622a64074a1a473d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58859cb26b6fcc23742eda73214ad6e8f
SHA128566b0ae0016822eb30516957c5946cfdc57413
SHA256df7c458ff1d63566b5424a7f3cc2db1173a8c1f8cc949f0490bb37b5c894f639
SHA51252353feb2905b8c0cef08d8235996a9d6eb287308e015c363f8b8eaf09c9f5d6ce507a4c76aa9543857970b5bf9ecce4d49f0026069a7748d346d0492804d19d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5454a17f74a70a0a952a0777ed0948455
SHA16ac916a1d963c3d424ac59c52e7ec9ca37e49f8d
SHA2561dcc6e0eeda86996f99c80f252a62e0c13139ca556f8551f9276ad7bf7940c62
SHA51281f0cb150d339d6455b5e02797c4ce80463bb66b2f8f0f61bcb04af1b8cba4c575a184ea39a5fe621314b250b696f87a1d9d0671a7fd1160c17cabc308bf32ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9da62522afbcd58f4cdaa14a17792d8
SHA1acabd3b797b825aebb46fb49d9ef0a8de2c67b82
SHA2562feb918b22a0601e9fd2ee665667222baaa8c1272f5ecbdc0f49987d68b05bfd
SHA512c240d38c84ffa1171b38fb27c4694f4e7c94f35966092b7e837e06c6579b7f94d5fe326b807c00dc27f3acbf435ddf48095f7a3bcf35f9fcbe169b7c664a81fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d8120af2a47acffb82966532e1eab8b
SHA19beb6427c9523ff954ea7bf0c655805e3ccef627
SHA256a465a50210e5f11c532fc588881edd37498b26194a1286782cc835fe8c10921e
SHA51253b0697f795bfce6f80005b2d91e8364f04be09642505116c62dc04e7c16da5c94726366386112188d3f1f8072fca5478d69390ce8fb14779cb5258476716dd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e410a06052bd41419a65725c0850478
SHA1a239841dff46ac906dc21abc000107906207e40a
SHA256e3d82110bf62d15c08f17b23eee621913e4618aa82dc29150afc34bfc82332b9
SHA512577b076a171f6fb1af4c55e31db1644d4365a4baecd65700827f4ea9e4c03d7c44d2e3d8446e1dedc768c81b0754c26e2bf5837681b4258f7329a36ffeef3044
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51233dd282e83b2be4ad86a9f95353505
SHA1b745833082594376d77c20abc67f32c3db264261
SHA25622c37819b543a9837845ad515dba584a3debb25a37064d26691124dfc2f1e1cf
SHA5124948496c0ffffc28c49afcaeb8a36c4ec7c1ae5309f3afbf1c1ff3c520456d74d390d27e68d38e0928a1cbc0c3557b0793eba8064d348d87ec9e43cde4ebd234
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd3541d245d7c38932721a16b73a1a65
SHA17e2a57d55bce5d2ac87dfaf13c30387eed0895be
SHA25629ce4d33313fe59daf8e847f01eb563d03b6b3fedfec9f35d38ec1ed32c4128b
SHA512ac9e6b8e118222d989e8815f873b4e176750f06afbaadb3c146923aa3aaf805b4bcd19f29fc9a45d63e6ab960d89bc3d1bb15125161a1d7f9732e7c3f348a55d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e672b3e6912a7b9f3cd9418049ff3508
SHA15ff35ad687b435f73b7cb7be161436a7057f0b1b
SHA2563f7d0ffdd9c21fe47f6a41cc9130a47468c8efdca7b7c15934b0985dfbbdb1cc
SHA5124bf96ea7a21d551b814dbf8b2c5c51ca85da03f5b4818ae185a12e39b54ba0fe2c1cc41cd761f818205da1571e4fcc7e73dae32f90ed89a2e7c5bfccfdf79af7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1077eebe57da68d2ab2dfbb5605d0c3
SHA1578677c007464777ec22a8369eb410e5b42b2e0b
SHA256398e32c713e4905c1485e08f9c2b3681583c5724a68a81250b5be0de583ce4c5
SHA51296339528b26cb68964b2c88b2e776d3e44fd1d8c37de94de71c6ca81d22d05b76de5624d14650369a93290661138309c09cfd990f468d6850c25b80ddfb1bb72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f7432f9e9dc4e8e53b531517c6872d5
SHA15b95eb1323c072f3637a09f3a7b6333580daf65b
SHA25634781036855345f4f047b0f20b001eb1977ba695f8495854f45c2a6f1e021359
SHA51207c93748adea777ffe1b2a183ac7cccd8d64441f9dfab3abfeca8d8abbbebed634af6c653fb55efa52ff5221075d77be19fc33e0222a414cc51536c25c603720
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e43e3eafb510457522a6b178a4806c8
SHA16e92fe49bac5b727420dd3f88b5477641e892905
SHA256830e1a05fd640380fcbe8150a1dde468c1fade0d200f93c440ed3c1ae957b8c1
SHA512f70d1d1625e1bf3ba5ab1d7edb9799af313bbe9fc8f56fee364c86c56ab744a8158c85844dc690ae47d0422df9ce784e29369a589499d685f0e131614dd2609b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8a9940e34cd6ec6952ff9798ce04786
SHA1257d58028216d49b8dcc2d5c2c72912099897ace
SHA256fa47eef2dd90186c5db1a001442f593a8fb0a87e4518643cbc232a5df94812ee
SHA512971501e23d2fb3bde37662b7ca64d1828a744feb5f1967e589dde8ce45c9fa7776b06151bbde24c9a3475a9d212baca4d2f2d3050601ad1696cd91860a0d4721
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06