Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 21:47
Static task
static1
Behavioral task
behavioral1
Sample
1d84a448b0677d6cbcfc15c2602146ac.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1d84a448b0677d6cbcfc15c2602146ac.html
Resource
win10v2004-20231215-en
General
-
Target
1d84a448b0677d6cbcfc15c2602146ac.html
-
Size
42KB
-
MD5
1d84a448b0677d6cbcfc15c2602146ac
-
SHA1
f471710079a37a3b13821a5360fb70b0be8abb48
-
SHA256
25baee980322eaf6086ba0cec2daf8f01fe76aa1ca4bc88312c458a3ab214b01
-
SHA512
3c4ab0ca1d86ac6e9abedc006430d87f2c8fac4b7581042e924b35ae4568a7343d0891f6690f76b2e5d186578e865aa1f5e468c21f348c378541117e71fe4ed9
-
SSDEEP
768:lT2akj8alnSMcdKO7Ul39+YRACkvMvpI38xT:lTucMSU3sUisxT
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40d973e31e3fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410542222" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD75B871-AB11-11EE-BE60-EAAD54D9E991} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000064c199e5482c00f9e02e6cfd65e62cbe9d05cc42ac699f3c3a2ef59c4add62e5000000000e800000000200002000000088aac892bbe7deb15f2dd86c7723c08e08a9ebe47140a20fafa9c1cf5cacff2d20000000f3016468c001535c91d1df72b3735a5dfadfaee0b9e5910243920eb297f73a2740000000069fb94c490babb12a2cc861a8d6c851f5617e514e18516458e930e1f0679ece4f79c0445ff2e26acff2b74e1bd5ddef3216f3f58e494866581feb63c047e4c1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a0bd81984b5119d66931a64c3e80a9c9769a737d2b871fe9917b723a177416bc000000000e8000000002000020000000d3494091e3e094c96857a4beeb079575d09e1ef7c1e6e19dd11a36620a3737c690000000a55fa0a452adc63f5c98161ae47937ed1b5875d135babf1fed6786e6cf2b73adbf580572c863c8080df7f03e974d3ae9ad132e5cbe6c9d73b51312de636d3d3493c889529d65f342c8c4d8c8a70731358d1bf5e7c6582b79d686b618449ecc38860d58e6f784cd43bd4be32d48ace8d18ff0c95adeae3322982294241ff4afb58955b3d61368373ad83f03e3e6d3ffde40000000cc7a520238d5501c76bd8b1d49ea63a7fc1e380b29c4f4836129138e9792be9a5ad5f2ecd2c53884e970ae6ab640b76a366ae79e656974a9bddbe7c59dfd0682 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2548 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2548 iexplore.exe 2548 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2548 wrote to memory of 2700 2548 iexplore.exe 28 PID 2548 wrote to memory of 2700 2548 iexplore.exe 28 PID 2548 wrote to memory of 2700 2548 iexplore.exe 28 PID 2548 wrote to memory of 2700 2548 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d84a448b0677d6cbcfc15c2602146ac.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2548 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8bd35e29201a67eba75cd52ba31fab6
SHA137592954d309a4121874d22373d4bea996a82037
SHA25675a774d472620313b4eca9f2a946c762eb8885281910ed7fbf780b9a2d67cf4b
SHA51283049a3384470c2f38921acf5e25c5c3879234d1281dd0491c6c654d09e8052eda60f5f404f71fd520d610950d50048e752b7b3304c5648f000f664e12068c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff8412a1703f1d95f697b8ea8af7ddd7
SHA14b3f110ea61b88a3efc90a5cb9f8421b87fcb84d
SHA256491ef8505986de1e4e8e0460775842765b94a577f8f57e257ce02b25a0fec0bd
SHA512b178482ec48030fbc388fd968ff99445a045a40cf4855689cf0607bd2827f33fde6012c8a9b531823791ff0484f782e3d4e4b0247c042722e5e94dfe40ac670b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf5ea306eaf986fec5f83b1df0c58bf1
SHA1587a83999ff8313df23be25492049202f38fd476
SHA256cd726da3d42e1caf2bc61e0a50d466dfd525b348c767626607ba568ca79eccf6
SHA5121b6191e3f3c00706f06d447fecd1d1b01ac1bea09d1efa2744a3df4c45df8b49f0197edfefcb3fcd19997fef89eee9107bf0a218b2cff1a6593e4ff4c7639321
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3f5799249b7263a7e7f0415c6e244b7
SHA14cd8ffa290a42e9123c05dc5e522180b39ffa45b
SHA256f5b03ceab798f55bac7856e7858bb9fdc6cff501f657389f52e3527b6664353a
SHA51208a4ad5a75d29e9c305e49bfe7513420dd4f568d9b5c98a7aed4cedbcf38b6445a27b9df74af8e58f09393ed0ea8ce1016c8d6b830022bd99993a3df5adc794f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adb7ce7f1c4d3d9df5ffc230841036bb
SHA15a04b6b35baf0f18150544d03c50a2ab4130c2a2
SHA2560af3e76eb105fd99e70517c795b3baaa15a16688de43f9cc89e5684c0093fc8b
SHA512f0ddc24310d94ae4906ac70f722c0b3b45f19a64de5c5f7bab58ab6cf5fb01b5bbbd05405305d125a3d9e23eb2d4d67dab9ced6bfada82f8826c7cdb02beeb97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59acf81ba55122b68f14423af1438fcd6
SHA13e070b162e833b3cacfe4dcfbfdb553dd049f633
SHA256b24e468f7343cd2f2ad2c7182354b0bfa8316674d7cc60fb198427c3702bfa22
SHA512fb8df86ea2c5fd7b0fa78144444ab72a1b363ab6c6bc0fc546ac15876a317ff6686a1b9585cc9e4e0710bdaa15b64a1135a9d78d9e75797612d4c22907076e32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58405da1fc4749e6e91db96cba68d0ab1
SHA15d3bb773a32be692053dacc732d2df08df7ed1d8
SHA256eafd0c3f178ee869d4fedd3fa205544bc79b56427db5f9d2878d3bc76617e8cc
SHA512fed5a0c24fb6b36c8b1fff247d1d969edfcf128c15b0689ead6db0dca1d3e7ae42525494c112a2cd471c83cfe1d068f89ac44ec134badf6a4c9fdd64cda12c5a
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06