Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 21:49
Static task
static1
Behavioral task
behavioral1
Sample
1d95738d6383a69a4f802246d67e9d82.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1d95738d6383a69a4f802246d67e9d82.html
Resource
win10v2004-20231215-en
General
-
Target
1d95738d6383a69a4f802246d67e9d82.html
-
Size
3.5MB
-
MD5
1d95738d6383a69a4f802246d67e9d82
-
SHA1
87e198ba3643e2cbc26bad382b78f6ad789023eb
-
SHA256
d9995d663c1f945db79b60ef284b659f96b96277800b035c3ca35750406cf623
-
SHA512
e0aa87e7c5fb0c110ebddfdeddf7078a78c221b0033b281bcb7cd9f1b1065f3738ba8268b62810664570fcaf3ba301c62335ef8c1a475a8d87df66f3f553cdae
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NNO:jvpjte4tT6DO
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A86B2E11-AB17-11EE-BD3E-4EA2EAC189B7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 3020 2988 iexplore.exe 17 PID 2988 wrote to memory of 3020 2988 iexplore.exe 17 PID 2988 wrote to memory of 3020 2988 iexplore.exe 17 PID 2988 wrote to memory of 3020 2988 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1d95738d6383a69a4f802246d67e9d82.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵PID:3020
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
4KB
MD5af0bf7f24364006dd30b1009c8f96e6c
SHA1d6c66b4529dd9dc97a0f02a9cd02d5953549a044
SHA2564b2d4eac40f88d1fa814c44fdedb97904e5432a57703c0d3bf522a78e0030599
SHA5124b5eeea5593482e51a095af58dc51ff087481027092c228186cc7e6b36d7e0bd59cac6f61e0c62e550f9ca6b9b54ec72fbb77d65bf3710b5e5154e0e20a5c7c7
-
Filesize
30KB
MD5c780cb721a4c7c3fc5ae7ee2c51f4818
SHA16e7ed5a8e26c3753bf1dc1bc2ab54defbcf815dd
SHA25665b2c6af97f3187d5721ed14e159f50b592c53dd0798663e7fa4174e5dceeadb
SHA5125c7c2ec72122c31d72a600e1710daefac6c8bf0d0d983e58a505026a2e8a565142cb516a0f1335a21f91694ce51c92e4a02dad4d9b9c5e53666b442e2237520b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5325ce128a7471f2f3807a47e28b6d52b
SHA1bcb2bb7ded756b2fe53f67301c9b19aae2a49086
SHA256c15a2190c3eddf96058fec9e9ea55f32c6752c0ab0366e03029c0494ba4dc759
SHA512541597b97cb79bf89d531452cce1a905280f79c9a66b5779e13f757b81e0f5c71177c25a86e429b2648db68ccdb99dcf63889d9e053743201435e5b06d67b548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdd8ebb8ea0865ac34ccea4c2ebb2e06
SHA187df1d7570fc770999f110dc57471c1fa0890509
SHA25643ef5204fee7460fc0c6e32fd6ab177817aff4fea73fc8820511ecdd99397de1
SHA512a61e916211f7b6b82727d27aecbf25708548bc84f49cf2916b57c1881aa47828d81ea7040472d1d1a801ce7e65056c3e434503da0e18cd99e31727eb40c1131e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d71f96fec51686f8359e25c388802cf9
SHA12c4271cc6613b8d211a77a7df1d5b2e4f39f9571
SHA25614a478a532b279ad8b0d1a78a9a2cb88718d735acfa95a193575b9bf878064d8
SHA512d880e741148952e22c49b9144182a5d4d42e829674e2d4078e456a6e6d08428a15328c735a73eaadcb5ea9cf2325fe3899a97775a73236449cc286d7d54d3c83
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e4689e229efb165da471c0c5fbf1c6e
SHA185f8f9d3015d6d99e93dd1290bb394e249fba351
SHA256578cdbab6b616dfc4720eb9896d21d9323c90c7766a2c41d7eeb14e420be4777
SHA512617f5db598574068a71812b113631398000c5b077ec7a41f32afb1235da2a80a8ab8bcdadc566a92685a10cc4f2c49254cfa8a4302328db640e7620f65c7ce49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57410d8b5ad7b234fab14f115b5a38b30
SHA13cbb4a8dae2a6b2bfe7a7453dbf377526223aada
SHA256655687d98f79bd69deb573834afda45c195fa32738791ac90594f55385c0552c
SHA51290b9fdc8d7cc09f7948be69541d4033407ee0e761e56d7d22b19327c618665db760b063fc7bc3de810d7211414d3a42716e88e8413c48863883bee56b2e137c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506158a8509b23a15f96d0a08f5e343d6
SHA1d141df475c84ab680cf7d1294ea33aa9b7653097
SHA25683ac191d4a483a3ac0c7288b8988125914e85f0090a8700c38d879078fdd4613
SHA51252923723adcdf179706c0ff5c0f8aa5cdba43dc36c73e84c6a1455e8a6321b802667dad29862a6cc90a44cb6ec3dc330f6631bcbffb553f581c502ecc1dde4a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b5bc92a74e91a2ce77e372b78f87b3d
SHA18a1194cc3d9b9de399d4a8e67f6d3b856bef87ed
SHA2561eda005c3a5634e99ee8fe9abdf4b99bb944cceda77744125ceef46bb249e206
SHA512ffc6b80ed026f4f5f8a11b90a0cc4567ce334603dcc969191e9e7c66cd1932c7a2a4c1936314cc7afe97c4c8e8519e33b114f9db87047ef78f14bc636d2f8a48
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b4a6833b2e33851a1fc21a7e68ef04
SHA16960f073237f31b3b7534d662af450cfffbaa7c2
SHA256769ca9b2699353a2c07bf32b7ed20bad5688ff605a6a2181dadf834aa0244c99
SHA512d933bb8e7f2d2a6ac10a5a68f380ad52a15182256b28700e83605ee41952e0b662ddf3dfb3eb652a6706564d3b7baddd80fe3111c464313184370cf14b7989df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee0bd11ae4224a517bc29183affde3c9
SHA1442999c6bbf0f413ef4cd4ad759ab63023f0db33
SHA256c5b8e1dd5809a0b765cc945d2e763c4f8860ece98356c8719841904fd3a29a9f
SHA5121187ebec2ffbc230c696ffeffcdbef95de59a42f6acfa121507438d284c94e8408d64d3109944e9ce0b7d5264b0f8852d0bcd9d5ae6e42eafb6d9e8fc6212fbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2a6df8a4e836a3a15c170d96ff9e298
SHA140b675b0c2ca20effe3fb628661be0d3fcc6c633
SHA25643144bb20cdfeaee9147bea2b54bfe2d72e9c713c8830b5b962aa8d097dfa01a
SHA51252f5ee387cda58b260cf50f4122a4c504715c9af2ec07493f5e30868da752b7ed8d360b058c6ef76142d1ccbc6b53631920ec78b722a13884a99c6a4a57ea51a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549a6b215da32f1a66a06fc88e2e95b2b
SHA19034963440878d48616e405dbe43a2a44a538feb
SHA2562e051f291122d124f40faf8c895ba04a50247d1c11956a1046294dd45045f6d5
SHA512bc2f44428fcfea5db226af9bd267b575822cbcfdfcdf743ebb4f2ad393e4bdecd7f284257990112b011fd633ece4bdd6b0c5741c850cf514ee0243ee51929d7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1c7b96449b2b07d8028d601e48c05a1
SHA1b9b874b9252dadc2402df7bf2fb0346c4fa9cca1
SHA256c17e7b49ad0b022b4624173f42faaed8ef8dcbba9e69938264e20f799c06a368
SHA5121f92ea376333607180844d227fe62ca915efec65c81f82fa9f9d0f2ccff3c3df8fc411264b9ee14a1341ab13a93b7e10672bef1ed77280f3b0622eeca65d224c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa8db43f1ce4bdf6735e5cfd600c7cb6
SHA1ca3d7be703109f563cb22d647b49ba5d64d13515
SHA25665ecbadba0ba5bb529bba2dd38c3fc40ac9ac968ae343a47929c695961ff197b
SHA5129636e8d0179c15a3cbe304454ca485b70946ea3d96c50b3f5a5fde4a79c68c62387c39c79f24b03111a921e4f9711eb50013d3568e121cc5db5c75e747a0b928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e972cc1fa9c95c674855fbe73fc2b85
SHA11b0fdc96eb1a0cc2c26a9214d69cd3ec3a83cf59
SHA25651085667c872d2993c83bb2a55b732cb56d64e7dc838b37fad87c8b92a4c9db1
SHA51270f49a221889e53c5238cf001414790fe75c0cab1ea8ae0959ba108f217cb6af68a21677c46dfe5e8c748aa10e7a4f32a8cefe6447086073ad636d6984a551ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53735a6152f40ce7ac51169b7dac7f84d
SHA19e0d51c71000b599ea84b828908155ea8391c083
SHA256e4f2278d71e2f60c660fee51371040ea525aa85d466feefeee96e3e02039d2d5
SHA5121f42dffaab8e2a52f0f4e6b0dd9d87870e5d53caf69557eda8a004db2da2016a0d85980a884a0543ed4eb24f49592de5e72960a044bab0896695e23ea02b9aa1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540b2a593ab30587a39511e7f8988b150
SHA18dd7ab44b6685c984370c57546ec0a6f0466a6b0
SHA256564f0d6cf0aa47ed1c23ab8c22b18e18c0977c3dd885347442ff123b96b0c4ba
SHA5127a0acf58dbef10e7501d1052b178b8ab5e290741b12b651d169100d2d6a1dd391bbaaa41d39c005476c283f6412c72a4fe91465f7ce45f9e380f04f5d9ace5af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6a4aad1fa79599658f1d89be6823604
SHA19232843a4654233f976b974d6af148e8098885cd
SHA2565386804bcc747008132d9e28ebfc1cb5599db9ee460974b68160c5ef9bcaafd9
SHA5128398441485bbcd56c6a477debc478dd2ce968b1d33c196d3ee698efa55b0aeb5e84468a6c1a14cb359569ef1eabfe21f7a0ff8976f4385355e15a452bc5b73c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf083b7331acd517e2b721a259628f96
SHA1ce0d83011bc6ae6a942ea06b9d651e6b3d82a579
SHA256215bbb53bd468d70393f125d49d2b7f6fd049b33613ab2d216990e787ccac85e
SHA512338f96f46b90848c324f12816c64158425248425bd30dcd0bd04b6a5ff7875f7ebf91aa7f50f1e22b2f9288d2156d89c42d5f4a01742e95c4a79429a3bd51975
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596f79df216e53fd6ed39f00664a79138
SHA1f79f67806d463264866c4c477efb8a4787a43c88
SHA256edca517cb30ffc1291edfb9cbf84b1438ec1ef22ede6737afc4b029b8d804001
SHA5126d1fc67f710a76d1e22beda5514a06c9843bba69e820509f3a975d2e67514e88811ce2395a5df5ab8a9b19857219800fae1a83e3e0f763d9d54d55a926bb3ac0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542eb65ede4321658989be28c670918b9
SHA13074d08e84e4e5e35a11fef2bda80c118f4fec58
SHA2565a62d05b42f63cf374610e71f154be9f899fd36451a731b7194808d1b2b5ee39
SHA512ca61297d6fc0049fe5d99f6b40c021345b29f7a03a2edceddf2981072359a1b707ca015b2581153d1352bb4469861133d66eb77a4e983ae8da5b99eb9d1d7dee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD52999bd3cf75bf813885466c087a4c8be
SHA152146d2e229dad1d86e6b79870eb7e72cc8d50e9
SHA256f78c1cd54b6d3b23c64855f6ef7d37f00c54a0250dceb19480be6862445cd4dc
SHA512010bfb902d3f8e411f7e6469ffb3a5c911c67d0960bae404bba69d6ca67b5f96212fde78d26d0c640c4d8af7ef44578921c3f00546a03dab27a3e0173f48cd4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25TCUAB1\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\25TCUAB1\jquery.min[1].js
Filesize60KB
MD5be8e7c2063205915bcff389cfa87e7cb
SHA1031053094808a7c0d6a1f9ace279248eaf4cccf3
SHA25630eeb41b5e82a4a826104b9c705308b0e25a3b5bfb95b756ddd0560590cc9f86
SHA512665cf9d6712670bc362cf52a15680468e10ea2991b824ee23afc8ced704a130347b23e002127a1083f69dc73c089b340926cc8a3e60e48a75cd593c2b67fe498
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XAYBR3IN\jquery-3.1.1.min[1].js
Filesize53KB
MD5f179db2ae9e25e72a9768a55e62a8b8f
SHA1b014053d38342d230db6ff94233b159ff4c76de7
SHA2565fda96ee4746410e47aa8c4bbb0d687fcabc4b45c7c3b013b96dfda746d468d2
SHA512a2db34fdbfc1af65767801d74f4dd7d53d6fe5772b95f8c3ff4968716ca930edcdd793365286e166d371a11d4209b44c4d34a95ed75031b7a77bd82a74a76ba1
-
Filesize
15KB
MD5def427684b9155b114913453d0492291
SHA182619eb15dc39e2bf7c5f011fa5aef114416555e
SHA256ed868006a7e4acab685a75dc702ad1c8baa286b1098be9876bab1703a7e05eca
SHA512fd9710fb85ad52d3dec95f13269a28ae69e819958c7a0bbe6e71772b547c3d808031a3584b2a92f106b64df42d4848446b3a0a2122ae8a91d5e0b82d42137f72