Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:42
Static task
static1
Behavioral task
behavioral1
Sample
1ec7bf9841a10d4f1a7135cbfbbf2a2c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1ec7bf9841a10d4f1a7135cbfbbf2a2c.html
Resource
win10v2004-20231215-en
General
-
Target
1ec7bf9841a10d4f1a7135cbfbbf2a2c.html
-
Size
625KB
-
MD5
1ec7bf9841a10d4f1a7135cbfbbf2a2c
-
SHA1
0ea41c6d7d357a25cbc4bf163ec3d7194d67b004
-
SHA256
f066b4cae5fb7b6150c51076655fccf792c0753f9409b23ce708ec7f671c3e64
-
SHA512
d63a22bff792e24eaa1de65f397958badee78928ed890eba9136c67f15e5bb107d6de655a2b89a2d032217adb65b63a9569be5c35606d8cce997579673fc9c47
-
SSDEEP
12288:IqYPsfdObbKdKIAnospUGr49rug48zX1rT3S+h1aha1AgV5XQa7ym:IA6bKdKFnoPGk9KgPXRLahQ5Tum
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D81F39F1-AB29-11EE-B0F5-76D8C56D161B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000034192674db61db4a74074dffca761e1041b83c13778498ab58aeadc871138fdf000000000e8000000002000020000000451dc8667b91d01cbc068853361f3d4798f1fe601955e5962f68531d7bc6f6c290000000107c69941ed24deff699394117fe1a5ec293ccf9624b82627cd01cd1f9617c6ce53899d47df694c8f8086917c728c1e1d10f28fc466c65a4588f21f34f236306f311e58415e8644068e3f2af176908275e0bba5f2781dc61656f6a866948dbe259f5ab3db334101df3d8b36f422d58058ec0b67f75888c4e9cbbc4a13eef7f8785cee8f4e801967a3f617d2c5f58b75640000000512b03d0f55f920c482fe95dadc1235c7474c88d2e481bad444cbf426ea2351ef44b2d5e197350390b23b1d2da8bbb86e95507ab7a052e200e5cbdc9eaa1e806 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000042d920c6fb41530f4d9b4db0ff493d75b2d97ef0e5105dd1befef69467ed9a3a000000000e80000000020000200000005faf05166bfaa4ba6b710ec9ce26b58d83f613de2396b1e3cfbb889c33620e9e20000000609963bfa3f6e475932d857f1146353fbce17d87697825c363273a880128458f40000000a1bf6ce162bf09d9f45b0851c283f1264374e200af3eaf973008df75a1e7aa411910f230b515a3d83903ae42ae0e86a93a31804bbd0251ae61d0b161b418493d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05b8dac363fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410552542" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2288 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2288 iexplore.exe 2288 iexplore.exe 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE 2216 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2288 wrote to memory of 2216 2288 iexplore.exe 24 PID 2288 wrote to memory of 2216 2288 iexplore.exe 24 PID 2288 wrote to memory of 2216 2288 iexplore.exe 24 PID 2288 wrote to memory of 2216 2288 iexplore.exe 24
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1ec7bf9841a10d4f1a7135cbfbbf2a2c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da4e2bbb10647bbe13072a1cc954382b
SHA1384cb1c327fae1c03fcd6291dd3d923fea9ae997
SHA256382259832dc9fd92d37353770e57ad24786ef53884407209fb42cc85e07110af
SHA512f8819eb8e84cde79ee406d75e305f1d68fc5f8123ed029cf88f73ae5bbab8da4ce080e33cc2eb2fffdd546523ce793edad581eccd00e448c45d3ad0c4168b4a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594e1477672d138a3ba87693288fc2b43
SHA162e0585ef2f5b58032bc5ae13221bd678845bd93
SHA256bdad897ba995465f376041800dfd53e64e5a1f0fea2f2b182646d98d69d86cba
SHA5120adf93a3020eb566130584483a60b0331ba63b83435ed29b2ea1058e1f1cf328b796379c93990ca34637c693f2915c0d7af88c26a348eaa13dedd7034fef96ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597b516318a91d471dd690d12618455d2
SHA1553e8a4423723d91b032788c114db5d5cdd717df
SHA256dcbdb74574067bb1aee5d4162b3bb0d6f8abc6ec9125136d5a95fb61442fa078
SHA51260e7e4220cf2d5d3df97664a79e624cb1724a8a11c3a689397f10f4fb1c3343e7ed6668f690389fcfd3be474d61b3de0fcf34cc92e8e104073ccdcfaa5d187c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b98a01c313aeac5c8262f8d59a901a18
SHA1a25b357e0a06ceee6dd6569c9d5e440b58bb75b5
SHA25684f06d6eee579be96cc9cb3fa6e68d43a8329900bb7a3624908c674856854d64
SHA512857c5761f9a2dfccd3ce8c86899f263a1f92e2b9b1d7ab915cf71698e529ad0bd1dbf96684ca56dcaa8c2784f1c2f858a169f72e6f183e440ad8d3bec47ad3c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52fb5cd6823c98c292ee165ef4ce230ca
SHA1f0325d189ecf870105ffbec350295fe763ff2838
SHA2561698a03879d27d18ddc6d282e6bd6312a131d588e4f6bab86acffe9eb4bf5b7b
SHA512ba7eba144e15bd307c06ba035a482fc0e8f849689c0cb0e9c2def96a2eb83ff1d185bc1d25284540a83b98c85aa1a93fe2dbc6f7426b224a4b62ded510939245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1d64f17c830a986161a101ff787238b
SHA1a50568b1577808a863e2307f4763d538db23b7ac
SHA2568cdc4415230861be54821a48dd571dab39d5e2c79fbc79509c9e61249971b2dd
SHA5125380656e64c9d00be7ee9aed8f4cb361471a87ac220c512fc1d08d9de0e1b21102d9e5048b46f9100e0ec5441ed0c3736bc454412cb9f3a6758fbb98956e6dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e822779df5fb764f95273d08b2edacb
SHA1b8c545df34e139afbce59370f54197ce1da91fc1
SHA2566182fb66ec626d71ddfef1323e8906007f5d2096e2742a06b1c83a0afceb35f5
SHA512adffa7ef3a3d879d1e18a07beb74fbb790a80bcfdfe2265b942ff50d8a6474282e9178e162c19d1af315b31f0cd394789d22cbdaed8ff1f9d77f9a8a96160504
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f80ae921910cd02d758f3aee733b609
SHA191c49b46db4eb23c2467cc73970012d43609123a
SHA25645923f9d9291155954b5486cf3d418e19ea5362f462a54de1e043302d9febc9a
SHA512795328e09c6f6d03c602ccbfcec2e66f9c870e84d587d8fad4e005631422ecabf78b66f38cab459b8f91537e1abd94f4affb436ba3264e4f38cbb10b62ec2b2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592128990028ed552ef7fe249d937b836
SHA16c12087e944eb8d04526bdaa4349fe0807fc42fa
SHA256a3c8f549c5fc8316c3b6d373834ef36b485a4413a9847bc23797588e3a083b9e
SHA51297cb6dadacdb6605a06168c8c4b840ee6833653b87dd8b8b8d6def6245b62707f0a8423fb86c579009927007f49ffd7c61310d1d4bab95ce22cbe07f68c99d05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d542c2a771aa8b952032a7e352c53f55
SHA18c772271be7c86132531d49ef540dcf15f9f73fb
SHA256e4b366da5b592a88132a17d6570f3591bffeddeeb93bd58a4f386951b1c5b182
SHA512a8dff0b5905e038f82461dd1d2a6240374082aeaf37f91982b8bcf0bd9801acf7e3d190a5408a5511e69274ec0fb774c7a0546b318bb98d0c92c5823d79168ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fededc30ccfb06c259fbec4cd0c1baa
SHA19016a30fc28d73aed3b2bd61e5a64008ef2cdca4
SHA256e1fb9b2c3d29a01e1c63c26e98286255035980da049c9523eef9e35439860476
SHA5129ad92100b43521114fc225e0810a38d3ac93922c973e70d56a020bd510e941dfa986b2764c0c60413089e66e4ff23b65c56aaa0ffe334d320a22526feaced5ec
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06