Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 23:19
Static task
static1
Behavioral task
behavioral1
Sample
1fcc830365f9cdc8460129e69184323c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1fcc830365f9cdc8460129e69184323c.html
Resource
win10v2004-20231215-en
General
-
Target
1fcc830365f9cdc8460129e69184323c.html
-
Size
117KB
-
MD5
1fcc830365f9cdc8460129e69184323c
-
SHA1
bb1b6797bce15cd21416b24406943fb5ceb634bc
-
SHA256
71750442d6493101add59806be34e5359c9a9fb4a642251b493a1dbfbed7e998
-
SHA512
1ed9e88a91343ea6b9a4ba7cae35c1bfc3ff57955fc625a10bd098aeb9f9aa5985a76b06de551090a5f205158416c7cddba590756a3109bcc0e33a8cdc25cd10
-
SSDEEP
1536:p7yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQy:ZyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2904 svchost.exe 2776 DesktopLayer.exe -
Loads dropped DLL 2 IoCs
pid Process 2072 IEXPLORE.EXE 2904 svchost.exe -
resource yara_rule behavioral1/files/0x000700000001508a-2.dat upx behavioral1/memory/2904-6-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2904-9-0x0000000000400000-0x000000000042E000-memory.dmp upx behavioral1/memory/2776-18-0x0000000000400000-0x000000000042E000-memory.dmp upx -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\DesktopLayer.exe svchost.exe File opened for modification C:\Program Files (x86)\Microsoft\px225F.tmp svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f9b7aa3c6a065e5f415392dfd0d6789758fef4e5726f8953d26fcccdacace0e6000000000e80000000020000200000003c29bc412af4b7f2dbb71d683750e0953b3811a4643ad5e7e0354b494cd697d0900000004ecdf877f17cce769516e0c7a39c78f7aa3abb7b902d063f42a8ba36edae6ebbc60dea8fd500d1f79b138e39a583257b0ed066938ffa2ff9e58bad5d136ca5cb12e1ed081cb9fa848e92f2e36a04f51c42142ac7971f5e62b2dfd6961356f71faac0e780ebfc584e67cc6439b3d4b133f729d1314b43301ef329d8e739324ef6759d9306e492bf2d3b58b6b2793f2d09400000005988e1f687e8bd42b5538956daacb2c66ddc898f3ed06873cee2523c5522d05bf3742c1ef743afaebc2775fe501e43a3c9ce8cfa5e870851aafc7c5a5dccefea iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410559287" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30ac5e4a463fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000f7cd590cd05c08264097fb851cfb35719e6298954c1926e1e9df8d7db4462a68000000000e8000000002000020000000eeccb929a5b79a82fcfce942eb724e0986501a5562600f26aabff629fe470d8f20000000cb444c0cb75ee14371922e432b95f995063df5bfe2f0284a81b704bbc3e6feb94000000062ad578d69217b2f0631ca6c6f0925cc9e10927c21740812381f30b9982e0b1c6c4d79e3f97ff13216649cfc7ea65db8f15ac7d6562de833353db479aca62b7e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{723B71C1-AB39-11EE-B218-C2500A176F17} = "0" iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2776 DesktopLayer.exe 2776 DesktopLayer.exe 2776 DesktopLayer.exe 2776 DesktopLayer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2072 IEXPLORE.EXE 2072 IEXPLORE.EXE 3056 iexplore.exe 3056 iexplore.exe 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE 3024 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2072 3056 iexplore.exe 29 PID 3056 wrote to memory of 2072 3056 iexplore.exe 29 PID 3056 wrote to memory of 2072 3056 iexplore.exe 29 PID 3056 wrote to memory of 2072 3056 iexplore.exe 29 PID 2072 wrote to memory of 2904 2072 IEXPLORE.EXE 31 PID 2072 wrote to memory of 2904 2072 IEXPLORE.EXE 31 PID 2072 wrote to memory of 2904 2072 IEXPLORE.EXE 31 PID 2072 wrote to memory of 2904 2072 IEXPLORE.EXE 31 PID 2904 wrote to memory of 2776 2904 svchost.exe 34 PID 2904 wrote to memory of 2776 2904 svchost.exe 34 PID 2904 wrote to memory of 2776 2904 svchost.exe 34 PID 2904 wrote to memory of 2776 2904 svchost.exe 34 PID 2776 wrote to memory of 2576 2776 DesktopLayer.exe 33 PID 2776 wrote to memory of 2576 2776 DesktopLayer.exe 33 PID 2776 wrote to memory of 2576 2776 DesktopLayer.exe 33 PID 2776 wrote to memory of 2576 2776 DesktopLayer.exe 33 PID 3056 wrote to memory of 3024 3056 iexplore.exe 32 PID 3056 wrote to memory of 3024 3056 iexplore.exe 32 PID 3056 wrote to memory of 3024 3056 iexplore.exe 32 PID 3056 wrote to memory of 3024 3056 iexplore.exe 32
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1fcc830365f9cdc8460129e69184323c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Program Files (x86)\Microsoft\DesktopLayer.exe"C:\Program Files (x86)\Microsoft\DesktopLayer.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2776
-
-
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:406535 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3024
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"1⤵PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588bd4bd7fed0e1f50167c7907a52a3f1
SHA1c163237bb25e62168f30af35081f84998e8b0e46
SHA256ae56a5fb9f94037f0ae0e1309da173c72a9d426753a5d229d628e04b33d48249
SHA512027c0984d7e697a4c1de9b840addb9ab0f769c1cd39523bc5dde08c195ea782549984615d2c7a2f1f97fb62230454567b2b32e3df2ed6f4906f6fd9bfe28d836
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59738cfe5b2efcadfa4f1653462395a04
SHA1967f840fb7e4a44af5c8b260fc520f321f204c7f
SHA256b821e113bc242f51ef0c4c4cacc8178a42948e646043a065cccc9528657247b0
SHA512e4b3d7e1d5736a323e1ecc51b8056b356890efac14205f8fc851be82d40e58a9902ccda69ff662689e296744d09f6251b19322882367e435d4fed3481ed409f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2912c836f498894257adf1ad8b6490f
SHA11884f42f2ac511016c7a2dfec60642b444950129
SHA256c1f7520a6d24f6294b88a91e7ba181c5b5066709172e05ce2e68e534e5766535
SHA5128ea8df6a266f840c32a1e1c7908c0b88b19182c49bf8859ff2f9adcffa7c0f6a24e07ea44b27a9ea4a2c852aea8a546ccf5d0bb132352b0a88ab30d8f5e9594e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faec901e198c5509645a3854cc08b527
SHA10f85c8031e522b76fc9ed9e440f1ee6339c49c3d
SHA256db16af0826d03240d8e2e12d983675d4285ddef6af5bbb2aff4e24bde8f833a9
SHA512e1d017ba41017c960cf45b19d95b2de390ab9497235c4c17e09fb4259d64d8792cbc4f06934edc0525e07b37e03c8112e1e3dbf15a71a53bc8b746017904d0a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c99572f8f8f3ec53289a11abb4d8e27
SHA1b68d939b03fb832c953d72521ab2aaf7472fdb92
SHA256c9faf320d10915b9dd6aaa486f7d6888867d4dc064656648df5998ee8cdefdb4
SHA512259ea909fac2c31df29d46bd72db22cc9a0de692c7b6e2e61553c57085c796557b0a39c7aa2f9061198e45df33461085a8b43748904c1d3b7652379d2bf9bc2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5795407b9fbe52340e4c599adc40ea63f
SHA15b2272c19090ad2d603ca03790fbd9dde6570138
SHA256855c8a1e985de5b9edee6b1cc61c1503fdf0a6f677ff8f409eb0e5852cceedda
SHA512961f31c2f1526db27fecb8cabd08b3c6e4b66bec50566ec36fe7fadb9066e6bf54bc0cc9e5e6baad0b66456a9e294877cfbfe070a58a4a6ac4abcfd54fd15fad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bdfc54cc4205c8211811041f4935289c
SHA17a632341dddad4c91eff083e3f3649e2454ce2d2
SHA2562e897ccc9778dcf71740a82de0ba6664f37644a0ddae4f502c7936b0bb240283
SHA512876cc0919f042734b64589ddf58f30b61bb25b585b53018e45853d3ee24888cea67862599568ff9bf5f86695938588c282a17a117af627a69690b7f22296b206
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54587635fa546dcea6d231777fb34235a
SHA145c1913e27b89c357bc4d5d302700f43fa54ecfa
SHA256b53f53d7b3b42bd3a0778ded9f5e48550b36083e57b64560e58827626543de9a
SHA512e54c6885799f53cb3305ce423510e288a023828c9c89ec72c9eb046351d5d91365fca30a5f4248872d6cd465df49838f4e588445beee32de000add39a47df811
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
170KB
MD57aea59a35a157c7c6528f993d31778c9
SHA1e841410e7999f9486a06ccb6e3caa61ac0778b9a
SHA256afa1afd8d739a006b054c7896f29f05d2570a2e40e797584eec0d2383471c2e7
SHA512e0fb17cde2fd7445aac3c2a89de06af0c79cf181b101bbebe97dc11bd061d1334ed55a81580727f8a9c7703114d6da5d26e08dbc9f8f4fd9b63363b9f5c35c1d
-
Filesize
55KB
MD5ff5e1f27193ce51eec318714ef038bef
SHA1b4fa74a6f4dab3a7ba702b6c8c129f889db32ca6
SHA256fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320
SHA512c9d654ead35f40eea484a3dc5b5d0a44294b9e7b41a9bacdafdd463d3de9daa2a43237a5f113f6a9c8ea5e1366823fd3d83da18cd8197aa69a55e9f345512a7a