Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 00:42
Static task
static1
Behavioral task
behavioral1
Sample
08dd1d8854210537a40d0db37bb75390.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
08dd1d8854210537a40d0db37bb75390.html
Resource
win10v2004-20231215-en
General
-
Target
08dd1d8854210537a40d0db37bb75390.html
-
Size
53KB
-
MD5
08dd1d8854210537a40d0db37bb75390
-
SHA1
b756f33dcb928dd2d82ce42748af14c8d91e3c1c
-
SHA256
e572276884ac121986ec665a8472110957d7d459b5ac56db683b0e7e7d2b878c
-
SHA512
adc230651d7765e929d2759242a85509775e355d364610a2c85321aa5d76424fdf77493a9fb34ad9e1ee4cfde01111edd1d52d60dd78838ac1b1734a3e8bc8de
-
SSDEEP
1536:CkgUiIakTqGivi+PyUIrunlYw63Nj+q5Vy0R0w2AzTICbbkoN/t9M/dNwIUTDmDB:CkgUiIakTqGivi+PyUIrunlYw63Nj+qg
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000627c3f0904ec71f15b17fdd73eab9c1d410ffbdcfb8d07ab027b7ed253c0dc57000000000e800000000200002000000011952f9bf119bcd9c8af14ecb7fbd68dd542385cecfa02be408ad403fbbc99a820000000c9278fc9ee17d37e217a715900441ebd08c70cae5e3652aca87e92fda2e47a3b40000000959d72565f9edcff5a1258ea54ae87f98c3b5de66d48e5c9049dd1456247f4292187ec8cb322f7a9f9a0ec48e080c2396e6365204a745d88782739112c75b30a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4005b6656e3bda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000019f37eb00c49b9d791ae44dfd22b14ad6df05e5cb5fd0aeb22a7b3eb7f356df2000000000e8000000002000020000000db47cbe2bf5d45b02e6096ea419196e0ce24dd791adcedd8e8a4a56d3c89adeb90000000f8969f14ce3ccd1671d384c8fad32aafe59ea31c22893610e275dbdc3b91184c1fadbfe0f4a2be8a3cbbe6d6b63b9edb3b6a1ba831e81ba96de1d27a97a3db324adad191d1be56d4f2d5c5951d2bbcf5aa7151af55b4db6e70816945cbacc097a6ce6b49fd74e478133498e61a6dc34a02cbff16c9a7040c1056d11cb5e97dd891a1fadf093623759e5eca2cf3b7e24c400000007b6f752745f56a25a1e870aab354638d26dd02cc11be3ad9bac5de6e65f47db2626d1e27107df46e751e3862537e61f0f74af716747db55978d6b7490b34b5b2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410136626" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73532071-A761-11EE-AE81-EAAD54D9E991} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE 2596 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 2596 2928 iexplore.exe 28 PID 2928 wrote to memory of 2596 2928 iexplore.exe 28 PID 2928 wrote to memory of 2596 2928 iexplore.exe 28 PID 2928 wrote to memory of 2596 2928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\08dd1d8854210537a40d0db37bb75390.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583b7a16cf917d814f41e19849abac657
SHA18023fb9772e2544ae85ee17459667e3e5a90f0de
SHA2568b486de579a54f2ea75af20cc34b2270dced839cb61a333b94f3a1b845b8c47d
SHA5128afd824ed7584629d460be42b96c0e62bae98545d6d16113f7f434e0ff500c713b09ff50490424189c326899ee927a91dab3ac3c5c3af33beecf6f93e54604dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b7f3f7b60c3ae2f3828e8ebcfa2dd9c
SHA1874a3acbc02f54648b008ae07fb9ccfa5fc978d4
SHA2567b1c2941f4639bf1be797cc340c6ff7a69f4ca7dabf6b67955a7742a2621588c
SHA512dc7c09c5174eb7ec5368d7c86125c0ebf299edd78e0c5ad53d027e4cf3c5262cee3560839aba6428f3f5a4a6f48a6315784b99560a5e3c705bddd7b00320dd08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c28895038f6879c8a83dff60f898d200
SHA1759c5c4ffa4be35c3f25672dfdfb02aa20740c30
SHA2565868adbcb2b5dc5f61a6519d562dec8fed4647b8011c7f0a2fa66038326c16f1
SHA5128b9ea53f39aef7522968ac34d17767fa43a35709b1e2d2d05da6abff8eb7ebd5b1fc4359076bb7a7ea40cbd8b8d6d00188b61c16db8a3dbc932897fb3fcce8d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5755a370725a6be78fe50e04af2e0fdc9
SHA139d3a784d5936240ec54adb1f0466a997c43fd0e
SHA2562cc0b0a41f1fb7a5f0b2469a2f54a2e41e29e0b9f66263f463f740c1661d7565
SHA5129ad1a3b3bb95bab8a20c4eafd7e7720e3d5d88ffd33ee5b3dce9a56e758c23d9dfcaac8bb541438368cacfd580fd832379381bd39df3a2d9cc9d7b9bd6340a37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580ae8faaff09b8e48d77a3566fcdd967
SHA1cb54912fa4e9671bef5155bdadcc9295b5fbfa3b
SHA2561e1b6514e74fac402faff2da5e23bdf35f7ed8a39ca869294643d16948a93878
SHA5121a7ec842c9db3a96123a380dd2bd96f72897beeb8219f0fe5e86ed6d4e44242bbf11c2cdfd712287138356ac3f1a17171a6dab6e401fcd5aa0884cd40ebc4566
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb1b89ed6a45ccceb63826caf7231790
SHA1ceed42f3b15f8c37ddfe3f78045d2da917fb884a
SHA256d3e044782563c6b4c11b350eb2113a0c206ddb7a7e8e24c40deed75a83780792
SHA51278a6d7fcdeada8d292bfaf2fa8ab319fe49476b20c152f7268572f83fc30b004933c5eb49ac8b60ff7e6f52945e40288cedfb9c606c503c355aaacf1b2d67510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500d1e440ed91f2b70154585ade7e40fa
SHA104c1c623ed22a4323e9b6f89e74c9d4bc5551281
SHA256e8bc0c97def0e0064f1b989b4776a5a7fdb0b8784d8b68bef596a45419f30c06
SHA512c27fb852c1b19a16481ab9d148032a75cda75f8a8dd975d28f9a93ea5e6cfdc917cca7ea1ce71531f7fbc1d4ca10ed19ffe7d27f14bc4e0de7a477e6f41b2a37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e28cd1def1e3e2a94e012b80b9cc8e13
SHA110cd764bdda885c587710da83f855ded22c0d094
SHA256612000ec3e6d4ed3298186d9d8cbdba94ba3c7422c85d2376469615d431707e6
SHA51261be2578c0cae5d4562757bd55e84c453e5b8f867015380ebee9223b6ed1301046c6d8de6ff96bc5c31bb9d1050b9fb15af975d1a23e29e8b63c3e9e5cb5cced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5185da1e19a9d2d7f33f9863f005788b5
SHA1654c1182c8044f43fcf78afbaa8acf9b987ba846
SHA256e76287d1554f8802e2268d398e513cfa8ae62162cead27d64e02351efde0a4bf
SHA512fff4d06dcd0bf5fdbd29bfe73f9ac34c68cfa4d785f7b0dcf32e692238794bbf6615bd646d8d2ba813ace38168148a2a027d86df959da4cae29416008c427add
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5391794e8b12d0005368f7a1a265941c8
SHA16ec1264a525fe08bd67e9554ea99335d1ca207e4
SHA2568ad663502887569cb1e23620007384c389ac44c3b65ceeb3b8c589885dd6ab06
SHA5124a1fb082d7c94dbc542aeeee8e8828a6f0a1a82df0a5d57f64cdbd39d1677908a826d31d8a84cb24f5e161e015845474630a53f2e516dfbc2bb8333a00bae2cb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\glossar-js[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06