Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 00:28
Static task
static1
Behavioral task
behavioral1
Sample
0896632f44dbccc3e805919fa1454192.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0896632f44dbccc3e805919fa1454192.html
Resource
win10v2004-20231215-en
General
-
Target
0896632f44dbccc3e805919fa1454192.html
-
Size
997B
-
MD5
0896632f44dbccc3e805919fa1454192
-
SHA1
ca7d982e9c2c6f664170bd172bf8f1f983788c93
-
SHA256
66fcea6af216f5c22ce6c4b35c8539915177ee8bc18155214cef3f06b9280495
-
SHA512
9ce6e1afd93d65a70915218cce2bfc436c37c91d44339223b680de462c7962d6c0d2c3f132dc7dc777196cd842a08b7a917dd09faf0dd0069878fee1c0739a47
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{42649CD1-A759-11EE-8459-F62A48C4CCA6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000004e56b3fd46f202c8670b2f8d6652a86f618d9061420c266f9c3b278c813c61d1000000000e80000000020000200000000db15286a22ff2f0779cb24b2cf83f3338f607006185ac16dfa98e4938e04c042000000028124e83ba3ea197ad43a9c4c0bebcb38f331723adc4788036da5f3d147cbd454000000044a8dbc52988c88c51e40414ac3791321db4a03eca1beb466dc670dabf001babff06ab39254b057115d32ce69bf00906e20fdecc31ab8ba5e560072e289680d1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0faef16663bda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008f2e29e568d407d1af75d0cccb65c7d927a013fc5f4f4600c77b921964161cee000000000e800000000200002000000050b91a4366fa3104f6c512ccee1b15b19ecbbd9c9bcdccc436194c43a381b96d9000000042b1971dc69806a17e99042574c8a9aea57a3222c99f7663cde8e8bb901ec47a646a09391a97253ec88b165c495b26c89b9c6dc230e9c9ae1c37583caa4054623cad461c3083dfc011870fc0f982884c645a473bfeec5e05056edb16e5540a7c1bb4c86f40a69955ecbf4d7a26cbdea32162a3d5815830f9e1446e3a3e0ca2c4b5b83cba6d3aaf155262bd8281763b384000000020dc67dcb225687b9d5fd7ab4f884329b437b18ebf4630b3461d40cede0f94f62b70751ec560e7b676f8e58a477501967fa2632f33c0fae23fa7ddb7fcdff562 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410133104" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2928 iexplore.exe 2928 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2928 wrote to memory of 3064 2928 iexplore.exe 28 PID 2928 wrote to memory of 3064 2928 iexplore.exe 28 PID 2928 wrote to memory of 3064 2928 iexplore.exe 28 PID 2928 wrote to memory of 3064 2928 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0896632f44dbccc3e805919fa1454192.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD56dd1acbde92438e37032ccc2a9e9f26f
SHA13dd217b2ae4d1b0539dd372fb5c7f105d15b4669
SHA256a8277a48a97d479fb686f5f83bb4578d079f2058dc907d8723f25715449f6bf4
SHA512202f69daf7c1c64ae681cce22c30ebdf12db85ab6a01c6f054a4ef9434d926369537c39361026b84861401a73b9a96984aed2c4fbaeb6777effe0fac4252a743
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cde5ab515bbb718fa58b6fb9fac0d620
SHA157efac26c8349c42e02974820803b87bb7e4dd70
SHA256ee9b657f3b31074ab3a18cd62564039436f22613fd8753df78bf4ed0b2b758c4
SHA5121d9a924ba57694dfd2abf0ec4fed3aa2dd5a5d9f1c4ced0d080cabea8a19b79ea149438614c168dbf869867715fb7caac5049f221aee861bd3ee54fabfe13ae1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5efa004717e2778d04f67e5c91e2b9758
SHA1c2cbd0bfca43c84644eadfabbc4e6df8824303d6
SHA2568618750bcda2b982b39f968ac9688f794e16a2161e1298ff6bdec18c261a7660
SHA5123f58edb36c2193803c690243f6bcd2611efe9e1f962b9531b9f0efe7148b2ee06524db014254bdb185c1787a43d524ea7178a2c8987ebaba90878a70e69828b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52e5c33bde732c79654c8e5e49fec1181
SHA18772b70de60160412845b50da53d67b2e28dbbdb
SHA2560b8befcb3dc606ab7e8e22767a20700ca00b4459bdda4c13e037439b6f735035
SHA51214e6711795f603507eac10c95715c8689ff1ac6edfbd160d579889e0437cd1e9252f70a0d4eee0b22ba5b1529fbc3d488cb8c2749361a5ccc61c58e2775f74ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5eadc8e43b6a987e600d4c6c3d6be49ea
SHA1fec0a312fcd47ace0cc1e2c1f1f0611ac24717dc
SHA256fbbbcf00a14752acdb93bbcf3ad2e5f68371413493afefcd9a3ccd7a09d80de9
SHA51290066b8c25f4494129f37c07054f11597155ce1ac448b28e2af648dfff0377f2f89cd6dacb36356d3e9c5d2ea470208587b1e8a7d1ce918a67f2b9bfc4aa8e18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD52b7fe133bcc233c407aadf8b7b6ba92a
SHA1faf0eecea6265d0c2509cb2c7da80739393df323
SHA256b69ca2c8a334fdbb802024925654f5a637d6fe391c0084864c4e18ad27bda2c8
SHA512c164698ae99556693eda5c739456067c765930bede904dcfe6cf096c73d9356f5cec456bbbb85a7981892791aaf9911026008a2b5f812ddf05b2ad832adb5eb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56737532ee49f43f4aca563bfb5b80910
SHA19f6594380d7f9acfc166f88caab83da88cb0a0c3
SHA2563d457ab9d5b615e7cded4f32a7680c6305b154efcaae84563a86017fcf02aeb7
SHA51293446c04314604c1ac51ffbfe67038d83e512b90a8f98526eb018d68213113c69d046a24b75f683b6210dba15b738c3c145f3297b51c2d49bee69412ca4f6b67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f4ad3de4d1359639771bc4ca7b240b94
SHA1fc7d234f09609c15d03d08c8d76428784d0133a1
SHA25688c2235f0fc1e492f9cba0bd564b54e38aa95c89d87fb1ff3e99537c186990dc
SHA512c463a6c0e8cb7394b8e381f51d622f4de9c722b778aed57fd51e0bd5bc4e2ccf88348b6b910f71e19ae14a3d3dc23769b067554575badcbbae297edd087e4899
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5221fe7211a63223b5059b1242a7ed9e2
SHA188cf1a0d2453edbfe8463f7e1e5f87e87e4e1beb
SHA25684e548473c09cfa7616ec81d4c46bce53c03900391fae796f7deb7d280456322
SHA512299d9b4d9ce1f9f2892765086f07e3cfbfdafaa862ae2a000c8ed2cb290606459bc07d67f67b41956afe8e5e5291b5380d6e7a59f13efb44eaf48389309c5a8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b0705fb8771ee7cf28de723b16b2a0fb
SHA16d28a59e1e814b29ace7a3dbc52be7db93ffc2c3
SHA256330df65caf8535f12547fca708da3d1b40640d19ccdb49611b4bb2c1ef21f947
SHA512ecb8c1fe0b50e9a653c54aec38d9930773f9689ea45f06e6ff7748c288c73911b342b27779e15980a8abb131ca8c771ec8a9e5d6eefac96dad34d33cae07415c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD51208b34e721595e53fc604cfa5eb50c4
SHA1c91331bbdcc561a7790ac7ae69edb79a570f4a38
SHA2568f26dc955dd1a75f308d69fd2c64732788190039df2b69976133209dc754127c
SHA5123f881a25b56371989c0d2701f39f822301950c896b49070a04c6b25de9ddfef2289948bce5e8b14d3ffe42dba73231355cf4d1199969f37952f386b88a1489fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD591e173d48ce40a30d65b187c5081475d
SHA14dce8d6498e255ddced916914e030fd7be2ea391
SHA256868b9d3c3ede0ace51b83788bedbb413bb8e45e0b261fa3dcecf0b396b7dc54a
SHA512967c6ed041267693ffa01d882e6350fc73cc96a7800329fb6b9d7a793a96ead0b970310a6890975ccac61e93ec2eb8c27505501830d19c4ffd41db3942c441ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56a4b89bf4ae72c7cacea629379fbb6af
SHA1e226a883f675a0e0cb5f556d3b0014ff1539aad9
SHA256919930a0f3b02c005de559faa1b7d185cf3549ad403ced2954c1d5a9070de654
SHA51225b34c567bd2da311a427d44782471ed74332e07ccbd171ff57867f44ae1699045b9aa5b34f32c1e8550982eb2fa9355b6e441b00410167f47abd591433205b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD538a7268f49b9aef50f70e393a1aa13f8
SHA1daa3e9cb443bba09398dc6af2dc1582a5a8532a5
SHA2560e980d1a0c17b56a03d82f470d82465f268e99096e1fb4bce5c7f263fc8ee32c
SHA5125d979e1ac21db708a1de088d63c399bc85576f7b49c05361a49af875b1963290789e00490835f7509da4ab991932f37b782fd11797512630d23e991860a321f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06