Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:11
Static task
static1
Behavioral task
behavioral1
Sample
0c97bc0daaeeff50e948be7c531e40be.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
0c97bc0daaeeff50e948be7c531e40be.html
Resource
win10v2004-20231215-en
General
-
Target
0c97bc0daaeeff50e948be7c531e40be.html
-
Size
432B
-
MD5
0c97bc0daaeeff50e948be7c531e40be
-
SHA1
3f9e2f419355cc3e287b0b2ed1abcfb36682806f
-
SHA256
68f2228ddbb04428d3d7df9396b32799aa681c4b84229b22da4719d85c4ef119
-
SHA512
c706b7a5ed7726949236ac566b420fcb9b5a55fc38519c7db6699102c7fab191308255ad5059c7ca5b0e8b4200d806543ec3e9d21f396274428df5c6649b9352
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104b711f4d3bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59EC1631-A740-11EE-919D-C273E1627A77} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000002a4f81630d22b62ca48feef313a04e2a4a44a074721783e37f60d0fecb6935c3000000000e80000000020000200000003d2550be400198d0ddd8df1d60b80eed5c855bfd33f21926909e324034db6cb820000000679b7c28073d3bfe7dbc0266074c769f5c9b4de4632c8e642fea3519c9716fdc40000000a6cb0cc95ea1040beb7b2f7aa35d3c43713f20797daa5d101cadaf0255c4bf11a93de40cc7d7134159672fb34e851847ac79e312bac975fcf6e28fb34207405a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000bdda161e218b08cb5c890070df56681af2dbd1a8a39505bff1136b23c7bcd456000000000e800000000200002000000064bce82d1ba616e2aa08503ac04331f5d00bfe77797563baac9b76affb67ff1190000000c83d281baaa54114cec8cf146824480b9bc169c4173915d1c7ed42b13e0010998bdd755b3826b20f496b395a27473552fc51fb046a907252327e9ffc89048e1a1f9870b7a9dbfe2174c610869093c441083732eb1053c387d64e0eeb293eab244b36aa039ce9b4f6102df6b8219d582080fe3ff264fcad8e322575d24424ab94f18ed40e94decb1ee14e1d7c9d2f806c40000000002638abe662cea73d11f978d7ed0b32357ce205c427fabe2726d9da9c57cad2e59edd7c77ccbf1994fdf367f5360c4202e676f6243dd0eace9e53604da00edd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2316 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2316 iexplore.exe 2316 iexplore.exe 2384 IEXPLORE.EXE 2384 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2384 2316 iexplore.exe 17 PID 2316 wrote to memory of 2384 2316 iexplore.exe 17 PID 2316 wrote to memory of 2384 2316 iexplore.exe 17 PID 2316 wrote to memory of 2384 2316 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c97bc0daaeeff50e948be7c531e40be.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2316 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2384
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a6382c9803bb9dfd334a79fb0c129b1
SHA1d9c00e3b4f25fea06b7785b0fa1e0d16223d0381
SHA256c8ca404c7f3f9ab31b51eaf6e52e934a5a3f553caaa205af00e244f8a9cb297a
SHA512225a98f684e2dd892a5a162fa3b7f466e85833cebb37adfb10ae98176fc4629da5b5789726ad5eb599589fe9502decbaa722999dc24e70071a4f6b8161a9ffba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f044b20a9b55e08bbc6ffae37a68fddb
SHA16ddd467d840f896b70e88a80368069cf0c751f1f
SHA256c6762e7369594278090410e0122d2cd856f8043dd25543780a8c6be832d62e84
SHA5129531d42fee512906cf3cf832292764fcc3085f748df3a5e79391abd1fe07897c62ad7e0bbe2fd872072b7e1dc80d854e5de0abdddb28f7a446a8d64bd4e2435a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f28e484255e1419b924522b42dc097b0
SHA1a1eedf35ee02682fdf82c5edbc0252b123723c78
SHA25678ed755327025669020ecaeed74af50500ab76c69e2f2c8e2b2296aa5d8a88e0
SHA512c1fb81e3fc03817978e684f675d99f92c01ee7c4354c7abb2fa7a778e8ca8a0562fea09b90fc722b9f8dd4140c8a88a1c1b2ba2dd377b20e18ece9c837f3be35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fe5b9695ddb1bc1cc67f769681805cc
SHA127228b0f0aa93ba5ab0eac8c4fc0c9062357105b
SHA256b446b930faf300f2f2c9c519f9174f151472e9d69c5c2148b379573dcac3f8cf
SHA5123ccf97287bb919a1dc89380499811544c28880a657bebfc3558dca1cfd04f38c098d7015e17cdd75bcb4397b31bfae583a4f9acab943ca6b2c5743dcf20736f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ab582de219e54ec0abeca7ce891d669
SHA18803072db4b4c83efea151137e98f8fb8d2e1c77
SHA25681f599d7cf8516927da34dc7cc709de106d274b24dcd1a182111ad39ad274d16
SHA512017f375308f416230db0f9fde6e7a018ed53fdc15de3174443f7b21a64fc25a386397f1f674365b45d7230c3f6406d53604d752031fd51834670f0abc04a5b2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b33e3d1f0d7cc0d180a814c97d8bdf52
SHA11e173301df43238cb8983639740a30966db70353
SHA256fbd76f2281a0614fe48ccc0611cfc2221782d124058c782b7d550e3e05aadb5d
SHA512523592c26867bf0ca66833027723174e618b69dee2b4a458adf1c1f7da2f9b69054c1ffd0c5cd19f0f7177a548140ea17a7cef8d579d0b8346f071dfc144f3e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5459445585e76ecd8f9f712e6398d3747
SHA170fcca09d27d0935537a90cb635bc6a8c6a57432
SHA25681f3b04428959f881b2c45862718eb1ab827489afbf70064af804faf8d87633b
SHA512ccdb97558f2b26e48ff7ca3b344038ff2e65bc4ec4ebbfed8feab302ec011f6d7b719c55adc833e9d58fdad941dc2142e05f5987af473036290b1118c9c447fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5790ead3b78052c50cf1adb1c7ee14860
SHA1c5d37891587786c8d80b7972443405c01fb487ae
SHA256e77fe25b0ab475af0ba7df5d956a2f24853e0a33c0a8a15279e35da04a828b0b
SHA51271c4e977e63ecfc67bd5a67f401857229722fe534a156bfef0e5efed1b3afd490b11941f9970cda47e5e772de3238412947b55e6602472f98fc0c1ffb608726c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f05f075c35956866165abf5f2171452c
SHA1cf925e343eeca4d820f926f71fa2dc2c4e87c9ee
SHA2564bef3691c929b9ec4bbdb32463dc957172fc7449529adde07a17b4c2925c0c9f
SHA5128c3691ad81ab7ee25f2d7761473186da1eb26235b7a4a10d50d70ed656eccb825c8648f7bef5be5c1c97203f3fb97fbbc3611eae04fd1b3af4817db8883e3524
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554441455ba0e2649cfb1e271a961193f
SHA10d9874ffc913e7d261e3c931cab7b42b719f8040
SHA256f4d9e2860f2531c94e7c7e8046000d5fa91fc01bf43569a93ecb34b8d4ddfba0
SHA512d3a962dba50e1711f33a068a9e867a5ac7f906957d77ba8f13af885697e6c3cc6e5773fbe692830e02fd4a444c8087f42b918c4d18e0315fd6d421c5b3e859a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52367295918e2e9b39f3ae9f384e8e42a
SHA14a33b3f57f38f21a5841d31d6103c6d18859b870
SHA256763d18a2c3288e0998ec5e11c7e47aa57f8faae3a5e4eb50eda6ba17005c3146
SHA5129c9a022dba16a81bbe2ac82769eb8f91cc704f86b3675066d0f7067faf075b3246b2cc1205095a9617336f757fb2e6dd60e9508f994e546b0cef93f4f016d1eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD595c6178b5537819347081f4d0c8c8b10
SHA1fa74c7518c351c86e240547b0cf18b2b266da450
SHA2565c4dea3e4d67993983aa396b5196ac73ba166d003ecf39dbfd9d8fd22d3888ef
SHA512b37b9730409b78bc69d67658080637140999039a228f4b60c78d1764069f0335ff5ee396b6bda3dbb705005d046f9b6e6d1e54c14d9a9513c52538c10a786cab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554c3211eeb7c0a2c89fd72fa81f25dad
SHA186f960cbb6cbf012cc3ef134d86317e548164a4b
SHA25601440961c828b83e03f1511e014c73ba047c92596729161417e702ec1670cb4c
SHA5127729a5252fe0118cef650034492ee918907ba3b32c76bf3c1f7d8cacfb0836e1fb9135561a93fbda789928383a1354e3ac14fa1638ac9df9b4622bcd331bc960
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beab92026ed43a85fcf2481d6ecb48a4
SHA1a7187e08fe46ce13d604d8b8bdc0d28f6ce7b961
SHA2561cd0062de06e9854da2cdd0ad432555c891a4ab7f01c216e3106a29c25fc629d
SHA5127c076782070773801c5806d3cbc6997e1c0f2b34eca3cd1e3250a47343d49219e0364cdc0d86e3122354afc2ab40fb7a05641609e574b83baff9a8cdae403320
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7c2f5f37a21f7f99984ac3c82fc30fd
SHA1037ec54b2735e6bb96ac6febe416add251a0f18e
SHA25616546d85fe57d7e7f1e46d2d1543b614c278727da648e6f4b974737600e7a408
SHA5123c86f3cfed7056daf3cf470eddc1be617d17d8ce177d63ea9a2a5ef85ede9989536cd119577b805a8206ba34aa2f599756de03ac8b5ca9c7679ecfca97c0631c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca1b3687eb6895837bbbdbf08b3a1860
SHA1b5ab4fc15eb0a4e436e21ca8f10848c93dda482a
SHA256bd1ecbf4b5dade4ef29205b6336525a05a8f49775631b70efd8c8ff4d407cbb8
SHA5127dc6e0bd93d52e984329d831936b9ea9a323e417334a334b57d30f85c2138b6e77a6e5ed972413dffb7ea78d85759665f182c0fb9ab7241aaed43c58139a3240
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58cfb9a4c11c8cb43fa14baf2b2748544
SHA10a0b7f68d47a8d4c817c53aee6b6b98e22fed96d
SHA256c5c3a53c30b51a88033798fd4d75715848c7a9c578779f18e9d9e62734961d50
SHA512835040331f0963cfb010b3db6ce8c62cdebb81d777fefdf58446a9452542667921adc9a55d15381d571af984ed17c34615287ebc342b1d5e872d9e0e94b62bda
-
Filesize
1KB
MD539ff57204c5654b50b3f1b90103136c2
SHA166fdfd56a8625cf3eaed16ff80b1ce62997c8c1a
SHA2561f994f522832aac9fd607bd36afd038e3af688774718748d7d5a051cdfb940a3
SHA51228b8683766fece3771d07d22a635aaed1327a6db21da10ec99c8b9aaa54a56c65479407fe764ee659000447a8bc8357caa7c4777a72e6af76541529dad31722e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JX14I93C\favicon[1].ico
Filesize1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c