Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 04:40
Static task
static1
Behavioral task
behavioral1
Sample
0ece18433b7ecdf145dffb6c5667ad65.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0ece18433b7ecdf145dffb6c5667ad65.html
Resource
win10v2004-20231215-en
General
-
Target
0ece18433b7ecdf145dffb6c5667ad65.html
-
Size
25KB
-
MD5
0ece18433b7ecdf145dffb6c5667ad65
-
SHA1
a8e9cc5857a034fa389e3479f41dd8472177ee49
-
SHA256
0cded98cdb3e0ca2726b3976db9b171d024d7a5b87483a96d5972dbb185ff0b5
-
SHA512
1787cb57fd2651aaa3ae551069e9f48a393ea63e6fc7ce8387b8a6acfda68aff9062c50de89fc0e1972029f440ebdd551cfb8f3f2f9cd88a7b9096f256e0978b
-
SSDEEP
384:1dg2H8oM/GwV9IftkOUtxKTeBfKTp23zMbApLcLgWQQ/U4yhoy7jfIWrYc51IlSs:7g2HlM/JltITe08DO1NG9p6
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e3e21ed0c5510844f4818ead4be084ad6b7941e5567bc4a26e8a05920f9964b5000000000e8000000002000020000000e5af448ca090685d5f07918f24aa810704b23e704a0627c55f8635eb91dfc90e20000000af14637b32e1d480a1cd56e5191233f10e0ddd2ef1247352955c6de93eec82d84000000091528e2cb375949ee727350abb33330974837bcda5f21e04772e47f53e7a141cf08161024b3a73399854e3700effddd58c0b67a64708ff3d5a2d06db5473d786 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000017ffbda4998bcec9105f2630197749a436a3eaaacea905bdbc40bb8077f7b1ca000000000e8000000002000020000000ef6ee136e984304900296bea82e3f41849e8d25ac1bd10539ed1d45423a44edb9000000061dfaf5b8815e32c27ed9745ddf53b11575efcc593a5b20abd868b08195e5917ce7c3d5f615e3fbd2fdae96698d2b45125c3fe7bfc0703c81531bc9a2364f9f90b4d1e5e467a80c9b0761245901750cdadd74e0fc7ee4c8f3f78fcce0e054d51a095df8e112b46bcc80ac38f05296206c3cfe6d5c4623b284ee7328d5e1ce093ad2ad4843df51f526b20ddd2559d961a40000000417819b070e38536d8d4db747dc32e64411e864c326d1d3c53519eb6d71d8e133683013f2f8997e7f550a01b9e20d896f84bfb8fb7d466ee8d4411b0819fa419 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fc9dcc713bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410138132" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7C587F1-A764-11EE-B1E2-4A7F2EE8F0A9} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2656 2112 iexplore.exe 27 PID 2112 wrote to memory of 2656 2112 iexplore.exe 27 PID 2112 wrote to memory of 2656 2112 iexplore.exe 27 PID 2112 wrote to memory of 2656 2112 iexplore.exe 27
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0ece18433b7ecdf145dffb6c5667ad65.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ab8d7026e239c6afa43a039a347136e
SHA1a74d211294992be8742e5d115ac5cdeebe216c3a
SHA25657670723b1cc63af1ebe316344234527672af6c724d4f9a7b272a040d0fc63b9
SHA51211c3b767b24ab0ef169649ac2d42b3cec2e0e9a81407d6fdc4f9e0973fc128ee0c8de875450f963fd6b6b6b70e38bbfbbdc12bd67d308748968903a14490497f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD502e3c6cbb9d391a6383b364b0b93108f
SHA19806cfd2013fb201d12ed3ff07478143b2c48abb
SHA25600fb2cc907341e53dcac13f5758af605f68a5320b0899f902f1510f94f8adb52
SHA512ee9f58c34e3872c67d5ec9247be827d34895ee09328bedf30c3779c84350ee4ac0bda899f7e9c8b4b3b00710e985f5ea0a11efcb490cef269d381d9c0a09411a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550dfa7bf8120b4ae411e357ff8a81365
SHA114196f949ea0da996009825270fe786a0e359e8c
SHA256937a5b3213162f0f22a84e68f76a138db3981c7f677e189fbf8a9a81e48f1e58
SHA512bd16f976f3d2efeec7d4f2540191e93ee12cf1f3adb5c549870a3915544be6bd1afc2b27b29e3ebdfc5f6fdb1ec86b732be5542b079ad6db6116188242c77dc8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55648f2ab9c96144aa4d9b9a0777561c7
SHA18a660233ff1a2a549147b396fe7c135fca9c72ea
SHA25652fd8355d88d44f69f02167dc410f3fa9b41f8b3dba0b7c05a5d91c9281cefc5
SHA5126c50a79a14833fcd7ca991a14a3131928f008da78ecf2cab3ca8aa9eaab85dd42b9421ad568ee6dacee901f9c9b5d76bf4fc04e2c42d887f1e4e730d5a423fbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf815454b1015d4f4db4df000ebeccc0
SHA1a1a504a48d55e708a49df58c294b1f7a18bad4c1
SHA256259c34833851e87751bbd08455a21f661606095896f0fac01fdd587ba43e4641
SHA512ff71268d804a70f7b9c42c4628ac4bb331532911ab22e243e4af60f69f5d10f1e4f69c0bdd46045549b9cfea98bf4886a9c5cfbeb8a0039429a0099be4d27959
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c4048899a70d3fe32992619ae277d90
SHA1f07f0f934e66a2852bbb7a60628c14e7c9398cd5
SHA256068bed72a22f58306e757ae96ab0d00981b63a6c2a6a9682b16bddd8662f3b86
SHA512601c6b46ec1f3cc596a0b35ff009416e0d4449b2f6487668b9d3aac9e6704bc248134d7f850b5cd2921a2dd3c3947cc75fd50d96c9c4aa7697789c8f27d38b5e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06