Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 06:38
Static task
static1
Behavioral task
behavioral1
Sample
113b37776c12ef569d0f4cd5377026d4.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
113b37776c12ef569d0f4cd5377026d4.html
Resource
win10v2004-20231215-en
General
-
Target
113b37776c12ef569d0f4cd5377026d4.html
-
Size
9KB
-
MD5
113b37776c12ef569d0f4cd5377026d4
-
SHA1
1fb725b6f21801e75e33764d20dfe337ee64bf40
-
SHA256
950c345b361265a744ef1dcca66c4bfb7c1261169037ac7ae296789a49980ea8
-
SHA512
957774c4ec34185169ee17b8439c1f1868fd17feac72183b5442ba0c84c8f1d3930590a69870191a623f09e306e96bb1f27c73ddc48aff5e10d9ec4359938442
-
SSDEEP
192:ln8uqnGDSSW0nqWhhiVCzBFLGaBty4js7VainZk2KJzbIpHwNBCG9rI1J8QY/BxJ:ln8uqnGDnW0qWLiVCzBFLGaBty4j+Vap
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000001cf712fdd4d04178928f4519f2914ed34f5188b7c6571569a3a80f26cc7f7177000000000e8000000002000020000000a07dae9f2927cea38ddd61ad8ccc9e2af344e5c83c365fe87070620531a9f218900000005e8a3e29c1392d98d7eac2109350b9fde936ca45f10d36a448b9fdb4ec23c3da26de19c1ff9115584cf4d925b482cb47add815a6a86e934d230d5562b9e2bb11d6ccc06b3da489842da584e714c724416d29cc02074e8cdbb406a4e492a96f99d635cf471c20e18aae80b55ea3b1e24989d243f6c2b4d57260165901a0811772418ba6ce50fe1f06c34ba0673354e48640000000f6cc3602a5e52522cfe74ceec5d31698cc6acd91ae2f3e51f23bb15ed9e859ffecd68673c532dda5eba7734ee6ce253edd404b931bcde94c05e41517324911e1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e9dda29c3bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410156514" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C64C57F1-A78F-11EE-BD3E-4EA2EAC189B7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000004b29365fa6be91ed87a4205e7a5ef81f49ceef171c3a13aec89cb593bdfdeca8000000000e8000000002000020000000306c1394c8ccc8e4fc2ec6f409d792c3b712fe3987ef7d7c646f6e537fc139b0200000006816db6e478441d02a0a20ce24331f9843dddd0303e7f4e4d7d5404cd4872b49400000004447a14a1220206a4a7672880ebed6c5d3d7cb89de06ded630444a375d32f169f136cd3bcbbc4552da2c03a70d260223ea8f0a0e65feaf2d8855ff1c094f5aec iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2988 iexplore.exe 2988 iexplore.exe 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE 2644 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2644 2988 iexplore.exe 28 PID 2988 wrote to memory of 2644 2988 iexplore.exe 28 PID 2988 wrote to memory of 2644 2988 iexplore.exe 28 PID 2988 wrote to memory of 2644 2988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\113b37776c12ef569d0f4cd5377026d4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5f3db4415375eb1440a3187d80189a92c
SHA1bfbf41c9c108e150f9b0b3afe13a118e8a752261
SHA256abf1057544c375767a9b90070a42a23921ef3baf05b9f8c8eeb6c3db2dfa4893
SHA5124e1e061a6fe8bc2a18b7200b13435e3dc3be8eb629bf29a05ae847bacd24258a5c50d6d1d46224e24db30e87e93230b7375ac92fdf529561ff69af9fbf0ee07a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c48d8d5139919ca6dd1d74771b38f28
SHA110bb41b6cf4d239db08d248e0f15b6d22a55ba4b
SHA25657696e34993e851738b882ca9bba2fc183045436379cfa5c2b337ecae3950c5a
SHA5128b7a26c316d1c6a298f3c582244293a921e2a191878f8ffe478aefbfedf8162c932fbd8154ee9f5aa734c3a8a4610de8027d7d12deb4776ac7f66fc578d22946
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD551a6cb2e59454d95ff813a535a756c7f
SHA1dc84d354d1a8e77521cd28f5e90df38875782b09
SHA256e5d89c7c1feb441dffe15f3123fc51228f9edf2a1ba1791214bc0d4d2280982f
SHA51241a8c95fa1f429147e5e3aac2579c04ded321e3779dd4545f0ac7dfe31ed1ac899ede3ceb6da32f09a9e91926b250f4306939142025affa394e7a571bd21cfea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b834929c951b81bff1de461577308c93
SHA14b04e8a74956203f6d0e47eef87204d48644d750
SHA25602bec16fe3e5da29dfdb1768584716e7d659fb715e274cfaf721be86559d6a62
SHA512d1e8573ae598fde1dd651629ab5c01c86213091ed518d574a946bd161858b0948863a4ae247a982fbf7bd71dea5237dae53961fd5cb00fbb6e019f58e2150527
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f1a6d2f7ef0b7e9762bc7995c341daa
SHA1f0fc754b7d50a17e1afda66e6200f23cd5ec38e6
SHA256d55be6d4d9124ec30615f734f52932c3f288325469f8752e2410acdca2690ea0
SHA512144f651de7a669941b12a10f0aef9672fd37e4bca3e358fd3c8affbd24196e12706fee6f43bbb196eaeb221b0c9e94b9efba422f803db1040f8facefeb400721
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD56f80f5e8c0f21601efc09c948b658086
SHA1f6c3b7c34cde87f9a0d7e81ebe6497ce9f2bdc73
SHA256f15f38ef22b9e3c51633e6d78825171881478dad9e95afb1ab1503db780ce4b5
SHA512c16b0346c3b512076e761dc14f080356d5af22667d56f08fb9d5dfa31614bc070ab35a1c2d5c5dac65b3996b716f9ffb450d6fc55e36f4dff122df75900df6fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06