Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 09:46
Static task
static1
Behavioral task
behavioral1
Sample
14ddf4089d8ac2f67142fed0d015705a.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
14ddf4089d8ac2f67142fed0d015705a.html
Resource
win10v2004-20231215-en
General
-
Target
14ddf4089d8ac2f67142fed0d015705a.html
-
Size
8KB
-
MD5
14ddf4089d8ac2f67142fed0d015705a
-
SHA1
2a1518bcdb008d79c05a40bb02c7713ada7ba4ba
-
SHA256
54c306e70c89ec2e89f9fb6661e061108bc40eb3b7c789dfe3f984164e80a565
-
SHA512
ab048bd973977e38795577582839842caeb3690afb346644d83ea2cf0fa8b2c7dd47c6c7036f59db20806b5d61806878430ed040e01efb598fc02f3c919a6f37
-
SSDEEP
192:FpvOfeAMRyibWQcN916/J8FVt8OvFIT32Kb:F4fRo9Cu8Pv+32Kb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d780000000002000000000010660000000100002000000073d20059967f0ab752d4858f265d867d5fae0f1cbc837654b7b29fed77a01e45000000000e8000000002000020000000a4593eb0af9d52c42df8c17fed0fc48e7d0d8f0a1f43731e0bb3ec0125796a5e90000000084bca86d19597df325348a8613819c234e1bf2d2ad45d1830d73f706ad6b0d5c4067ee8e62af90c832abf4f64e311fbf333b3c9f3a6bf9b19df5aba9221c6b50e1d992605aae3cea140ffab614a937c575b2224e85a7722ad8489aa11707bc6380933df2f19c3694b40420b01cc74e89d942c9494bde7d7bca4d91eb2ed75b8d8f5d1a74c8a761ab845d097c32ab4d8400000001919cd814ac7904a0ad81deedd7ef8ea85ef32c3a3d3426bae5f844e5ce2bfb3faffec55d3df0f6cc41a86598cccecb48edd68f8de256392f5803aa3cb147a4c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{091CDEB1-A7CC-11EE-8DE0-D691EE3F3902} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90526ae0d83bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410182401" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000001a0d0fb638f983c99c90b2f3d55baaee2ce7aaa875da6c0effb8d52a6c62bfbd000000000e80000000020000200000005651a53dc74238ae9cf079be6ebd04e945d5a165c753900f60c98c7504877ab620000000008cf884deb50b73f7b62acf9aeb36a53db891bda681fbb2ea1ab24d033301fb4000000066aafa0e569032c7de12208d576ed27d387831a2e810788e901224a08de357cd296a80ae4f74e5010c4a134546691b0d9d25e036879f7dd23f80066c47c84b85 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 780 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 780 iexplore.exe 780 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 780 wrote to memory of 2284 780 iexplore.exe 17 PID 780 wrote to memory of 2284 780 iexplore.exe 17 PID 780 wrote to memory of 2284 780 iexplore.exe 17 PID 780 wrote to memory of 2284 780 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\14ddf4089d8ac2f67142fed0d015705a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5264b9b3e2dbb596a4e4ba2f748a3698f
SHA1222fb45ac5dfc4eed7ddf2fa9efc649159305a4f
SHA25654353768e0bee884e9c1659fc8cbd6bf6c0dd2c50c7e7104b803a9437e452bb0
SHA5128657603816b5a4c5bed6b088be9640cc1ee968fd0b7bea3c3ceb12922d44b107850a5979e94713cb1857fba012147e1f470e6cd5aadfe09e5c1b067735dfa957
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d42633efa02873df064c1f5453bb2b5d
SHA1bef69e6c5901aeb5decfc03154124c1bb041ea48
SHA256b2f5c9badce41ea712b5885d66ef0566acf4acfcb260fcec2f346408917ac7a1
SHA5123e393a24b3f717e653c466bdd8225daecd7b1fbf798ebd53872d2bef898c74a3e3392ba96817a0f590cb06de9105a2c2cc311af4961dd3ede97712e33fbbd3d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD57ccacf2e68b63e5f9989a2b00821ad8a
SHA13d36c760ef765feb6790a308fd8432ff69bcf170
SHA2568da22d4326fdbc7ec5a859aef3f6f8cf3aa1231384d3b19f27c078d2c6da4b3a
SHA512d32be0756a1632fa476991e53225cb9af8583da9b5d5ff9fa07e1cf293b8a6a2e90451e362acf931972482cba942e4e5fdf174d83a8c8c99f2ef3182aae2224f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD58b514056b3bb4914e2206eca216cac58
SHA11f69d34013b2f2fc96c1ccf79bb69e5fd440b31d
SHA256f7c82f6b13ec46fb6e58f5297e54f5e365fff91b698dbee9c809c1dfbd3ce600
SHA512fb0072cf8f2fd77786b571b71510489a6c4ad008db01b7c74a8839470e96af36a259894412971d2b6d076daa52dd0675c37040ad6ffe7128df31046c2f4c491a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53de398c77f57d207dda09c6558a17356
SHA16d73986dc08ac7fc7b97cc8e7f2df84ff32a59e2
SHA256cd461485304ffa095b2e39c9c621b50239efdf0c700a869a71f4fe4ad9da4943
SHA512cd59a6ac6031dc4ace1db178c44d36125d759204ca939fb8c93cde3ad306b59b7285dd32626a330c459e3ad13d8ee8165e3e6492266b3a1363d9c710a4227e37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD56bb997a092dd734ffd0129956c2bb1a2
SHA17a862be7c3a374b3f14d69e8beb44fb2dc40c602
SHA256e35837dca172edd59ae3f877319508e865f04b3e55705059d640733e9f056bec
SHA5128cd17260d9bab403b9bacb67ceade415733191e42314c71cdf7562765c0d33251abc8a5748fa97f65ac0f0abec3608ed54de0ea7a185b8b88e69579c759fcb68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD57c1afa792c1fce11c2d49aebfb9df018
SHA1f980658ee46431e0fe22cb1108bb64d5aed9f230
SHA25661ed712dd6c076333fead8ad95c2b91fdfe84b0dcbcb7ab81a57e91b44da69d8
SHA512a8e7805de6344127b1c01c0681a525ff317b53ad6f52510f7c089b412c3b2a95363dc721dc243d1233c84f3e288ba2a767b8de005f21ef8ebbfa9baf7048683b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06