Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
196s -
max time network
226s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
1504f3627a302a24c315d2119f8c96a0.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1504f3627a302a24c315d2119f8c96a0.html
Resource
win10v2004-20231215-en
General
-
Target
1504f3627a302a24c315d2119f8c96a0.html
-
Size
42KB
-
MD5
1504f3627a302a24c315d2119f8c96a0
-
SHA1
ac8cba37edc0a3e23c013a79d41530f1975d92cd
-
SHA256
c1d220204074a32e93d66746ac6d674862730e8da7b3119f76a61d3bb2e2cac4
-
SHA512
a69417f99b7056e6a98c1deb73902c34ecd3be9b61dbaed1c232f2f560ec0d5713d792c5145e24f3fb6434e3d7729b40139d260ff924316a990c89f3b6d0550d
-
SSDEEP
768:YIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZrvh:YIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqa
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410183644" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECA12F40-A7CE-11EE-8097-6E3D54FB2439} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ec94d3db3bda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000044a23a24bc7d5d7d97fb0c367993c8a85d339384ff15ddc57818257cd2a4f853000000000e8000000002000020000000f1bc1abc97dff0981a2390030aad6b7f5778bdac31af9949a8dd13d56c79e831200000006baef7bc2bec401b281e9e4c28b8ede23789eb8b027496309314e00a2a3ece084000000013a47b9217ce71c666d5c8de486e046b852396fb890fe6b2f37e6d8023857c36a59449b726745d519a63a74de3b49c410245dee8b0ea1d818b64cdd6e93d6006 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000026b0609da38030ac84a50c8cff8ffdf76cd9048d1eb84c4eb2febbe0815fbc6b000000000e8000000002000020000000558d81a7538eb22ada1c6948056a398f24b6869f48cad8d5e0a98ca3845558c3900000006d6f9e3dcb88f089e9ed30a32d2ac118f956416a2c11796c91a53db66f4900a6f93825e00d32d28f0138b1a58b16a8986645d273429597c33ca74e05f4bf00548b250f066ed56755aa01e3e41cf16e5b68eb524d1743a6d0324817519f30432d9225ff7ca7b0a882968a1b30d053a71e21ebd9f78d4e71703cafdce6587ed8b28b41e838c64d3cff406323623f4026794000000096f330a976ab3a588e9fe1cca5f6d558786eee23eb99de0333099a4e7489e2729b9fe7c7204b1247f782f30acd7446c262a06583f49db783171386f66078e070 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2276 iexplore.exe 2276 iexplore.exe 1316 IEXPLORE.EXE 1316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2276 wrote to memory of 1316 2276 iexplore.exe 29 PID 2276 wrote to memory of 1316 2276 iexplore.exe 29 PID 2276 wrote to memory of 1316 2276 iexplore.exe 29 PID 2276 wrote to memory of 1316 2276 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1504f3627a302a24c315d2119f8c96a0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2276 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562a424219b069efc375d9dc1560031f7
SHA13b99933e91b50b301eb73e0bd1c15c1684f0c6fc
SHA25682d49c79f9b33b4c4c7df26ed988fa91275117d3bc9f313d29bc56ce44622223
SHA5123d25596735e06ef663a0ecb82cf6d919366b61194eeb21f75f1a8c0eafcce090c8a6b7523f858939bdf9ccb0d38fa21547199a21d8575dbcb886279925a8ea65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5289f4e7a64bb0e1129a8aa45fb9c79a6
SHA13929bfc0a39a7acc470abcb273f91baf5bfd1b3c
SHA2569bad729e30dc4ee4ee372a2820fb87c6248f4116b36982cc70f219ca60d2d310
SHA512bece9a7eaaed90dfeb1c5009ae80ae3472283aa4db7b6562f173620dfee3f708c27753763f33a5153748afe00d5670f089f6f5f8119077f872c804a9bd9df03a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7be21b6d41c828d050b7ed1ef795767
SHA1308ade5661e0166c8b6c9d0b62581346497cf2af
SHA256133a84408ce1be7f33b04d067c4894e820b643b177da33429310da508f7ddc7a
SHA512098a88a318bf9203c70a1049b767889a750c063bfc07b07a052b9aab089777be4ba5dcdb2db8f3e979e7b6119eeb8b8f991a25ae75fc7388715cb1b46465f900
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f41588d5a52d5636f9cc6d2651fc9f7
SHA18380d3318409213905e403196438360eea4560e8
SHA2560c1f8af2ed192ca36488af527a1e9ceafde35efd7e3aa12c434a3497187c956a
SHA512dfa952139b8aa2b92105838a8648362468b13fb10fade921409723eb388b3b3d5233baeef69c13366ef73dfc5cad1457cad52210110f7d2ecf5a2a0c3f2f7c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be5cebb4cd98d77a12c2b7b6327362f7
SHA1a1b6a7cc0d85a2f2884f009309741841a5e8f2d8
SHA256cbfda7642352d97fd7db6f9b22d90d98f6ae801c5e6b3d55cd043c411465f270
SHA5129f0816937139a337857389f2a8acdf66c1c638d704587da3f76f407a749fc666c542e7e56b2afaac275b54c935ac51f59a07799c1d995cddd3cc530257e3bea8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557a33c10b138a06c2de6b46fe2158c83
SHA102891b4beacb2b262e6dae5ea4c70416958a9b7e
SHA2569329684f0c412e32d09ae387fee88c6f28dc3dab7ce486895bc1c44b297b3398
SHA512bccf352947ad7822d51b943649689388439d5f867e1bccaaf9949644cf8a44f90048ffe1591a76a27826e7599adc1ea811a5c3878819a301f6e78dc1bd16fe1e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06