Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 10:20
Static task
static1
Behavioral task
behavioral1
Sample
15b73261afd4db9354f63584ba22181d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
15b73261afd4db9354f63584ba22181d.html
Resource
win10v2004-20231215-en
General
-
Target
15b73261afd4db9354f63584ba22181d.html
-
Size
2KB
-
MD5
15b73261afd4db9354f63584ba22181d
-
SHA1
10c15d5faf04c27715688d9159f59a115b37e516
-
SHA256
2fbb9496262da682ddf0ef817aebb30193900e814fb0c974c6ce9d5c9d442500
-
SHA512
c52d2c2ae0963721402c0e24ee4101ff9cdb1e0e849c6e435ba3d77e49a04dffc4026e6be232bc065a3d7957c4737b2f42bb6d943b496b528eca78feef2a4202
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5398AAC1-A7D9-11EE-9B21-FA7D6BB1EAA3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb80000000002000000000010660000000100002000000061ed4f5f14346474249edf711c4eae929dfa2b37c3a55c3ac47e2e084c30c653000000000e8000000002000020000000ce37943ebccaec7b8f4e2027c51a43e693831bf85a294f601c5e1c678f8beff6200000003b26e5afd8d05d8233f2d24674bc38d9c9082b5d5f34515cf6cf5b875014f06e40000000df3ae0eb321e58028f7870c50a2120057f2ed9e7df102485fc96f1ce652f181acc1f6dbf497430e961610f79f92bb3ede9cf70eb2c419f9a6a2ecd6c62e900e1 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d06b30e63bda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000da2833480278330846937f0f7b0e634a50c889d2e4ab344470303d12c5277450000000000e8000000002000020000000d8da2f4fadf0b7764d87f5a8582a148a92c0ffbfbeda03d214aa6232db3bf61890000000e3fea1179d33d422355e9824d8041218dd4ce66a04a7837daf31d4cfc07dcffa468261f9a430a7158d477d863d36245c2c06c8b1c84a9739101f4531cc4d4455bb0bc7310d8246254ddfc0965fab22fb92c74e9592ab8afc442fa2cdee4493274c9b49a7f3022ee3ca373386b89c022d2a12006d2228af46174b51a8101bff4b48dbb9e350886bd2d2c1cf34e0538d2c4000000021b08dd87f7edb1819e340ccbb3486e7473daec29a401c3dd410b84471b9ed4ad20546907eafb7d2f68b10ea847d09517b8fd7a90eb0eccb3ec02827681f6820 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410188104" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1452 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1452 iexplore.exe 1452 iexplore.exe 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE 2440 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1452 wrote to memory of 2440 1452 iexplore.exe 28 PID 1452 wrote to memory of 2440 1452 iexplore.exe 28 PID 1452 wrote to memory of 2440 1452 iexplore.exe 28 PID 1452 wrote to memory of 2440 1452 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\15b73261afd4db9354f63584ba22181d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2440
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e58a35a3e33db39078888e2fa3de1db
SHA1d0014acdc8293e706fa13c9fcf0844fe3d8dd503
SHA256306580666bf3192eecbf5316770f87f9781b5ac455ee4c26d722f13de74644f7
SHA51260b80b74f89c06878785504bf72a6face91bdce89ab684a2658c40534cc2eaac0901c5fc00a6d4f51daad682e037ce68e844bfd4d7dd1ba5228eaa6deb72140a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d17ec9196b7efade307e48da647cba8
SHA172bf8d6dacd62560736e2854c78db1a546fc6695
SHA25698d5a02dcede75f16eba7d41b0a0d4dc5bc8c58ed69a881a8d45490321ef46c8
SHA512d6aaad1b7ce50c38b98a3d0a3ece10ede31101790c18a591425ef47330776885053aff5d6a5f40daac0d7fe8d8b5de224b6d7d69ec0abc29c3ae94b283827a77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a32389a49de3154c6c8eaeb486d6d016
SHA1cbb25aae11ae06a587438fa05370835f15adbc38
SHA2564212fcc6c2a744ceb18a8fc475231922897824833fa3ffe9d5d4512e0fd39048
SHA5123f4dff7f28c3a43775871b57104238355800485e9d79e71d79adc78fcc1622769f59463a1f3c822ab7623bbc651138c9a68797e9bfd709893814451472fd66cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586d65cb8a41b1ea14a84035418e621b7
SHA1c47a13affc77c8d109f2d99783f4e56caddd63af
SHA25695855a7cee62c32ed4c304752fde232b41000a7c646d5407411ba23c754c19db
SHA512482a959180f1a1728965be6b651ff28f20830445ed35f64ae6b179f2982936009af69b00f21530a617a719d90d0077b67ebd176f30cf2e18417681f8440b7ae7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ca82fc89450515f6cc24e1facb99479
SHA11d94e6a11eb86e71cf8ef939a698d799b46ea50a
SHA25632274309f9702b4edfc539a85f59490e031474261f53c04d605a612cf3e95a70
SHA512b5f9f0283925642134a212fa0d6c40cb5a24d41b9bd35bd04068d9a6b6011e3fb9dd32ee0d79596b9a676a380ba337888483cd8266e7a1b2cebbd3e78b5d3692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5393d46506b213a0cb9af8e7549eb3d9f
SHA1ef3b8d51912b107caeb65bb85447a56a5648b2c6
SHA256ef505cc57eadf0e741299509529b45a22c5ae19f8794cb027fd444a36652a389
SHA512e56b36b5407fb49cf56a14c249404286b1b765756b99b44de1dccbf99eeb4215659d341038509b920fe7ce3128129615c05e8d796ddf0da9474768331d952dd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50816b3bb29342eaa4594eb51884eb161
SHA1517aa8706b7213936eaf2d4f69ac3eaedf730648
SHA2565d61e8f197ca4a0457c280fd1a032a5e2a0a3c02886f1b29712a5e6e88df13d6
SHA512ac5bdcd9111692a135fcf8ab5e3824f09bb1529662c1fc5d8b486b5ad58891af3ed0beb645674af415f2cbab39c755483a8a0020aa77866459322751b95f7423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5204d3f3e0028e4fd8a026d99e2c3660b
SHA1bd5ba7f292c9cdbd4ae46c850cc2026b9b33ca3f
SHA256d167ae68d5affb762d0af567a8e5b3c8ee8abc4d7fc24a7facbb4a0fe0a48c26
SHA51229fdb09e26d1d088e44254171094074ec0950d9d41307d6c2001f40c702bd7fd24d11803913425c7bf2d56ba99c4d74f10da02b8ba524a7e78549e42038f6619
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59cfd3b33844e413ae8cee063cb11558f
SHA1cfbcfde0b5dd7a5abd3acd143ba66eb1fdd3fcd5
SHA2562eb727827a30bdfb21766decbd22c0e41e291448b5b67972f8d80feaeef4ecde
SHA5127de079b4e4c5ff5cda351c8931c1e79141f6d93d38dc89ae77499961a768bfd8ace55925f4c48018874888dd63c5617fa01e1335ca9b0b239be05b8d4409a93f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5295217f94273b74d071d08de887a409c
SHA1cbe57bb7f5fe1760ba1c0601940fff53ae47e601
SHA2565aad1a3f7b74e4287e0544e1c2743e94bec988d34717bbcd49bba84249c4acef
SHA512811af8b7e703d970ba4b661169858b80208396a9bc5f84ce33e30c10d6b1dbeb54e5a614c1e571ac26b5358743bd32d4b61cf3e1d04c8c715d6204e70b6e3c36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56092bac4cbd58a6486c48f7bd99084c2
SHA1211934178b2653ac3ab825d51f31afa5923b05fa
SHA256b7cb1d863d8b1410bfa4de55be7e832157c08ca7e73b764b2baa809af4c21b97
SHA51230ffd172bda96957d546d835083d717f04cb0240cc47dfcf612df997939eb6581145be955933ce00372b9f1567946c3cb5668438f885e7288d6dff000d1f36fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ea395c50276dfe4b1b24c47d76d8318
SHA1c772bd111e4908aa7d7072bf254eae7c0f82f547
SHA256d5c84517fa08a2db74dbc69305d2f0e17747e16e4471ec4e21c28dfddd8dfaea
SHA51288689f22b0b2fe827e72019ed3a0abcf8e25a258e12525e6da4646bf93c9c13f69b15fcc5fe38f8d71e670c1aa8bfb3f5f67c365e4e5cd0a0cda307558ccc265
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b62476d6d79ae65db8fcec1d7c4b232
SHA1231b5a07f8fc711b7fae9b18536471ad19d8c6f9
SHA2563977392aead5a3adaee2e64de1aef95f3c16396cde2129eb2f028761dfd475ea
SHA5125f61ef616c080d0d4f4d5615b72dbc88effaa10ef5f9cf05555df09fe7660171d5fc23839b9bea8aa826e1779f9e2b31e691f8e345434b2e98b9706d3f40e682
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0e95ce7cca7cf46d5d9fcc990983af6
SHA15164265e7fd3af5868c6a6ee06d076a32f0d513c
SHA2564fbe4d16a9a51067bcfa4636dacdb77787ad45cb50b7ce62d269156bf77d481a
SHA512fbb65f503ab4d1e90f0ccca2e8632de75a1f2eafc6cedc62a405bebc586e5258a7d2eb74c20f74de8d568e6659021148c9bb8001bdefc98fb340c81c2fc71a7a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca4f5e941dba9a1444e7e09438624b76
SHA1a4b1672379a0c9804a0e2a5fdc2cdbc60018d1cd
SHA2564f91c48972dac0ee4b36d354ce2543ba92f0a15114e610f660201702351939df
SHA512f5190053cae61ea3f0a22d065678f91c9b467e8de64e5a9291cd2ba5182e2c020bd879c18cffa2e2f971b138e0590922ef091072b24a54f477bf2f65b83dfbfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592ff2b5f20d51f65b784c0574a80bbbf
SHA114ec870430397ef6c1a445d63202e82e7e450fa1
SHA2560e99bac3fd155d402ca1aab73c243449b1beb52c364faf6ee19260f8a652d4eb
SHA5123cb6883cf814538fc32245981b956c186a78a632b8ced20dbd56a055a74dd275ba54c65c9ffa0f2762732be6d65bad6ea956397ee0ef694e09fc9feb95d1c076
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD528f5c7bffe7468fab9b973fc09d0eaf4
SHA197f09f1573ca4da19a29c45d3951b70bf6ad3eba
SHA256315c5968ce53a38d869799f50a5f127cc2a8a88747d72f2d249d199c5aa1db72
SHA51238182685d4e034c6248244530f0bb7f660d6c5a11ac9f21e8e52ee240ed6e6ebd260bc7b712c15e6ad48de84aa7f73c60e204b71fd773efe5f3744aef5eba587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD500de3792df3b54dd67b5e15ae21a3df8
SHA1c34b0088858478b2a90d2f06648c1dc1d638dd76
SHA256c176c8842116b4b159e07b9d8685aec83bd39ed54c631a3046e9b9a5c776f6d9
SHA5121328b53a8d75a10cbbd43eb1d89550ed03aa7d6e3a4548516ef41f676a888456213d44729b909de7348621e8f6ad55a80e0a957ee2d07ce19a2fe44514a344db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5282459ae6bc87910cf48d8c343a5952d
SHA1c16702c9714eccd36f56225fcb375c96ed4e512a
SHA256a15e3a0835cfa1f5438dd909ecdd254da8801184d5dc055be20253f525dc4392
SHA51202952448b9ca00efbd97bdcc73f6417b2f6f6d5e302a9bdddd219159cf30fa98982a43f2f8e58baec6f2bce5ef38b81aae6e1b3640102a0ba5cb04b27de22b44
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06