Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
182s -
max time network
268s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
1813a7451fc8a9fddfbca7359c04b84c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1813a7451fc8a9fddfbca7359c04b84c.html
Resource
win10v2004-20231222-en
General
-
Target
1813a7451fc8a9fddfbca7359c04b84c.html
-
Size
758B
-
MD5
1813a7451fc8a9fddfbca7359c04b84c
-
SHA1
20767d367cdb2ba1929d94f10e689f547c3a2ecc
-
SHA256
ab96da4439d05ca62acd9a3e9d7da0a34958879bfc8579afe9e27d15356b25c2
-
SHA512
6b737d3902163eeb4eb1680dc6fd32ca301c88a8f32f2dedd0ea401d8e31c7061e990d930c4f388105b187e5e6325429983e6372d9f68e1c4feea8b0b040303e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6034820f2e3eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000007229b58cc72f2b8eef4faef5a7c734fdaa07ff878f1e7673c2936b78779fd848000000000e8000000002000020000000656aaf3a37f04f5bbf750331dd415dd49c14a630e2b5d462b8b5e91a0df6cdfd90000000fb0fe03e29023124c35187288019064cb2f1cfcf2ff8f4f17f41cce7bbcdedd9614d0839f211832cd46406b094a3b241b1140816c8acffeb291e15f2dda5fd51a169cdef20cea8377ecf52edaa536ed430bb3e11a6dd16bfc5f549528cbcbce47a2d08cc4408e5a0a5045427539164841da657dacd34e85cded01e726791656122b94e678ae627ce4925a614950a15294000000061a225a88da36299484c25c510e4e0439aaac00246207edd3df38504230a7d3d36b617a805aa69f692020554b2eb388384cd51308d4c70a724fd67f09fdcca7f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410438888" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ac84c32c727193335adde3e9e4c003f3632204e05b9550cf1c97390662891020000000000e8000000002000020000000d8b2d4fe9f98b013bf62a218b681b9dac85d6644521ee0bd03dea7a924852c842000000040615babcd2a9226e04b470903ee1321ffc7c42183867d3d8c7d92aae9cdec31400000005c407fec2955cc78a9dc1be4fcb9ac0461badf4795945e57509c2762b7401c3e08263713e933fb20f7fc8e9d89d14abdb842ae74a757da88cd175a9ce97595ff iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3986B420-AA21-11EE-B989-46FAA8558A22} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 108 iexplore.exe 108 iexplore.exe 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE 2540 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 108 wrote to memory of 2540 108 iexplore.exe 29 PID 108 wrote to memory of 2540 108 iexplore.exe 29 PID 108 wrote to memory of 2540 108 iexplore.exe 29 PID 108 wrote to memory of 2540 108 iexplore.exe 29
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1813a7451fc8a9fddfbca7359c04b84c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2540
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520048dafe8f036f82b3fdb94b29604bd
SHA1bb1888c69c8988d9ab9a0df471c44688d244b04d
SHA256ce667a4c3546c526dacb19110829d9dbaf3723b943d7a79487ad02fe18f00635
SHA51278f168b67baa4c16eebfc43b7938f06ce4d6fa465849ae2e38b571c6520165ba7131f79e27d7f7a432890b0f8610d09d15fb07c6ee1b75b353679106a88715ec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56710f13a6878ce9734d40959a2ee9866
SHA199647573bc7c942097caff40f1739fd087612402
SHA256eae5515d9b31b8373b986aa1d897dc3c55c159a2baedccc8f0967260431814c1
SHA51248c29ca0386abeb7171add32a5bc8886424e51d023b3f085f19eb70c0fc2e60dd863d810989b5a3df972fb464e87d3cf20c5dab1bbd1a572b1a56812aa6cb03e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1a6583ac5faaf94dac7365aca467bb0
SHA1f9e1be10bc7003337c4b78d82d57e091f2f03f53
SHA256392eea06d3c73a4399a0809f6630ed6af21b5b49ddf305d726affeb6fc940ef1
SHA512584283e5ddde656e8e7109f76f6b4e1b3bbe649ffe486ee0417dc9de09233c9ca2121996c7ef88c1578a124f2144c8b40f3d8d4f38d7bbc95ab1226c2452e621
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e59bfe5e2d7f8749c385bbc56583391
SHA16b50ebd6274269b170eafec19c7f6d7880a07641
SHA2561481e542da5beaadd65b13ab307c1120a078452328a66f8b0812568ed47cc5a3
SHA51278883c3ddf0178c754f6f867dff18df2ca8e60c7d3ebe69d8635f08f6addff2b11b90f423108e94cea3e9e6366b69a0c3b73383b1c53c77cf34a0b6a66879a0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506b213dd6a15c3ebd382d30a8ab84ee4
SHA1b7c2e1b88dc5b2cf9e7bf8472581b565c0614a55
SHA256e645982092d862d13c35aaf5ce4ad1608efe24b0159fe7f073c2501669f182e9
SHA512cb7faeb027c0bb0b108666b8fcff763ece251dea74d51878099bf1bbaddb7939d742bc93a0e6071370ac4aec99abf3127f7222f61dfa205ca8ee76d0ebb1d1c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520f836b18ce0156e5a93a765b20c706a
SHA17616c735ca6dc9090e2ae97b8683332d8a944795
SHA256aa361e6db7352dd1bb72faa6d0a3ab6311d54700e7790f60f84b55d1b1a0e56d
SHA512b84a7ce782bcc21bdb265fd91973b7d2a6b38848c285ab5f4eb5f130a7476d57303638f2ac7cf5acb71cf0be3ee5087c0d96d876ffbfad76a9414cf63b04d6bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57701c813e18d45c45fb10313341acfa1
SHA13ac946c7bda8ab30eed80361840b3ec1aa496e1a
SHA256acf016ff2d57f4cffc3838f5fe542cddb572d02bc463f2a5f1af7332b9915565
SHA512705b9d06a72317583ee75b655507d361dfbee8045a954f7e5ee3d94e1fe8b0c21f9e44d71eeb492dd77f94158296b90474b07a424de0a72f4b62a2959e6f2c35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0f1331e13ef40856b54e9245993d477
SHA1ebedaae3c970789a268692e5304ce9f1a8c52613
SHA25605c1295bc9bbcbe3e34c20329ae87fc2af799366954950a9868baf2dc92ec527
SHA51273e19e8c614aa92eb7458e5d112e96705d3b88d2aff04e68f96b7bb402946b94cf1a4d238d6bd247128d67cce531af2dc6ab2aae57b50d166b7f279875b75281
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574764f436949b15c1471ec11ee70b565
SHA177ef0e092f00c5d6d3e937afb5405712789a9ac6
SHA256a9d9431d427ab615fa0476eb784fcdf8efff67bdf485199aeb9a47ea548a2f20
SHA51281f0a49a47ee84a5eb17507e29cebbb3642197c7eccb92616a462ef8d8eeaabf98c119155e2759eb765951e163bbc407d6a2c6af5c0b9cf0704568f2c52b66d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed1f000e1740062077250dda1ffbf875
SHA17c086d47de3fc2ee42693f90bf8c447ccb7bdc98
SHA256d9b61939c7d72371b0ca71689cb5dd7a2c2de1d829fb0fde1e6a4c4a797f8c31
SHA5126bbf29af2c7ee885c0165c33705a6a080abbccac7ab887063b991d69fd9448fbcbb9081c46c9b776792d4756991e310732bea2e63103adad2fc92b162cf90c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef7c06c5cde5fd58d781baaf38660b6c
SHA18cb6c7902eb992ee91ca2411de7c18fde8c98b53
SHA256ae246b2b3f9831b414c85a3a89a384288335cf756e07a22da36fd8d3b30be35b
SHA5129f28c7dec899f063edb49e2477b30f1fd862c72b29570f68ee4c9e8c32d94e629f357469b69126623b094fd330c8020b411fc78c0a2473c964bc53e36cab1094
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58277a92a253fa8e9badd9a0f4ee35eed
SHA199df64e872c862fe1b96c619777b5d3c6f1f2095
SHA2563accb461262152efd0e173388f1b8f2c2c981535d548d4aaf51a321eabea9845
SHA51234d5a3c43ed40a5b998b78498462bc7c48dacab31f0df2a07a69c40f18ad7463a47cc12c60cf40ea78deb98a92a91fba5b8899a0ea2d85308e7fdd3ce1671597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5477665e6bc193b64a17813e4f1e4ca62
SHA1524cc48ea78f66ac4d9ccc8524265842b7cabf35
SHA2564b84fa2538bcd8eca4064a202933dc154499663c4c954667b4cf05c210d2b69e
SHA5122a673ed53ad5519f39c523482f56810afb8095c5d9f17f2212e1cad3247498b933ea67e6aaef8fe28cadf2b6042c8a9354ca49fc900f7dfdc06886b72319353e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06