Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 12:32
Static task
static1
Behavioral task
behavioral1
Sample
189bd0abba900b8821397cb44061f0af.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
189bd0abba900b8821397cb44061f0af.html
Resource
win10v2004-20231215-en
General
-
Target
189bd0abba900b8821397cb44061f0af.html
-
Size
6KB
-
MD5
189bd0abba900b8821397cb44061f0af
-
SHA1
74924cdf809ea76a0b18464e3d4662d7a31a4592
-
SHA256
e7fe75ce8cdda2d647ca7194f0d67027350ccc739dab55847fbbcb0c55ea39a5
-
SHA512
b71b9f5ddba6ede257fe4c558d50eea5842bda2bc2fec2615314e25d244a75fffc24302ba7f74bd4950f0e93430831235a716758095282e740fa5f5a8f2014ad
-
SSDEEP
96:uzVs+ux7oFLLY1k9o84d12ef7CSTUWZcEZ7ru7f:csz7oFAYS/pb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000008938d422511973346a60c99bd6af7185df4ec25dda24aed03d4767c3c11e0e91000000000e800000000200002000000006039fff5e281e291ed46bc2aeba25f5604b6efb3e918d7db01a1c4c309bd80d900000006e0c8026ad329fea518ca674d60658ef2b352f96cf5bde0e625cd05eb9e7373816d54c39d36ad1eae0f9fdbc320612cc566499b5ba84817357a9c375fa5652112ec513d9743398bce43a4a2f99e491506119361bcec4bd504e3d61eee5e6b3a661a878b198d7c203348e80d840a815884ae1983f8bc006da976657ea7069b18e175ee3e8975f0acb5c6245046077b4fc40000000eb03d0190ca9666aad2cfb6ad6081062dbc9fe7a125efe7494d5004f0d861a4e659409db6426702f0a09729cfcabd20c745bf957e8bc1f124c3dd93503c829d0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000003bcfd5dc6eaf1fa57d48733e7ca8d1a46ec26c85d8d0be26f782cf302446eb8a000000000e8000000002000020000000dd8a60eeb22b1bb370f1c73a945c2421975cdb1b29837fa7d021741b0d8a272820000000adca37b50b43a47ef0634cea5970d31c6862c44f934bfb997186a85a146b2ce84000000095a09f5617a1681f0f974b248bb8a2ca32959213f24ce5198beedce8644b55d4d82629d7ec36847a2eee0da75afc22375408e69a869c404b52a0f6a43d6c930e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{654764E1-AA2D-11EE-BB9C-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d01b96423a3eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410444119" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2084 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2084 iexplore.exe 2084 iexplore.exe 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE 2424 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2084 wrote to memory of 2424 2084 iexplore.exe 28 PID 2084 wrote to memory of 2424 2084 iexplore.exe 28 PID 2084 wrote to memory of 2424 2084 iexplore.exe 28 PID 2084 wrote to memory of 2424 2084 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\189bd0abba900b8821397cb44061f0af.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa985dd6366d82359f4a38aace4985b4
SHA14f48b09952cf6d4f3d1293e9318c1404f888a04e
SHA256cde759bc88c67403ce61a7ecce757f641c497b61038434f3aee4d5f0428c3070
SHA512763a1fa12851cc85efb30eb30391c853f04223412430eb2ae316b478116476a8292085eda96d06587a7ddf8b83687c04d4686ae7f370a174b062e9d988ef2874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b683380a7a99a873302e96a9b0af10f2
SHA1dcc945faa3b539d626ff82aeb81a5c73fc3e07df
SHA25670b68dbde99d7ecbaf887400184d23f4d7b05532ba0bfc7c6c85d23e677ab1a0
SHA51249de022697458ebf8ef5c11c7401acef8ce204c93dd7f8835ad39831a3b8a7762d1a11bbf624a34866785a18ed840adb69ab6273680014e23b3ee81f899fa3fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc91ffbe5ff7efe7dc88bec58c3526eb
SHA1adc84c10651455c91128947b0bd3ee87e388d577
SHA256c62134ab337705e53c73e745c8f96206b9dff161d71d9c44f47748577b70cedf
SHA51227e2370f01e3304ae341f896c5e8d6c2e1f7b906f331923bb6f0a95ac87ccd2cc5b9e22f43bde65a9b1e40130430a4c83ac22f5710b2db54ed1dda9f8489667f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba9cb756adab71e15df20cd22ad0bef2
SHA178c9604d047880618a1406081fab5ce8b7067402
SHA2563c6800696442830a6d4ed8ec1f31b5e6930553b26fd912ba8ca73cd1e216bb8f
SHA512b9c66e081711d7419322c665fd38d77d38feff2ad8dc785bfad72fc8503bd7dcbe3d5616894c9fda7c81a3272e4af8f5cd72445e1c75878ce4ced68e2902a9d3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06