Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
188s -
max time network
219s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 12:46
Static task
static1
Behavioral task
behavioral1
Sample
18f1eb1ce836be81034664569b1e2fe9.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
18f1eb1ce836be81034664569b1e2fe9.html
Resource
win10v2004-20231215-en
General
-
Target
18f1eb1ce836be81034664569b1e2fe9.html
-
Size
121KB
-
MD5
18f1eb1ce836be81034664569b1e2fe9
-
SHA1
894be2d6a7f59116a120b0bb1d5f73ae9bb8da45
-
SHA256
d895f0bfcbe1d3eadb88b992fa18a5ed25b5dd5ffb16c3a292daf0670baf9cc5
-
SHA512
925408cfd05728421fb972792cfc8761a8d23c7a41ffc03b1ef5c044bf9ccf552ca66ed9875d9cafb09f48fd7d1bd464b477c24b81c620e3cdaab99c43361cdf
-
SSDEEP
1536:tqtYmtDyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9w:tqtYmtDyfkMY+BES09JXAnyrZalI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{20A31550-AA37-11EE-AFA1-EEC5CD00071E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410448319" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000005ec93396f6d363ee3cde02548d6fe9cc8d5d346ee46333d873307cb7dae59dea000000000e8000000002000020000000e00f5a4003486fe2f6ad588c1ca051c1a993ea33a8abc8b876a8f5e43ccaed8c20000000695d83e218fcb56aaf5461fe8d81d22b39d1776b896d5a5ee4adec40309aac1d4000000073eb5122cee5d97e8216557c410b4c8f27beacec3dff6aa78aef197297823183169b858aed937948892bd1b749ffea6141f67870295bdcc1f7582d7e0d5f86cd iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c1930000000000200000000001066000000010000200000000f495182148fff15e2356ee03a7397135f24eea0a91551bd9c4f5aa17789ee12000000000e80000000020000200000008440325b56f7e604a9c9bd4c5c35c7446110ca12bed83c0a6448568e7189424f900000004b2568317cda7c571eea3743d0425d16a4ec37da17ee1999715c2af9f45df070c46080c5cdeadce436a256b08eeb09ce39bbffdd68a8697e77d38bfcffaf14fc44627787dbe6643c77aabac48c9cb8347998ae1ec865cdcdb3a1583eb754c6d147a738b2f62a58422e9451783c8bd227cc9299eb75ab556f768a1d242fac341abf48cc97e459c0544ec8e2597b10ce394000000078a89515cb3dd276e2a72d67c3b7380d036a010fcad5f16b443b4641a50121bf5c1f13eb3ae5b87e528f0f11fcfb630f037188a2dcac301b875779aac3ddb3b0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bb6219443eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2592 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2592 iexplore.exe 2592 iexplore.exe 2768 IEXPLORE.EXE 2768 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2592 wrote to memory of 2768 2592 iexplore.exe 30 PID 2592 wrote to memory of 2768 2592 iexplore.exe 30 PID 2592 wrote to memory of 2768 2592 iexplore.exe 30 PID 2592 wrote to memory of 2768 2592 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\18f1eb1ce836be81034664569b1e2fe9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2592 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2768
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c001ef85deb0b646bc43cc1f758eca8
SHA19339039bf62d3e57427d11475e16a0b56fa0e613
SHA256c028231df2927bfbba851117552c04c30a925d71ea67bb75f07b6ec751ec86bf
SHA512b5faccc126bc413fd54174adaa49dd42ba9c45fd32529c4eaaad13e1c171c5a49f47660ebce25c31e426e663242ceaa3d69eaaf2f96dd9fe6bd31eaa526fb86d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fb8eedc7b0ecb41c112373139cb9be3
SHA15d6fdb52a17690f4b85519e2a745fdfb6f5e6ff8
SHA256b1a6515c72470c6dac7e925fc9015bdf6be83b71985db28e2cebbb7c74442dc0
SHA51259dc0328e23f67a2e441cb6ad8b4d967f7c12b1718000f527fc3c32d8e7e1e04567fb092341f25285f1ea0eefc6d514d6a1bf76d1184f785f4d2ce0cbb720727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aaa3fd104567c3660a7c002ae7d01b17
SHA182cd2b7614ed96cf21080f28fd498c61a1c0977e
SHA2569971f202fa13d596ab7dee8eb59141ef60c07c44760b2fec43e21112f1baa88e
SHA51221867e40dd4c3b2cb927aef07658105dcce38388e943daa35a1e4ee813fbd08c9bf69ed2bbd1f477db03cfab56848d029226228102fdca51c7ba3a9e69a763b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506e0af4ffd812064bbc60cb3a1873103
SHA135e347a87b3e7a4913e4c6a30bcca99c455e0703
SHA256e3f1c49b18a4eac8191ed4669013b15ca041644cbe4a5c0b9cd628b2cded34fd
SHA512cf75e5e057a5b6920ccca2b35dbb7abf671166a926efdb0d63e9959702b01741d92c720350434f064944bde9885ea9bae538ce3be652260a10832c86318b9e77
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54faaa9d60c8ae3da5addc6eb74c36f15
SHA1dd8423627e68fcb44f5c610e2eec2b653952e3c2
SHA2567e9e1d6979bd9f8c8881b27c9295d5a890627cd7a91b262bf7056943589b2ffb
SHA51265f9c61b3bddb58129572d4b7dee37b7c2384926b3fbbfab176417a5ad3e0ca6b3d3b35772f87a7ef47a74acd1c348d4311219ce769795caa30cd6d33b6064b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dafb10e90c66e2bb0c9bd1373e870a6a
SHA1c2526c44aae6a1e2e72d12633c9727e29ae7eff7
SHA2567bbfe53ae5295ba414c9ea6cca9ea3f304cc6c0d5f458bc95ed928faa936fec7
SHA512b3b1e3aaf0ea977bf369d3d6737f910d81614a86f094c5126a98ff38b84b130c97f0d5a6b0cc73d4272fe96ac34a1f3b2f915cb1f3281d6c155f894d7a4d27bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dea6deac3ed509ffa0dafad508161092
SHA13f499243a8c4a48a30b01ecb2aadf03fde09e4f6
SHA256bce865993b5c36e4eae63a346b4c034108d0ca5927c98c0dd1bbf0f45422cc48
SHA512d46b105eb8bbc71a2c6e3cdafe31037ca4e4c6d1bbfdbda31eda33462b68bcd4521f8800a70d65099026625649c2c2df1c5ae759d290c3a919565aae63a63981
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55456631429b174d570b2261bd2fdf906
SHA1fd2f5d769cef5427b40be2cc4e760a9d054c17fe
SHA256b9fc223d18cb19e6e0884d5ce69420866a2f8673a2b17635453fc245870aeeb0
SHA512e083fd1745b8e428e748d7d13962e51ca79a6c2cc97a694400cd7473fac043eda2166dd84dcd2a062f0b5cee861f23fb9178f6968f272dd493ecbd986930a3a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d27f4964c87106dded7bdb09add7d14
SHA1d6ec88b374151c48200c358f09fd0f1c088b7977
SHA2567e2243ae8878e4c9b27cfb0940faa87747f21a6edf6452b0a700fe1d24984e12
SHA5120187aa9cf7435c06e539f84ce04c63fb3c6c840f4b5905fd1a3cbd17fa071e4763c8ad039668ee4c9e898cb53adf372882849365818c32c800df796413543c5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e98775cbcb609079913258e71ee2b3e7
SHA1cf00dabf2361f862a8f4ecc5df233f408bb89061
SHA256a7296ba2d05aefd26dc58e192843f0a3e4f1b95bbbc056a339a56aafb4327fad
SHA512818f580f315a6ab1bc1e2f31fe35285af739d39d8dcf57d6eacd23291560a9f7cc2a7c5bb1498c5227bfec52c41410547c3f56439cec8539d2fff7117cea0bb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534abf28c6b29a08a2934d21ee135c088
SHA1fbf6546af2bcd72fd6f34cf95ec1cf6c58518b7e
SHA2564821275392df5966ae875e782afdcc447ce376f9fbb1be90eb34f3e60ace2bb1
SHA5120da783745b291e595d0f923c79b68b1d6f72f9a2fee7812a163d543018a36a8bcef4d941cb1600501bfd76487fb585c0336f4d92498bdd13b61e4bb0cb64b453
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54011eb5e492e95db5830c6ec50cf8183
SHA1654f9a1440b3d30bf98da12b3ab0acf89cf2d67e
SHA25698a76e5174743742c6627e35268bbe25e8bf246b66ac64eea0f0e58b49c34506
SHA5123874c0526b89ed8f2682e2c305e8c8f2cf17c21c5bf00666a701a5039d3570128182f415aaa94c23495db64ee184d87a030235ebb7622876f31fdbb7d1915edf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e54d6f49b1f5da0b27ec7c089a5eade9
SHA199acea230f25fd301c9c1c0b0c84c6bd3c0502e7
SHA25689c66e82f0a70896c463f5859b7ce1e320ed9c883fffdc3b7154e5c17ceca511
SHA5125225d1870920d107a35198d51b8d915573091de72d2ff64fb3ec01606cff0ebe51d4fdda8ab3739fec25aaaf40a2c4c191ee4815219fd40c4a202b66a73b58d7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55aa2e55dca6600b98499467913163846
SHA1e7f9b68a4a39d81081059fa988ea0a0376cdeaaa
SHA256a0c06a0bcbf18e4a804d4c8b3d78c374e450acc570913c94a58e027630c716b8
SHA5126695a763826160bc50cbd52f07c1938942858f62a2d1663ffe21ae0e1619fddacac027eff51d1b94146ed4365a23cc412effb11391ebd2522bae61c38b84d8bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f39cbc8eeec763aa13b75a6fc31fdb6
SHA18dbacb48085b7f1744a8e9b79fc82a39b28c6d53
SHA256b8112c1e23f44b77377c03c8257f272844eac7f1d66e317814a5cdeacb2dc949
SHA51289cf00d7c2d2036d94be202ec1188a11cdb35dc072144bfb577b68ecb64de966832930f288238f906dc0c7c863ab1967b0e91d588f81743405fe9403510454d0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57432b844563260fbc02954c0cbb13154
SHA10098a65a7d1de618a3e4940d45f52d63eabd677e
SHA256e90132a338a9d6ce1445d431442f2687d5c69b79b60c833e72e2cb194740e829
SHA5125696d4bd5b73b7f9de4b7117604f13fdce0e5fa0179ce69824e6ceb48458b13b29e377efe8bde500f7cbec6c52ec33f425950cb8ca84e677a9568833c827a76e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a0e243e5ecc1a0f24a55d664e9fd779a
SHA15e8441a52479e65e5ff91268e774fda0b7a7a9d9
SHA256fc5508de107b98be530265f696112882d05e38a675b37acccfe44c3442829198
SHA5124cf77cf5d0e05d6e6a3830edd3ab3c981d21833da1bc2b8af9c8753d6b81209b412b0ba44757bfb973c3e6a6b2f06a7403e0801c979ca20ddad72e5350907c8a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c5601c97c323b8e68c6bbb251116161c
SHA14ff2900138c6dfca6a629c516d97a7172ccfb0b3
SHA256907dc121dfdaa517ddd832f3def30e86c5e0f8dfce4eadea620892fa2f1f962c
SHA512f9651154b2d61af25ce59150133aee0c0158f540a6b4b5943dc0f9cdc40133436723261f623126f7e3c68f1cf8bed8efccaedb056fa61e3183366ca96c7a032f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06