Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
166s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 13:53
Static task
static1
Behavioral task
behavioral1
Sample
1aa978cfbbd205ff95456f9d790d0929.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1aa978cfbbd205ff95456f9d790d0929.html
Resource
win10v2004-20231215-en
General
-
Target
1aa978cfbbd205ff95456f9d790d0929.html
-
Size
415KB
-
MD5
1aa978cfbbd205ff95456f9d790d0929
-
SHA1
cb054c439e34f56301db4ee709a961ef02071b99
-
SHA256
77c55d09ecf63af41ad81cbe3700374f88ffdfc6ffb54d32becfa92cde7d35f6
-
SHA512
4354533b85bf4b2b38f80684266e918f6152d992e1aaee346f4e05874b08a93356bf7bdd49cddfeb06ae542bde45beb7ead68bc80698dd4ea44194cb0c10fbd9
-
SSDEEP
12288:P7Eqkg3l/X94itkXzHYD/0Yfvn/sncnM/CGFtet3Bl/GQktItf1K6jm/UoY7t2ob:4qkg3l/X94itkXzHYD/0Yfvn/sncnM/4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7019c99c7d3eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000003fd6d9616bb575c3c7f081b8bbc8432845423ca4cd145b5203ce3188078bf0c1000000000e8000000002000020000000713233f917aa1ffd4f6cf52f232dd55329492d6e368a95c0689e659b71904ab320000000f9a5e2b714a070e9e3d1df6195be4e8104120e7b0007f4810bed49792a7df930400000005701f9fb6b2d755f3bfe91b488de90a0a5d775ee292ddd63b8d8e9a15584e0c1d3900314231dd3deb0e3b713bcc786188e45367d8ffd8fb82741f676433609a8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com\ = "18" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410473032" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000000f502243b4df27f43c2b71011193c1351c6fb52c341823841198f942c1a76fc5000000000e8000000002000020000000e347876c82e50bade7c8b93ebb4444a1459884f01520179ab7afe7f7ffd6d0109000000035fea934533d82331cac48626d8c99cf731655903b36d91a077d732781a0ae17f9caa5d8d960def017a2926e49210d1d17fb8a5406bf76c61718e1ab1bea3bc700ad0c1c59ac423d181fdf6108d659bd274fd6c27784b362cb8401f68ed576fa3f6e9802676dbbc2fa7da4ec183a2372fc3b348027230770ebe313322a4c7dcbed0cd388a467ee3c637f99cd40162af8400000005e10c298b93686e31c33988098fb46b69908e2c88e38bcede309759c1738b38f66b4b2cfa467813bc04349b401143315f05515df3552634593cf4ec61dff784e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B811FDF1-AA70-11EE-BCA6-6A53A263E8F2} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2220 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2220 iexplore.exe 2220 iexplore.exe 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE 2312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2220 wrote to memory of 2312 2220 iexplore.exe 28 PID 2220 wrote to memory of 2312 2220 iexplore.exe 28 PID 2220 wrote to memory of 2312 2220 iexplore.exe 28 PID 2220 wrote to memory of 2312 2220 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1aa978cfbbd205ff95456f9d790d0929.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2312
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5256bb96a3bd95c6ffa9843f7aefe4939
SHA1305c219ef244eb439e03cf18add56fdefe5bc2f6
SHA256194d310a46d80b19ea6b3e93879279c7830a3e54e23daa18cfdb478d168d24a9
SHA5123b3295ec9156b89377fa4f8027f96ec7b3bcd07085aa3981ad9c6df955a257168cb645d5bf9e4819c05ae86794c0a5e4b083a6f5d9c00299aaecd39f3c5d5815
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57275d416c16afa4f7990e3ab23c429e6
SHA1cc5fb20ea7239566117c84d8807061fcc6133e91
SHA2566cc62fb0822c74c6581e1ab09c2b25dcc42767e0392544ddcbd24d354621f2fa
SHA51271bf97abe5586837602a8cb3c44448c43fb1881578dbcef187bb13e4348f4e735504937a2460aea78a18548f5dac69d310bb1cf268ec339435d182a5e03b5389
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b342d2ac24406b794d1075ba43e96f17
SHA1b23d6729e0d2ede262c1f516438ce41c95168517
SHA256b8877e406529dcd199288efd3f9f879fa4628e4618aa4a33f5f3ae349803fe63
SHA512d10e2bfda833b258472e69511efa461975972d9e431204af5becf695d9f2744adf091a40606d24e52ddf0e6e315b6f14934e23d018ded8f49581885e4e0988ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af3c32efed33de2cf3f47bc37ae3f0bf
SHA1f174755a0075174398bd630bbfc18d3c6a5f7dd3
SHA2562902e600003f9626b0c5cf162c3a7bd983d83345a45848fe2628808b4afa8129
SHA51211958b6d4fcf418cec0fdcb97a931bc3862f0287d633f502cef0dc7d69df87e550e497cafda111a39c6035f372d8a6eff9e07c08975d8e001131bbbad5aeb54c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57259325df65cdab09f6db2389feb3fe1
SHA145929aca77498e55c8a1298b29c6e997208c16ab
SHA2564e4ceb875466cea26876ebefeadeec9a47c2812eb2cd0573c7de3fbdd28eafb0
SHA512697996a127e8871fb25150a8284713abb23f6158c67365fd59c27e54b004722eae81a47282ff91da6ac8f8bc875b56265acec1aa322fae4979b1dafb70f12217
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD56245eea9c3c27c6dfbfdcdbad3eb0dbd
SHA14d2c1183870d57ad3f7851d39e6b66de23614b87
SHA2564fcdfb80b4b54628102d1d70ebd9f3ebb795f084aa9f552402f9399995ae3f6a
SHA512afc9bece51d5bc65a62f130a10ef5e670a7180eb39c7658c0efc54476973152fb4aecefc0c14ad056f05893b4f715260f00296b16031a71a7b5b6a741b46505f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RU3RPYUN\platform_gapi.iframes.style.common[1].js
Filesize56KB
MD5f6140cf2e81a9d5b9bc96970fe1946f6
SHA1e18cb20a08d0c13d44b72e36e9560aec2187abce
SHA25668cc8a99c8ed5cc0eb3aa2146fd34bee0051bfd98faa3c03b83c78b4a12a8bd5
SHA5121f61bf7228ae9fc1b36249223f4ca0675da05beaa6c00b28b7fff500e0527ee237d139eaf6793ece67f8730dfff0207bf945a848795aab7c57301433449a8acb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\M0G1O5QR.js
Filesize157B
MD567e216a27dda24bdcb086c2385b0cb99
SHA117141c80f5d32bec3691c5ab24741d8b7dd5f0c6
SHA2569dc433b2142d3ba0803fcffa53f19d34da26996d20c829df6d694bc887325dd7
SHA512802319543dc64cb011bc2684004e878a842b73aa55e4da1141ccb8650cbf42fabbf2b46c730760bbfcc7a140e11700244b9f5da78bafe9fca7ec7825c12b4255
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9VC31Q9\cb=gapi[1].js
Filesize133KB
MD5288c5ba5b7001fe841c32f690f62cc93
SHA129aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789
SHA256c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52
SHA512e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06