Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 14:26
Static task
static1
Behavioral task
behavioral1
Sample
1b6336caa551cd6fe4d7fc230f7f86f8.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1b6336caa551cd6fe4d7fc230f7f86f8.html
Resource
win10v2004-20231222-en
General
-
Target
1b6336caa551cd6fe4d7fc230f7f86f8.html
-
Size
170KB
-
MD5
1b6336caa551cd6fe4d7fc230f7f86f8
-
SHA1
691b3bc1700139828dfad6b96c1d64c1d326d790
-
SHA256
644869de905978da8d62c6945f7834450ec159f6403b986b603791e3b2ec4394
-
SHA512
6d47c515dbc4e940be4af246d90feb58bdec362f5addaaaaf52aaef76e98216cb6dfd7a02f87c6cbc2da9ec4105658167465d9530315c5cdfc40a83b21953988
-
SSDEEP
3072:xpqmye7vLFUAHZLnVRcZLoBzuiG8EPAq2yschZLOZLGAjVkmZLjA2GJnG5z9cG6s:xpqmye7vLuAHZLnVRcZLoBzuiG8EPAqc
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410237398" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d78000000000200000000001066000000010000200000000e29455bcd94dfb39e41a4647a0b526c0862869a0329a73a680e42e8eff7c36b000000000e8000000002000020000000bb38f88cdbd56ca5ab8aa091a6ecfbbbfb3e17157dd7b1bdc0cb12d949b1e29620000000f5a5d47d07535e12adbdeb95764198912192627da9f7db41c9a8d968176f587140000000ba14c952f58442de4828e48a99f8f2004eff03eec3322505747b29c3b321a8028f730b49c1fb7b2dbd9f527fe92b2a3e01a3b0b6f538336b8f56a053c21dd29c iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000099d0b958710c99fe21bf062f1f2e19e3e1c5f474252471836ec481fab91ca55000000000e8000000002000020000000cd33a113bc14d4000c44aaf596a4b236d374829bde79a9cf1a39a8640a04821390000000cf6609a0ca510a3c7a11758de0444067c68902dab5c934ff06c75ab2cc76af3a1f850b4ea3514cae9a82ea45d13c1266c397f687dc9d14b7d4cbe5be11bf55a8a5e4f7aaded1b0ee05e0953d480d566c4b52cdfbc3426e499a54b0999a10c04af5b7c5b1cd1d2f00f615a245d0b250bd272448dbd7467c1c06fcc50f6453cc987369dcd295e0c23cfc74195c03c4d1c2400000004f535287c8770d5c1ac9e90e4ec3bc94ae6e5a484ff16e4cc17f5c32f5a3f1a433fe620c1fdf9b90475d728bbf171315d63a2ceeb69f69b590a00fbe58b5cd37 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80547cf7583cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{124EB911-A84C-11EE-B459-56A82BE80DF6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1068 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1068 iexplore.exe 1068 iexplore.exe 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE 2184 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1068 wrote to memory of 2184 1068 iexplore.exe 17 PID 1068 wrote to memory of 2184 1068 iexplore.exe 17 PID 1068 wrote to memory of 2184 1068 iexplore.exe 17 PID 1068 wrote to memory of 2184 1068 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1b6336caa551cd6fe4d7fc230f7f86f8.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1068 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a2e61107903a648281ecc42dae245e55
SHA1901ed7b76eb667a275d61a0df9a9078d2d4e055a
SHA2565d3f46ea3cfc4c23158a7bd3a9df88565646a2cd8d042e5b7afe835293ff9d2c
SHA512d68dc2ad58948543938f307a02e35bbc9a02fd91dbf719d1536dbb559b268a814f1d770ef7b3af6a4349612666b051178f57f0a7bfa27e76511c865807278ceb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba5f3b34036dceeb3a2d37385c24f07f
SHA1e5f261b4a3e7d96ba3db27e0d5d89683fad2d958
SHA2562eeaa3f26e5e5bf1dd2f47aad021e8ce042e4afbd6e66e34f31616f434a6582d
SHA51212d7d6b5af5737c0ea5d3cdf562fd4be321670957f763aac9996235c1c5ba9dd5913e66094ad6e4e52512170e0a72dc69f033e85ecc75fe032255da547b3e276
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576d009d52412ea7cf80c252ff0f01d1c
SHA1ac2b3576efabf9c2985e7dd651a34ebbc0896b4b
SHA256f7e05f8347cf8b3c3d643b710d3c85a28dbde48e5914a367377598747cee0292
SHA512b3ef9f6d25946bd081ceaa691a0d0162666afd4f633f2d4315ef9272658c5d017c2443da9ac362331b8f6c6ac039089d7afcd1c2e7a7dac846932a4c58ff77b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eceb5ad8b9557a234f33da6b485abecb
SHA1a8fd368470c38cbd3fe6a9e57527aa0ae58d8f13
SHA256128077a88123ef0222a822f53b702ae1724cb2f14f2aa5016ee186494d108cc9
SHA512cad548b12721d8c3c512da23bca31b3f95cefb18e5b242fa7fbd9448dfc2c43c9aead7c81feff506fa1ad05731982000e9e2c48bce33f4d0769921b12d05f488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55899c0f3f29162d0c06218a7c2867787
SHA1535387cf341f80529cdde7d2bd09fb7e0f4ca315
SHA2563a2bda42ea77963f299ce184098c4c609a164fa07816e6e06e2d5d975766b1c5
SHA512b7cec307b0b24d2de1b5896a4a4f7266ffcb596f765cafb7d22ecae6bbd28e1947445e7c51637982a490efc3899ee24bba53e25632578bee1d20c73648906adb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e1aabbf25c99993dba46b2a0cc40cae
SHA1e5691965cbcf3833e0fb0fdbc045a913bdc172c7
SHA25648583528b0f1fc867a3d0919e23aeea0830202ef5d1516add917e224a332959c
SHA512b822564259dcbf398755dec962e0455265d01310d13cd421127eebec2a2354318aa71c24a0ebbe8ae27112b8c0324810c97393d4b5bcf18945d5eff3f49393b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dda7a8032dcde47254d9083098a3ff8b
SHA115606f03ff4f5ec94fbcde2dda7546f47fc9ddc9
SHA256da58469de6e3dfe1597958142404fbe00ddca973f94b1b37e928036945715a30
SHA51287b51e228b5e9888d06c2eca685c53eb2e4ab5f714589c90f91f3bc5ab8f5c5a29c0a3cf710fe476503e040035e688060de27fcbf4b40d5e45d313bfcbd5fc27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ac1470dade6148f64557e68d0e7c9d9
SHA109edc7ba91c58cc164ae9ea7dceba13ed30d5c7e
SHA2567b15840273078be452760e0d05e4681c0ac7e108ee67fd1ea8e45e985ebff2bc
SHA5121dc54cfcfad892198a90f319f77560fa5185b35a92ac8c902443a9fa9872a28d960ee3d652d7036f468269ed8110e228ec0797b71762a3592f762480e80e720d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54dac9d25776166418b53896f48276e61
SHA14c7b28ecf601909a42614063f7c1259c720fcc6d
SHA25639997e45d542913ff4207da96c7d7b2880cffc91223024f4db55a84975cc801a
SHA512e5477a785be265d5c3b650aa97e8d9cd21170a651a24bae01bf09c8eb2fc7bd17e8af5ae332f441e7b8a9be0a72de91e7bc1229063d4c33f7221abd9b082784b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD527cb99cc5c0b4070716f56c25425cdc3
SHA11153e7210fafb11bb9257abd3ab7d4448cb31510
SHA25624a2106c502c593ae510968c44136ae31d256149be8dfcbd3e4b019bbcd5919e
SHA512bb2b1040a0e64a095589d94eadd2ac5a297c4a49847f84c99fd800ebc5844f35749a2acc047479412212d3ca3fe9d745337fcde040d05448402b97f9d6327d1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53474fafd1ff4f349816333c6315ac982
SHA159cbd433d3250e3399317383eb425ab75db024bb
SHA2568f1b96d20e91a83e69a7023458278439845236bb3b83bb02e5fd192ec51051fe
SHA512dad8c755fbd0084888847b0d9aae66f3d3bf8693ac9747b8c932c2f73fbe193bb99216e54359941fec9e1c92da06f074d274ab8a39b8ca85f116848ec2f95c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56736215b1ed5199601518750bcacf514
SHA103b1e23571e49b3ba226eba8a88accfb67c2817c
SHA256ca04f901024566c1c0b13427939ed52e43a31985b4f6acb9ba77a60d2880cc2b
SHA512c0ab9c9a8e1e715a67a4a19d118c37c4ada414cad86d17901e3c47a0c07aafb66c3f31f97d041e622a2696b008c1ab21008faa2f12b81735b4830948f34e46fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df0b58a90b1588994668835b28a08e34
SHA15a682628c9ce99df4b55b3bc70ca043c2c12b683
SHA25642372409d4db3716959abf98cfbc74815891e979cbf1dc104b095ce7cacf0e97
SHA512bad2b083105ff8f61bba339990a84667678156ce65e73a483fb401b1c889cfbff3cd1b426da795fb7e15f04cfaa9d095ab8cc532fce77baae174a5d2c43883a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD577ee6c4f0889808aff89c509a5f7fb3d
SHA1a18bed86a996b21635de23ea69437ce268b880d3
SHA256a0ce795f774ce6537aa6395a831573ad71c52c9dc662eaf0d18d90e391aa07df
SHA51205bdf42fd0a52209d670605446ac4ae09b0a3f3765c4cd1eee285ec4cf84f124c2b26f10e4137a6201b5102d9b72e8a94a3b40d1f88799ffdd3cbb95325809c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e