Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 20:18
Static task
static1
Behavioral task
behavioral1
Sample
1bb1518191a9a07eb5226756055ad26e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1bb1518191a9a07eb5226756055ad26e.html
Resource
win10v2004-20231222-en
General
-
Target
1bb1518191a9a07eb5226756055ad26e.html
-
Size
12KB
-
MD5
1bb1518191a9a07eb5226756055ad26e
-
SHA1
26a463b82a27ad0a539d082e4151326597712992
-
SHA256
e43d78005162503556dbc07411727d35e08fef7b3d45d7d264dedd03fad77d38
-
SHA512
00582b14d8b895e9703025ff3acce32d9456a6e8351a33ad05ce0efd96ab7a8f34a0232573207a279a93f017a76139401351525e75e5cc57907e530dae857d3c
-
SSDEEP
384:sTlIc7Vnojxa/gYLBkZcnY1DA703aguLZ:WFgTyCaxLZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410242706" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72446751-A858-11EE-9201-42DF7B237CB2} = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1208 iexplore.exe 1208 iexplore.exe 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE 2716 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1208 wrote to memory of 2716 1208 iexplore.exe 28 PID 1208 wrote to memory of 2716 1208 iexplore.exe 28 PID 1208 wrote to memory of 2716 1208 iexplore.exe 28 PID 1208 wrote to memory of 2716 1208 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1bb1518191a9a07eb5226756055ad26e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2716
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587d3c1a1e836e46155ad5852da0a0f6a
SHA10552434f60fb9504d685920af6cd226c7ec8b1d4
SHA256f29cc7c07a8e97ed0722d4cf3dcda523da0e942ccac4de29226a94dd65a6df15
SHA51241438c399f5f61a8d5bafe9e8fb2fe3004e422449e64b61ba2e41b32275fe9638a9fc38185148615a6a144f85ca6052bc46cdc5156ae6f1aa4c2ef81e28a5d99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573d0aa75dcf85701b7e6e02f35d435f6
SHA17c51fe78f481e0a7bfb3e79fcdadd8f6094871b7
SHA25682b8d1c4c40239933783dbb9a45d23da2c15d1e8f97d92097762fe25e5b5b921
SHA512c21ebfacf6ce6755abecf5b769bdc1027744fce494e72d28453d0fd89de410283cb584c2bb9ca6e425b544de13f9b3279c798fe0734d97ef9538ffbbc804f46f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD506c79e71dd3b5810d297b8e8017520df
SHA1ccef97d4384bf3c13ddf220ec386ecd676c653a2
SHA2563165344668fe1e9eb8d2bd1cb4695330dc75f4287cee995c2208c4659fb76bf5
SHA512ff5dda738311a7f799af391289854d6008c73dbeb6cd9f9b61e13213fed925052b777824868c98a036607faf40b2908f9fc6e151efd05a48b6dc673d475ce150
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55220a7a9a58eea0d5ee7b2df3a92c77c
SHA1a60adaa1980fcec868d24375d4ca2273654472cd
SHA256fcd0817ac1910894a338602650aa82407daeba220251718ebf39761745acfaa8
SHA512c5647d8106e659f09373f4988ca0a89f3f2b7c56c95f2a5e6be90183bd00ad412cdd740c5e7567f834aaa3a07e85a493f5c649b51fcefe302b5feeb1b5070da1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555e04f2ca0314328218fd41c696efe26
SHA1a6417d9a4232313eaab7fda63411050b9e864d55
SHA256490c95dcb3e54fbb92dcdbfa45d3e7bc791b9b2fdf4f4283323f7144b7e8a0ed
SHA512609aa13fdb3e832ef581bec725a949e1815f87411aebd942e41ef49b281247d2ebe4c8f8890395e4f94baed445d3447b21205434fd83561bf798af03ac42be5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa6075ea775cdf16473a289293fc0b64
SHA10e56344d781402c373edb4456d0312de581484e5
SHA2565d51245eef940c96b047fde8223abe49d9b328b263590c72fc993d0819a20542
SHA5123ac605635b51a05a6b6586178765325b4f8957861f7d3e495e57256b45a20b55d06a2d2f7561748870a676208f53e7dcee032635455e402790a510d24168c24d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fe4b6976a8eec720d15bb1ca89089a8
SHA1b9760ba653c8d9248cf56fcd22e51692db994c34
SHA256f06c42225dd61a023994477b20fe577cf414d409625fd10c747917c75c9dade7
SHA512898fd6c6a73139699fd23dcbc1d1c17a1b16fea14f9f50855e95b7f532b086ac035ae4f78ad103bc7302efb1121565b1a837c7b38602ea95d968a39f6e9cf2a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596a6c570fedb48cb85d13d52183a545a
SHA13778df2e8b9ec0e3c4f33c735b6422f570b5085f
SHA25682844a5f01f70752b1f80002a27003efb798b5252dfe537a345c36ecc5df3e7a
SHA512b3a8d39cb1f1cf39ff592bbdc94c8af4c445bca52bec1a6d683e0aa318fcfd17ce23549edde9e569a8ae0be7cf0b96d36156150041d5d63b1622f5f4d0967774
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5109233b308068e79ba11eede206b7ee1
SHA1168777c724f2539090ece4e63d1df3e0671bc493
SHA256054e6dfec34527cdc58900007d9a1dae8fb8fb3c2c82d4c980efde43c90391de
SHA512c0535b841d70060a7ce72b83de2433a338e007b5ef4668839cbd120f8c0781d569fbe7fa72f1e6807a0c94a9bcb65fabef8e1f8271e6ce6519e8b3efd3e6aecc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf50a4ca13c68f6a1d3dc4b54fc70e6e
SHA128478406616057062b2e34d897f9a1bd0c3e0f89
SHA2562f10e0198f570dc37a8e435fb3e862fe221942c852b71fdab44a2a6e512e9f57
SHA512d8a4cbd4fceb9467f8689f65a806fa655e69db422fc6dc6922163e30442ca1b8ce6ad87233f1e8db5a0e68c277976d4a135612d75738b838628bc1a790a9183f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c3331cdebc3e828dafa603df867d48d
SHA19d7e8a961f420bc932c195fe6a3a64426b1a0efd
SHA2560753e9333a40223cf96c8b54766e587e397069febdb68f182f65827d9bcc7d3f
SHA512243490adcf70751f36f7be8d5bc1bd4fa8066bb2b147f7c49d83c530195753f95b61b9d8d2b50d0e8fb4f25ef53416225c149e447c1031425900020a3d3fbc26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b02f9fde24df02714ab03624dec4d5c1
SHA11952260419c9524c1902234698232022a76b4b80
SHA2567fc608a6cafabd786ef69416f8d3829b59ac5da1a30805d748dfa07d7dbf667d
SHA512388eb044187c049757d164e90fdb74d58ed0147e33f6b29e02cc483f34fd9948330bb69635a1a8467eaa7f829a153b5c7273a28ed5af994d57da2d24029db865
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f81dfb12c15651b1858b4ac853324239
SHA115e32aedefd2b1d453043dbf287a1f500ce7acb2
SHA25646263f20ec1e3b6f2370afcac1401f9e44e400434c8c8e55b7cd6033b6f9259a
SHA51282dbf92cbc2ab8c6112c400eeac80de44a7b85f2aa5d2674d54cb13c2d55418693ea3984398dd00c1b93f9b86936d7390f52835de08b05e89700979712748865
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06