Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
1c1b796f8cd422c02f6cd70e5953ec31.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1c1b796f8cd422c02f6cd70e5953ec31.html
Resource
win10v2004-20231215-en
General
-
Target
1c1b796f8cd422c02f6cd70e5953ec31.html
-
Size
1KB
-
MD5
1c1b796f8cd422c02f6cd70e5953ec31
-
SHA1
f9e7451cc4e8ce23739ae19422f8a7f9c87a4f42
-
SHA256
053899e59fd29ce93b7d1f5e33092da2594d05643332cb3e077d84e74801c7d5
-
SHA512
ece6ecec01584d685ae6cff511b66dddffb8f4981a9aca757bd92cc50f54c0739370b87c1ce8abac546b9ce8b7efe1be577a12cae89b2b3b6cce5248db50266e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A44C361-A85F-11EE-B1E2-4A7F2EE8F0A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000616463a5e41567ce47acfb974a06c1ab8703b73f854e6d9d204b4bc6010dfd82000000000e8000000002000020000000e798a0a6eef6ab3c94c0f3ab3a42c6accec9b4bc36be3f7b6720133a434f3b5c900000007b4ecf32332ad5d532c4bf15dd855a5545d95d24519b19748a95749ac106d2c2b4da69f84c475baaeaecc76455f778a9a5917b1fa1733a95e92ec2e6280ba27413ded0057536337aa3902bd1e7302ca831877284e6ca4f891945c886daa3ca31e8944ab2865621e8a246220f4d1b2a6254b33f1c3dc34b3b47c4578335fd8b4555b20acab4792e3c14320c68f71aa0d940000000b5cf5c4bbe5d6142c8471a220d6dacaa0fac201e3f31a7dedae438bff3984c71ad8cf12d11c9d77c63940dd85b310aee2af1e1bdfb61a7629118022a7f8b33f0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410245644" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 102a5a5f6c3cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000a7e9d562519ed50c0d5c42d9e8a36599a25acf4f9717ee745e275f19978e22e7000000000e8000000002000020000000f2aa33c6ccfb8d96e0a788ad9386e98b0ee204d52726d6165eb866aec4c54edb20000000b252b410c8f1c0e75ec4b091883a616cf93b6950761e656164970b21258e98544000000001b5245ff984b14c7c383da9c5365f80136c8635983cd775128f528b7adedd44afe90658127092b140f1ad62852766d64492a13a389ee740657312d10dd90713 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2144 2112 iexplore.exe 16 PID 2112 wrote to memory of 2144 2112 iexplore.exe 16 PID 2112 wrote to memory of 2144 2112 iexplore.exe 16 PID 2112 wrote to memory of 2144 2112 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1c1b796f8cd422c02f6cd70e5953ec31.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f88d62bcf2ff53c74b584b3fb87807b
SHA1286169d1ada271a6ff67655568c6e003982d8d69
SHA25685f52565b9b1593a39b1d53abf9c8dcd137c8fbd4df847e81bb8ea2ecbb65cb8
SHA512e9419ad0b88a25188b4281abbfe5b57c58f290da6bde689f36675b2d0acd2726e40f6108f9f79cc2a084ef71d564e1dbf990287bec67a4c9671813e7a4cea417
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2284629543c749308ddeb7470301f93
SHA10cf60cf59420a761554b7e4fa89f98f30ee449db
SHA2569add9d3263829f148f4f10aad5ced49731eadf2c64524042d4a03a60045bed44
SHA5123dac35b58cd7bd301b200230212afb7634f7e5a52c8d1ae194ecc094b5dde1370fca0a8a0bf37f2a862d4b28cf4a954d01104ebf375c1631d9e8daf51bc02081
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f698f244b2503e1d2014e3a9851ea32
SHA1b1045ff42a9d8ee5eaec573d6e00027e3116f78b
SHA256585b68884d27d426ea992a482d9d8066fa7ed372568d63f9e26a451ba87b1dbc
SHA512162c237aa087cf1815e27dd8e801ba1ace57b63b6699b8c97ec682988f02efadf59bb4724bbc519b7784167c18a344ecf41f2830e883f831638c683fef558aea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4817f0f7a2e80a7c6876712eefffe16
SHA1736e38fcfc2b1a61a565184a463befed82b1ffe8
SHA256dffac05412975ef1d14a59a3e34cd31da98a4233981f7778a0108e74772f93b3
SHA5120234862a76627a44aa77394c0d366170f16dce01f1bb7c2bbf60a37f0af539e7af24086bfff9ae65727d48ac267f1f5e19d90284a07ed4eb81d02644d6f9f7d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e265f3db1c90639cccef02f9c97b965f
SHA1ee005566ee8e01ffca6d71eb7c5f464f0ffc54d9
SHA2562bc0f61261cb31f9bde7bf4de1ebe5bdaac09bb80d4a2d0f86666704b1a599d3
SHA512207c7482540c68fa3aca782d2de7bb966dc36f45f5cf6af685587ca4a5ba72d66c2190a6c5bf50269ec7ba7ddaa9d84013bae52bfa3094e801855640aa9c356b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d440dbd2bca8e50affcfbb2fc5d2ad61
SHA181fb03a88ffc975e5b7ea8b435b9c7d80d86ce75
SHA2565f361436f57330857ed8333e74f5d235d80b5c494e560b4bbac55f8f84689177
SHA512176671eedf4017881a1944b3ea0dd31be00fb430d0988f1aeafcff1b7c579d2ddfdde06f26299905981180ebf096c701a4b42efa7e72500d73d84ff89b4c437a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5985c8fe51f493b5234c1da127226d536
SHA1a479c5fc66684841fbdceab74e62b850cfc37d49
SHA25615d29a549747d8b4297e62470e2bed1f75c809a0663f5f4db309c54c435e14aa
SHA512d271845dbf523479858c84de46bee81f93f796e1db327836ea3e6b2ab791b80e5edff31a0e4b73faaa3d2d3c887b3bb8ff6203fc846fdeee931099ae4305d0fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b70de242ff2b2b854f1b8ef8332d049
SHA1f5e54658aae04725967e9237d13eb38d9429dcb7
SHA256063a573e2d82c370535c5d677e456f16ce5e22a9924cf208728a938bf8be9ad4
SHA5129dca8150c6cceb0880d0b6bf2af7be1694a4fa5e50af9cf022312f44a1dd5f5f67391c445e05a34944e8519660993d6475d27ab663682b834f4f3761336999b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56189621c7db5f12173d3ec18a349c811
SHA118439078e6ac8ee4d7b9441429db0ad44d753110
SHA256dd31700dcbcf8dc05d4b79748a967d90a88c1b2ff55c289fd2171fd51ce96619
SHA512c348a4bee28985daed762315edbb52f2c48cf6ac937f3af168d84aa27d537f80797c53e6411d18bcb8e1a8cc78d6738474019c04a574959790dd3e7aace0441c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06