Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
37s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:04
Static task
static1
Behavioral task
behavioral1
Sample
210206e5328ff14fc2ad4c77859ba3c9.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
210206e5328ff14fc2ad4c77859ba3c9.html
Resource
win10v2004-20231215-en
General
-
Target
210206e5328ff14fc2ad4c77859ba3c9.html
-
Size
29KB
-
MD5
210206e5328ff14fc2ad4c77859ba3c9
-
SHA1
b73213c7f250ddb5e589425be51394b7e4939f61
-
SHA256
6db387495e05faeb82c0aa7be719dda4ee495b1cbbb1d3c55a197911f1bd192c
-
SHA512
411479137b2f21fb3bcb2edb88378cad609de6851c546d805323c24f2e083f83c05b5f0ba7c773d79bc42598d3646b0174298b23613d9e9bd8adaa9a84c11598
-
SSDEEP
384:SiPGJtq924cHx2VLwM2XQ1E//j/cxHq4btIJ40oMIhfTqn3LuWRcu0C7GdoRxT0Q:S8Wz3s0Ou10NeB2U18IueB2U18IF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{77B235B1-AB4F-11EE-AC1E-72D103486AAB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE 1712 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 1712 2468 iexplore.exe 17 PID 2468 wrote to memory of 1712 2468 iexplore.exe 17 PID 2468 wrote to memory of 1712 2468 iexplore.exe 17 PID 2468 wrote to memory of 1712 2468 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\210206e5328ff14fc2ad4c77859ba3c9.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD52b9324a5e270b9971e561fc3698af126
SHA155032da782a433f8730a908a243fce5a315cca74
SHA2562e4070b849da790a0aa2563d12b1ea004225c1b91cd75818ddee136a4c021307
SHA512e40d7431c25170b155781e5e9f0f20f7386640d4ba003a09902ebc94a4291bfde17dcd67c53140bcb46a68018a8138d0cbd82f55950043c2e4d7e90b0b4a9e45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558ea818e7c6789e6092887c4a8eae1bb
SHA1dde08d53d39d4b643c084f2867f83c19e05c18f5
SHA25660a20a1518e5a1e5e19c0c402c5cb0335bc0b3d11643b4d697b03356813771e6
SHA5120621b7fe63da80dc30cdf14d949b08131bff4dbb21a55939e45602e51b93cfa8f3d24263fbe24b63b57c5cffebb9e5e21526d41ef87adc288eba74cc37cc954f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50211ff0c9a33b2fb227d0680b07d190e
SHA1ebb4033ee2381413305572e09df1ccd6af733ffc
SHA256a698356a26c5f841dca593d15c1f1a8cd1cc9f9e00bedfc405527cbb5cef3b9f
SHA5121d402a12056c2d3d07e310fb492fb73017f57e3d766442e82a4bbff449f73ce073c2be0da8abca953ad07003be35141eaacc854e54782d25b61ba216c729b188
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5abfc768ac27eca2df19e31e2643dd238
SHA135b6c0553106301ca0c46fc200662dee5c46bb04
SHA2563125d8db2a18d2eac5f0e99951621cd41e76d8fcc4867dc3a64ed83e795dc2e9
SHA5126874fcc3cc28a4935fca1662c91a924e88a402555effb5455b38ede4fcc6dfa3c29008027304eb8a55cd7ccde3947d376b7c8d9b8f3b0597b18f8b387adb2bac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b642430a8f0f07b317d706db8904f04
SHA1c71123e4a829b8c4cac4821f0cca2d78245c02d4
SHA25689a9d18f301e1b8c59fe7edda72796ec6de9cb7943f3374338408011c68444bc
SHA512c632d989ceaa150909ed84d8487e0f3d833f73a902e812d10deb7d2e6e84c4cc6b4fbb196d122fae98a5b21d7d741b800e60fe4683caf8a89403faf8282631cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505ab6199c434893c00611093f1c39a27
SHA1609ca2ee79646ee215e7f7b4e4b46c94eb317cc7
SHA2569b5bf6c17557dbb83bd564dbe778e28e7adeefb902b26d4809439c443599c82a
SHA512a7b8fe1c0216c344ec6d5b043f9084b715c2d28f7650b2f838a6f0998a4538950e1c9b1bdcf53be22b15420d197cec77e18295b94326df517eb8ab2e5a515f1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e2fe275d61df053f55eb283b797fdfe
SHA1ce47dc295c4505de097d78f96ab9a36e576c7b76
SHA25621efc8525a06b9ea2d2c84e4c044ad70fffe3c96ecfe78ed15b0bb079d631378
SHA512d28cb6b21c0801a7ccbe8fa2e99924d5aa730f7e9d1d1fd4faa733dd32c1ab406da055718c5b6b8b048d6d6bfc47eaebf3b53bb00a3acb8c4d77fe98ede59011
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532dd281f05ef77d7ea56326c30aed983
SHA159c961c92524a6f7e8a29085b59bd5f569ffcadc
SHA2564e7f8412d2710ba563a99e60c8039ea52e2c3cb0855cec46e67985f55c987da1
SHA5127c180c428381f2ea29f2369c3111e0ed8884e8c0ba2237c99c21e22d42a359da8bb3b01c360d66f41588eebd2b69dfcaa7ba90763d362cbfbd4045ca07cfbe27
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587795f9e7aa5d674e514e548d68ded8b
SHA12fa3cb5d6a6f9899c631158f69b101376012fec3
SHA2560e612890ff2080b592f7c4f6fe05e5d1dad7924a47828b0123cccd72861e33ca
SHA512fcafdf46410d67825eb5353cb6e0031d108e26078fb9bdc619ac8173598b95d1c5918014b71344c3a2d8edd8f14715afbd13b415276c24792959e3bcf6a1d2ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56dbdf24aacc610d1c0fef05b096bec68
SHA194a99d3038f223ebbf882d934c2b81a584a95460
SHA256d5de6d17fbae0378c59529fddf0339f937483c8008fc133de8b8c0158e196169
SHA5126ce7240e452bf44cd612488fc1e12e757bab94aea5321ea0c812b56777c78616586a83027d9aff90a4aa710c9c3ab498fc35bdc76cf2722c80407b608cf71fa7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5fcdf1829a2f71a1820906afd2d497685
SHA1fd0f01ede9fe47960a2826a8937ff7f0c130e7a1
SHA2564f0989521f60996167b7bd3de1b63ffbb2ae3e5fb5d326a8b3b6159fe8474fdb
SHA5128d0ad6327e35be3405d62f8e7c26f046b992fcf6f81358d5e36028cd647bcdc6ee6070b0d8b4042aadf3438db9d642cb4883845d7442d823d10c6b8f862a4a6b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06