Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:26
Static task
static1
Behavioral task
behavioral1
Sample
21a6f0a2ddb914091b2f47da4a68a716.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
21a6f0a2ddb914091b2f47da4a68a716.html
Resource
win10v2004-20231222-en
General
-
Target
21a6f0a2ddb914091b2f47da4a68a716.html
-
Size
28KB
-
MD5
21a6f0a2ddb914091b2f47da4a68a716
-
SHA1
e635bdda2ab9bc18011e47140380b979135470b4
-
SHA256
98e55532dd1aaca429ba7ea56e4580649f0088af02449955914ba0624b774307
-
SHA512
d23709e9fd9909708fae2f276d585a09a553c2da46d2606f81b6f20bab36849ce3e4afda3faf74b4980e5ed681e1678c783ee04ac75d4adde1fbf0e96f993e2c
-
SSDEEP
192:uwUND2nEb5nvEhInQjxn5Q/jnQien6Nn/WlInQOkEntZj9nQTbnJnQ9eoym6MIm3:vQ/oIpaAw60Sjb
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410573310" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E0C7231-AB5A-11EE-94C2-56B3956C75C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3004 iexplore.exe 3004 iexplore.exe 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE 2380 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2380 3004 iexplore.exe 28 PID 3004 wrote to memory of 2380 3004 iexplore.exe 28 PID 3004 wrote to memory of 2380 3004 iexplore.exe 28 PID 3004 wrote to memory of 2380 3004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\21a6f0a2ddb914091b2f47da4a68a716.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2380
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58d8644bc4364c319f8acc10fccdc5b01
SHA12f4a271f67dac766cf5010ecfec5ec84d4a9bc2a
SHA25610e5a32a009f27740dd2987dd0537b8fdd8272c646a4ce9343fdd650ca0c96cb
SHA512399a47771a6e59032202eab4bbb5628c97068598be2d2a79dc0ad86e8d0be41f02b2c7f0603a2f0faa70047f24b078593e03ed6adc14d08be2b9ed3af8fb5824
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dd65b988df274610e08035df854ddfc
SHA16ab4bf21f0ef396e4cfc4b951b1c2b3ebf62d5ba
SHA2567fd9f21fd9cbb56fa39dff3f89f51c81be60d563eb23ba2873b376668421adf2
SHA512b1dc7cd50bb55e37d667bb1ce9772e855e5908e7b68b9b56246aacf678238088649f473c1c34494f0c3d781a8758f2abcf5786c7d9302b0bda36de9052372cf1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e6f72d6678751144d80d2ee06f424eb
SHA10a1181fc681678a517c053ebb2fb2b02e408b3ad
SHA25679081f09962be432210c91635320b842ced732003d6bef014c84d2e594f2ae94
SHA5120ba8f0deb0a8d3254b51d1bf6314c43a8a00fcd6f6a009ede6aceb631770a626c95b7e7b685f4fc0ac79f560790f451d858e92f5ee97b91e1a9c875afcd4d9c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f70c94c492b8e2328964364a25813ef7
SHA1dbd3bacca3744cdf900f509762770880feb20ee3
SHA2569966f6c0a944f10b930ce459e4a41bed262685baa81cac131639d55d446995c7
SHA51217a6a2175773ab0b5f5f185d1716cedfaca5fec0e97e438181a536d04429322f9fe1b347f5a4d04ec1aed3ee52304670a3c7cc64d4e0fb0ec9b80225d159f933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f7139e87b85895cdf30b1ed259f598f
SHA1eabe1cb4621586b9d4da4e94bd0052ea3a63d7b4
SHA2562feec885e5fa46b2f82f65c855b1aeecc60207ec77caf007c60c2532ec38da5b
SHA5126a2afe8de00108cced12b1bbe41e79d575ca3db6ab00fe7e71ef085e3adc7ac2715b959fd0c8ae077b1651ac73154791866c4a6ca06e13f77eecf397ee474a0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc05cfc1b5f12bf2541d49ef672bbe8
SHA1e96d9cf8e6055660726c16f6adbd00cc0369e03b
SHA256ea92df1cf9338b4b2d0d09063acf118499f63a9261e23e9722b52f7d23ed139f
SHA51263addf172fab90262a356e1a0e86d8ab3987fbc0add6046748a472bc2283c45f69b968c173239519e7a21995d869b35919979ea5fab81b2b2d0e0f97ffe622ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545d2a18cd5c3a8b8e1cd14152db4f5dc
SHA16da144a4489b31de7bcd35052359c942a48468e7
SHA2564ddfcc19783a3cb892b7ae06065c3744a6be9d795e54d70c0d18b3e4ebf4f572
SHA51253d30cabd68dbc64b7b6fe82204603acdf2ccfb60cac8f45c58c8bccbf78f9468d37ca7313ec9079a9f3b7e34d063bccea409eb25c44e217c6b25189e60dc5b2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c5e1c60b2056e24de8f785e7eeb9bf8
SHA1c71979cbb44c9bebe73fcc5298e674278b67dbd2
SHA256b08bbbe9d52bab537a1301a6821fae75750c246632320de878e9e20105588137
SHA51281b6a3767fa4c1c21f9bb99743810f9d75d5a06e589830fbdc419f1710d123dd4851f3b5054af2336c5d9964874b238353eb2118eeeb759df011677318f9443b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06