Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 01:41
Static task
static1
Behavioral task
behavioral1
Sample
2321e8b43410f411dbc14540bb8e04f3.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2321e8b43410f411dbc14540bb8e04f3.html
Resource
win10v2004-20231215-en
General
-
Target
2321e8b43410f411dbc14540bb8e04f3.html
-
Size
6KB
-
MD5
2321e8b43410f411dbc14540bb8e04f3
-
SHA1
669cb7ee88b397ee3a2f0bea1bcea6fc77acba41
-
SHA256
f5caebb9c43643eb7dc5e1197faf0f8161525241de91ff6a671309a5c041a341
-
SHA512
629456b2b56ddc73ae7379282565fddd3d585f90b08526f005630c5825a45466072989c6a2bd78189731f7fcd2863154d1dc2c640d9f645ab84bf5f19103706b
-
SSDEEP
96:cuvXr5k9ZBDZU4ci0w9iFcFbv3XXr5k9ZBDZU4ewWVTaTxXr5k9ZBDZU4cS/+xXF:culS0FcxtS8VTaTrSSSYxeCZZ5WS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410583531" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d09a3ed57e3fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FC974411-AB71-11EE-ACD1-56A82BE80DF6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000074ee7ddf18840f2de6e520eb7c996aa459fdb66e986f60e06145857a8d83f068000000000e8000000002000020000000deb11c0a00515950ca761f97f6b632f0cc30161389327967f6c48a9fa2dcc31590000000ac28f51453e9b0bc4331c16c291db2531ffa53d5d206f7283e6edf0dad223a986f0edff4d2c95a4fc3cd082c9f273b4056ecbecc4805ddaa94135bd0578612d3b99b3ea347e93ca6a0f97fc6749db47b18ee1dd421d5ea6f5ed2ca998367c325ca568f1d50566f55d1fbb60223ff12a409a61a2982b0452c566aefa2abbc1f8e85e959f60dbc32458248a18d7e6cee8c40000000d9a6d96c540da6b4d0f39ecb5d77b8c5a3bd47eeb287b6d1378a2857eeb57374bb98e7c2b35094a15fd74dda9feb2056c2c17cd3fd39fdf3d96e3a3c71cf1c02 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000021ae85a3b5cf4a627a22eb40c066e52fe18fd49ae60f0dd94a6ba5ecf373ee25000000000e8000000002000020000000b772acb09ca6a2a06b57160f58ffa573920013ff83ceff75d22fc77251ad34552000000072d64b4007399be0750f89be6f6cc14df42e8d3d2a1640f2a8ca843082946a7d4000000081204e3c8307c9aa93847ba26531a4b0424aa55a191e895d35f785a78e2f971bf5df3228ce91c9ceafc72e15a378f8522f5048e2a6e9ff57db74406ab19da5ec iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3020 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3020 iexplore.exe 3020 iexplore.exe 804 IEXPLORE.EXE 804 IEXPLORE.EXE 804 IEXPLORE.EXE 804 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3020 wrote to memory of 804 3020 iexplore.exe 17 PID 3020 wrote to memory of 804 3020 iexplore.exe 17 PID 3020 wrote to memory of 804 3020 iexplore.exe 17 PID 3020 wrote to memory of 804 3020 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2321e8b43410f411dbc14540bb8e04f3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD505303236a72ea6ce904e8f15ed06739e
SHA111aa497f573b867c4076a3908884b84822f0035a
SHA25696b1f3ae3b2f0b6dd66ddf63f43d45f3e1b3d2a28fee4f816c49ac7ec1764059
SHA512c5f07e2d450f6d5dc448da32134771bc99f9e3b6c3f87e7fefa139d618c42d1cfe20c9cdf8e6af67c9c3694ce1b90f95f7b21eb3cb616a0dd9225f79ec4d31ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5165e785acbdabdf5bb290d17933048a5
SHA1a8dd4494ec20a8adb5d0c99bd85b65b3b3a6d20a
SHA256dbe53dd30ad1a50c1e3a7ff8877e4fa88110e647860ea5e11e3df6b858e28fd8
SHA5125d4f4fac3fcd4d0b6d560bc923f4101bb06ccd142f6fb79869f628c1ca6a983ac90466f56fb159e6ee76bb51695b5ffa6cb1df569fa94925bfd724b5d800de8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da3742e2996e1115d7efeb1c5100f3ff
SHA14d4ac91554211c50ed764e370772dd3e84bbbe3f
SHA256f22f61118b64f38a034c0edb051b2e76e19d09f768ddd92c3e02599ff2bc8428
SHA512a4e9bee11ef04f8f669fbc0e9b330fcca53019f60dfd0be116f354d9bd030a387635452cf02810adfd133fce3fcd93456546ca01bec9ea05e305527370289d32
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4609d08295efbcef80ce684269ef044
SHA142d77eca88caedf77ce73d1c17d9f9e0d9be3245
SHA256e87808890adc0224215e6878e63a94592b75db6c8bac097e542e8b790c328619
SHA512b135d62e85fd388322b2c74767059dd517dc804ec891d6d2f2b651e573e8508e8cbb52d3e358d568de96f03083caa7b79142bcdd1f5aa61112dd4b5e487340e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5623aed8076d5479d52b7780252c37931
SHA1ebf928df2e4e42ce8d72c4ca973342b016376eee
SHA2563dae8158b9caece2c2d679b29c23bec0de1ae156d0ab083d5eea0c5cb4a97b49
SHA5129cef45d9bfa3b0480f22759b5ab2d542e970dad96a76eb9350b96738bb924012da2e97a38526766fabed1b6850a688f51814349e12daf7b01713f970eed7ff96
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561a2346a36cfa33b86950b418dda514c
SHA146daa6189fad2ea6aed8237ab026cf59d966a071
SHA256d3981228ae14d394eed04546a5d09532a5839f4e249a2a086230bd9acc32e137
SHA512f258d9ea536922f32b00aba0a9601a4233b1ab2d1e95d1ba8d95a4ebce231abc703e8bab14bc2cd0152c2fac71691b15e6376c23e6a83f09b8d3486951dca966