Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
2257137f74582b067925b6e819fd57a3.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2257137f74582b067925b6e819fd57a3.html
Resource
win10v2004-20231222-en
General
-
Target
2257137f74582b067925b6e819fd57a3.html
-
Size
3KB
-
MD5
2257137f74582b067925b6e819fd57a3
-
SHA1
6c69c84a9e545a70ee23a8c7e1e2b0190c349b86
-
SHA256
c73e8cc4b273bab33a321581a309668027598d8c465c198845f2b692364811bb
-
SHA512
5cf232d3b0025dc58a84e1b8e20dc5369243f257dab7a2500bc84c666484a52017a07b9f2685b49de8945d154ddb746ca1efa48ec20da0028a9eefbf80669d0b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000008f0e43bf24177ca551b46e30b0597eb06a8f030e4c2e987beac1c0766cc123e000000000e80000000020000200000003c8bbf2006f2b5d19560a1fab1202d2bca7558d807941bf46ebec1c7376da14f9000000072b376a758267dbd09db0d852dbbffd124f35267b840659b5643e2c8386ad5336e85e8dff56868362a64e79115b2b8836821f76578234cbdd13cecd19275705faa6db8b683f4d3ead43e33029fba9ce7f62f7b78984dbecff3b97f28462be273de93b4b5d4cead83419781ed92178b6482f4fb2d87b88bdeee335fe39788ba257f442ad186c26f008855972939471f7d400000000a5da6a9dbf49c1e4908c6bf69cced9c2b648bbfe076f2ba50403e0425e28896bcf259b6a0db983dcc4c656750964897d3bba13c68d67c849299963cc2ef3269 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00e39fe0713fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410577966" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000522f135de60920709d00c3691d764e9ebaa8956e9de3ccf91be79b7568afa7fc000000000e8000000002000020000000cabf7dee94a186b9bdae0490504bac9760805a3f96e7d4baae4733b5dbe7e9ed20000000e7c02e0e8ab93e17886d10087a7a0b6a97f60f649d3e9398a435bc5f8bd9d32140000000c2040a2c200ff4a9ef6f266171463d5bc56ea732fce3138883be54905252ba65b32bbc109d51b20de18a4ea4b563483d9a5934d002875333122ba8b1f2852d7d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0831FB61-AB65-11EE-B49B-CE253106968E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2468 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2468 iexplore.exe 2468 iexplore.exe 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE 2220 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2468 wrote to memory of 2220 2468 iexplore.exe 17 PID 2468 wrote to memory of 2220 2468 iexplore.exe 17 PID 2468 wrote to memory of 2220 2468 iexplore.exe 17 PID 2468 wrote to memory of 2220 2468 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2257137f74582b067925b6e819fd57a3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2220
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cac2e5c21121406aaa9ecbdc2a3f63c5
SHA16438a89b7eac1793437a4dbbf84d369ed3cfa4ca
SHA256f044844ec4faf62afa1e4df5e989cac364cb58e4e8a45774f76eceeadda2fc91
SHA512f60683b5f49eb07b13ec1ddea031f533436db39f15ba6ba75c90e57f7618ffcb0e0bc53deb6429eb20bf0da66d8039ad047bdb7011e2c71228dc94c8f07e6b39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52338ba9032a65405f8cd815ef5471025
SHA1186b0922ec6375b644087902c45063a1c026153e
SHA256faba42ebc4d00b49405d680d5bb70baf035b769d0ba2dfb2c5f6a3ce212dd363
SHA512e1cd20e72ea06fa2ab9116b8f312d476bd30fe574690b7df8adc4d05db4a4b1010090506cc2a490d6f20a27be97b6569e116898b960b7c1d031cf0530617c96f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce04a1a3e1c4c9bca94a2f20e4b78a0a
SHA1640e78ae35acec99323ced5cd20a3f72f3361202
SHA25622c6aa9157b68b64edb767f3fd8e862788df254e9edfcdbd5610747a000784bb
SHA5120e5911223b686887629ed337c5c76dcdc5b2426d2e01926feea01e8ec433e351d565175e8e5bb458770548fbc1c59756fbe73484d7efcf50a4eba1aaea628712
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab3cc64e16a2d6f11f10af35162831e5
SHA15f044814220a0aa0c51277809deb426202497390
SHA256e6c9272234c89133968a98c01d5f822af5206008ac83f450946135284725a9b7
SHA5121c97e36a7c51a3454ef56b47c25857c558444b4b9b52eef590d05c800ee6476241a521b9e006a966eb02867e83454fdd0084313bccc373a2fd3c927b06648d9a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1f63b3e08512f121c84ef4a16ed8055
SHA18fed0e42d3301fcfc8b6fd221c26ce868d2e6a70
SHA25611845eaecad91bea2aa3a0080cb5a56581caff56b2524ec44b4ddac81116c80b
SHA5124e57eeeff5036e4e77a5d678ddea8c5b259a3d389b3e1424e226a0b2d16df13b0d267df92ef24097437a2759048d49698a814b60a55e3f0d4f823e4d72b3f157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2e10c3a5f8094e7bb5753087f27369a
SHA12ab50bf3e794c27b94d3cb518bc059b8af829e6d
SHA256ec24abc02139defeaf63f3d39e9622c0f88778dda71838e16d829eaaefb86552
SHA5127297929917996212883ce1e2b9c5f4692201e8dafd684a17802e8f46e2216b2e39d730d26eac5fe8ddbcd695a75bf03857874b74bb00ca15c345a8ad67ab1a37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bb808917538358a03baf99f541eb9d7
SHA161241f43e707ad1ed07c4a1023122cac613cd958
SHA256eb2714177815227eedf8f4e6a4f5aa09f37f68724f280719bb00f519a738b116
SHA51299bce304b0062e8221050b3b8712494b3789075d8a4b2a38fed09524f7cb1c34616530fd5c7527b3f1e0f6ef8552f9bda0f258adfe1ea11ae806f2409ae6a4a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD539ea6851777e0f88d38cec98c265fd4f
SHA1b7cd7fbdab3629d2036a879dac3f96df39d9a39c
SHA256c842801b492acf336f3498aeb3f3516dd7af5f854c04e3e3ac9c557087b1301c
SHA512640ed43dd69c4648cbbf57a399f48e15bc232fbf27634fd89a95a575361b0293688f0efb863f4587bc9caf5b912f88da8fe92db4785024590f0440d7f3da6e3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5779f4b92c6dca006e93ba6aabfb684
SHA1bb7ad7e2c21de54d29634a4f5abfb403abe138f7
SHA25649aa6db7f0e537b291cdce8aa319bc818b860b6a29d9569c4629a88f8a2224e3
SHA512842a0348e255f9595a574f2f189acf7d23f16ab1a26a2d4fc8e08d321a2da9b22c94403d97c475c9f8877e1850e159cd0bf6ec9d16c14f910ba63d50d9e50ac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2670ab99a26e4beb2dc2570d1a9cae6
SHA1400e4c93d817dbdf3816f6d92614cc0658233eb4
SHA256ed21d1b86202af3e450c021f884b8d0d556b87e518cb68bf756fe12f28bcf4b1
SHA51240612be8f381a47866b199d54efd9a3785dfa9acc7d8ddb6d1f31e1eeca8b77e58fd60a5ccc44992c72a974b2b419f708f10581022bdb431afeb06d120149700
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06