Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 00:59
Static task
static1
Behavioral task
behavioral1
Sample
226b83a17a1c9b9adbfb8a0372cb1385.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
226b83a17a1c9b9adbfb8a0372cb1385.html
Resource
win10v2004-20231215-en
General
-
Target
226b83a17a1c9b9adbfb8a0372cb1385.html
-
Size
2KB
-
MD5
226b83a17a1c9b9adbfb8a0372cb1385
-
SHA1
521736635322f4801be734c427c5e99ab4af5cfe
-
SHA256
83585106aef2ad9b66a93d29751ea85ccb1c0e4f4976b96c26e3ac759d7c741b
-
SHA512
69d800f002002b618e719a0562f16843b630a045c9afd1c9a7375514ef69e3335684f925d98642631bc6a7c3f4d0bef4206fdd8f57c93352b071c5c275806646
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64E68191-AB66-11EE-8CE9-D2016227024C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1716 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1716 iexplore.exe 1716 iexplore.exe 2168 IEXPLORE.EXE 2168 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2168 1716 iexplore.exe 14 PID 1716 wrote to memory of 2168 1716 iexplore.exe 14 PID 1716 wrote to memory of 2168 1716 iexplore.exe 14 PID 1716 wrote to memory of 2168 1716 iexplore.exe 14
Processes
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1716 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2168
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\226b83a17a1c9b9adbfb8a0372cb1385.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1716
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c852e8335f254b6d410947e88f557610
SHA190b2de0a92c659bd8fddd2f6616b33d0a9d9bc95
SHA256be4aea2ee7c2e8b43fc44ae16c75c4d753e9017f9a0dd318d4959071cd596a2c
SHA51228994cab2023d52f961f19d96d8b3d6950b4ebc1c7a88986b181443cb05eea26f2d44ff307ef107cca3ed214d7ffd61eae4ccd1d24cd3ea04ee73aa00bb63848
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586ac4b48ca36af2dcbeee6fc0f3cfaf1
SHA1902eddaeae8e08403f2fc821f09fd11bdb634ad1
SHA2560637a493482ac3d5a1d891386803a9a864e631e5acb1383ca424a244e4c9aa20
SHA51264afd292ac1bbf6ee3809d8447bf7edeca5b010574f57f40350111f7eb87ad6e7528e6bed3fbd496f066bc09abe5f34adf12e4edeb286f5772e8dbd4ae1aedba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5181d5135b73772ddb66d90f443f20e81
SHA13bac0781e39aac88141126b2635380b9703d100a
SHA256d8f59e602f26af7d01d142d3249c691503eebd79f8aa9c40b5523faa3d19e896
SHA51247c1b4539e8096874b79b3d07ebe5b9850a6f5504dd91d1c83ba25c7b5bb5cc1f7e2ebdee3068dc3f70abeffe6dc03d86a850b985ebe5cadffde47ba0d39953e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f51b06a93ab776fb1fe5eb882056fe0
SHA1ef639dfd8470dcec4fda3ba83995a4ea6d6c93c3
SHA2562ec2bfc1477abf918592843a26185f210d87be278995517ef9f128f7ce5f33f2
SHA512b23be7ff0898358fc8cdb200e4115614f6c0b1d0a1f68bfb35d839a1858c5e33b733334cfbc6e9cf59b454342a6259945008fbfd37f9a44c1b81db9b68dc9a0f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
42KB
MD5ce4a7607eb47bc493f6d3fd18d40fbb1
SHA152dc4f2c8ea09aee7fb3c64b866eab5243ea31a7
SHA2563f68d7e63c998b643dd9245554f62391501c16522a1ee99d0817fe55863cc66d
SHA51273646da6e3e0410fb24476303f91c3cf1c464b2263d929f6c46bcbd2bd59a5c8967e0ed19acbfba6734b8f1893f430996c81973b1228a1d7afccd3892073ecc5