Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
25250553a0e2cc9800689cc8aa6acb39.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
25250553a0e2cc9800689cc8aa6acb39.html
Resource
win10v2004-20231222-en
General
-
Target
25250553a0e2cc9800689cc8aa6acb39.html
-
Size
908B
-
MD5
25250553a0e2cc9800689cc8aa6acb39
-
SHA1
9dac0ec13557e46ca53faae3c6817c58ed205e62
-
SHA256
fa8cfb2047737e9bd0429f91a13518d062730fb30401e43767fe1175e7ef9284
-
SHA512
1233b450fa39ac8c4b2aca7cf41e89acb65a857c04a357ccde57815ee9cc40c03cb1a9a0de82c31bb3c150ca343a4e29cf2a42f7e5d161b820cce274949ab2f4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000009f590b1ed7cd44183e2cca07afbac4af52302c5676fcc1526fc884c3b89bce61000000000e80000000020000200000009bcc0f9d1913036393d6500ff907e2a2badd99b8b07eafabfd3e9a95383a0bc2200000008827efcbe1a2c2f425a92ff15da355ba970301893c4ce3f267a35b08375f0c8240000000aa0065e7c3fa24668df0f132c47315ee3614667dd4a6f1799dba61be4ff232ac8eb25646010da4e9d27b6372276a5c98bac800d22f45b6ffecbe5e3f2ceea7f2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000074200f35c042f74206ae21f9f58bcbcc9ade4a5ea72de2dbaf0d0f3593a6cfc2000000000e8000000002000020000000201c4fdf872b196f71737f816a08a14bfdf067c073b7da6e06056aae9cc33b17900000006b4c5590e20737e58860b79080cf183f0fcf82427afc99a09a48b6de9e18a168cea4ee985a676b9eb97162512e5fb0342331b2fbfb1edc5994eefda65ddda9026ed919387f969965044ce934657e683114743bb600a775a9019ee3d4d7e0219cb983973a3c7191060bea04548d2712fe3b792919470ff13cbd631702188179881029ddbbbd843bba75a5a1327d6e3ffd4000000003f905bee7ae0ed7e844bce93fa49fddf95adddfc26dedb11a2bffd04c9d2f72a430536c8dab1b2a1e18fb586457aaba679a95161f1653720b6e323444cee007 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2C34D091-AB9D-11EE-A1FE-F6BE0C79E4FA} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6068ae04aa3fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2764 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2764 iexplore.exe 2764 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2764 wrote to memory of 2820 2764 iexplore.exe 30 PID 2764 wrote to memory of 2820 2764 iexplore.exe 30 PID 2764 wrote to memory of 2820 2764 iexplore.exe 30 PID 2764 wrote to memory of 2820 2764 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25250553a0e2cc9800689cc8aa6acb39.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ac17e717d6551d5b8f0a00b6215cac3
SHA18e37204b73ca70e20a4590521db66afaea492830
SHA256417102649fa8deb41d81cdeb30a04d936a04c2c349409da8c9a1144f84404e2a
SHA512edc445b611a0fdebfc6afabbe1314029d10312468d8081873f0c5a118d1db6090c128bc186e4821cfe5be9c6ac8e7e258e5b3a20b97d39bd02b145e57e2cc078
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eff0d8c0a1144514ec677dbdbf0e1f8f
SHA1623242ee05517500a511dd92b9cdb5a8ad0dc24a
SHA256a1c37ad85de886f25f07943d39b2699358a29327216166b931eba1814f3381b1
SHA5122d139d88e21ff1e5b731c3f129204da3cd94159b51918be45d05dd52e4e649b737fb8f43e2541effba7805c43bf099b64e5a227c82173ce1b4b7ea59eb01725d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8696ec08d3d9fd4c57f2afe9efe45a1
SHA130e9da08567fb8b0a7daac18b79beb129d98ac05
SHA2568f19f1dc49646c302ecce8625511ff0a1f743efe5b84cbb19b4b0d2c34300167
SHA51273711bf87eb316802d7c5376427e99df7317ad295dfb4ab80bc103e5455717bc7d535351bd68ed4869301b4b7f9f9791a88284fbba2e0a229f07f4e5053fb365
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bd478c6f98e88df133c1d72fd9a97a3
SHA12e8aa036aed163aa7ff82e7457b2df34bc822de9
SHA2563a80ba2e8b63e08986fa37c8997ad3b4ed143b4d7dfa93d05a222c2a1b8b425f
SHA5123e4741af20017b535b14f3e5aa16572607088b5dbc08144f84ae804210eda21f31d40a0678d2b318c6a66f89c6115821ad37cfdea84ef90b4c517816cbcaf1e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558a7445e3f4a85c4aa9013b12fc2f875
SHA109d63c7b4f1fb7d41535dc91267f447515452dc8
SHA256c63cc5c2d14efd7d681eea41d52c5b65cf97b4b52d5eb58d930175456c4db876
SHA5127d9a907e8a3461837bc4934ad11d47a6d78e46a55749898194879b918651da882b20ba166e36496e711435b66a35d7cc4314d95064477c2dcc33d010f81417af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587b04aeff626f336efe4651c9ed3b2b1
SHA1ca19cbc54b9e9c1ddfd8a066ae46c5431d9b1137
SHA2562344e5592921626397aaa41e0d2c4ba4de5115cb5dca22a4a2765a9fec0b8eea
SHA512a6695b391e6efe912456ecc3bcf66478031aba1b556c99738e32d07919d4234386718e05d939660f1539235069196973e3e79abcd5565af15daebc4447f8155f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56862ef7abe9d996daa2005c0234cb75b
SHA1ded67ae8cfc8c8e4d3837017c7262e6d810a7742
SHA256bdefc966e4e47c384c04b80de53b75e50fa6b61409ba248346e7a3ac7cc4aa0f
SHA512953f85ffcf771de6337ec2f78def41269791116212140bcbee94a3b06504f00783cae9a70c633fc18b1d9242a394e05918916dcdb121ab63dfc799972975aeea
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06