Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:04
Static task
static1
Behavioral task
behavioral1
Sample
25a3bd71ce2c382b7abd906bb7fdc0c3.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
25a3bd71ce2c382b7abd906bb7fdc0c3.html
Resource
win10v2004-20231215-en
General
-
Target
25a3bd71ce2c382b7abd906bb7fdc0c3.html
-
Size
10KB
-
MD5
25a3bd71ce2c382b7abd906bb7fdc0c3
-
SHA1
91207da732a94530fc476a17ce0e3780178ddffb
-
SHA256
e844382475b3ba3c2ed126eae3c6dd792120bd1d331382c65dbd46ffa80575fe
-
SHA512
f8bd538f1403cfc724ad36fb57e793f0877980e28860fa498107879e51392da4823f3d2f532d1b3404b3eb981abb3bc93904e802228390052f3b8a8a7e15265b
-
SSDEEP
96:uzVs+ux7I5LLY1k9o84d12ef7CSTUaGT/krIpfLWN9xzhkdZMVeUWN9xy7lVHcE8:csz7I5AYS/HizwAUVVwQPHb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0EF7D01-A90D-11EE-BF73-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d30000000000200000000001066000000010000200000000488e9f97ab8d5ed2b2aa90a5b4cd36da50fe77eecfc1fa5acce195651c71751000000000e80000000020000200000009d362674bd418370ee36742fbe0a63ff53afe8d14bbc18d20b9795479b58194220000000cb6759924f109b33e4393aa37362db2c798af988f3f2f7382f9008349ef4b30840000000ea5c8ab2b9bb11a84d037555d352a50db08025cff7b10b2949b0227fc0a228a67c1b0f617dd7c147bf63c3b32cc00302710ea049d8668305bfcda9f08ef6de66 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f1c8c71a3dda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000003254231418aa5c352f73cea21bb92122f0da33acf1f525a000b1a1c050b1af1000000000e8000000002000020000000212977f5809b94db03af7ad037a0304b53b561d8623a989fbd1f61ce60265ccf900000007a1ff69748b45cb196998c3baf2d6e9d835dfdb9c0196fd4489fd321a42454fcb04549dfab518c2731121e8e742ee4e8d8270d2f05f29f02008c0c24ef58e6c1f9bee09d86e5be596c885c95f5c879f1a1c6b28201ea7250482d4ba23d88d78bd784c20be51dc6bc6e0d8326f55eac5d140ca46e32a810f0cde470791d6eaf9a4c039cb32492f4d2d89920c0be7a696a400000005cf86f36719fad266ab53dbcdf2df61cd954632135a15439c47bac59890c984b7e2df20109f6d971c843e41dbe5e1e7b516fb9d3baf1347ed7087b1a614c86d3 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410320667" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2504 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2504 iexplore.exe 2504 iexplore.exe 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2352 2504 iexplore.exe 28 PID 2504 wrote to memory of 2352 2504 iexplore.exe 28 PID 2504 wrote to memory of 2352 2504 iexplore.exe 28 PID 2504 wrote to memory of 2352 2504 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\25a3bd71ce2c382b7abd906bb7fdc0c3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58df0899da2344c09ba5fb5b4d639f948
SHA18bfa65cd5c334f351ba4687f00f14cfef68569ec
SHA256fe561b7a7402a3781f60981881d5d232a98af356f03559105af0894b807d4440
SHA5123586359620021f8166bb0fbb983a323689ab39577b7d5a4d46107572a8e04225383c028af65b68bb6954810e6dea20c37d87ba1fde68a1f70b58988e6120ffa6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5052ad5680e84a2087e53e53de1b5746e
SHA1731841de53c659917ea742781b68ffef6d5c2e83
SHA256cbc32fc1a1d1c59252263198e712fe7946299b65de495ae5c37e7140387506b1
SHA512276b4888666bf8eab641c2e08949bd92e71daf3ff1102439d9238df50fb92ef1c517fdde5c44b2e7d1af92e3400ef7913b5b6338b3ed71689183619ffee0696f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50123aaf37676947a7e88c49dbd364b26
SHA15661579f86958a59edc88ef7dec012b5cb96a252
SHA25614e10f5b48bde4c4b5f1412a78c8b7bc5de1b6c233868b4d003e6666fa466115
SHA5125097ad181449bae2030ecfee34ef20ad91721b094849a9645022c4fd848b7a3a0a71046bd29ec453046902a69a1029cb4f2e45a32cd06137c319a72ee2e73120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f75aed174560dd2f3b5879a7ed91572c
SHA1c59cb17e50018e3547e3d6021562cba2c46667a8
SHA2565695b0ed218da4f264da3ae0db5b726f660c6245ed139ab14bdc60f955711815
SHA512516e84f0d6439f775aaa00b2b8a59822c146f36d47d061878c9b019ee8b85c49ca9c85885564515813f3816c7d349c55500381f63c2b65133b5f973dbbffc45e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5caabfb40886d2f5c0a7461e7791d1d0e
SHA1c2379ce3c3f5d3cf750214a22f60efbea381bec2
SHA256fbcb71c782888fd95f1f3bc989ff8809c8a1ccf4635ee7a5e3906223c47acd9f
SHA5120055fdc53350adb7895af4130bc037b261e8aacc0a8e9a0a7f5768a812aa18e58c1597d891b85c8c3ca0bf00d4410c2bcdd69040e92f69ed5139ee3277741bd7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57bf1c2a2a3df1800fca1df6d132b3dee
SHA1d447570b44d914becb1eb59c132601fd5b5eaef4
SHA25683de8853cd7245646a341396530732c7c7f43d1fd5459706301900307ae24425
SHA512a4fcd177b383fec3e2c3c837611e3c1bd3bf438c8dca5a6076034f41a87550dc7a7f9b582f34bd3e0d190bb798526abaf66e35ba864914c73ecc60ccf631af5f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5088904e10fb3dcd59d23cd9b9d88c770
SHA15534cdf5d9e1ead8c364bf3db28fec8781cf0e25
SHA25632ebb46f20c4faaaae43bf453ed8c8550ab0d9a5adc7e7b4e3d72b78586c3388
SHA512f808d8ab654918d4155ebc6604842c3600fd317f3fced20e6b61b95aad74a8b62ffaf9914f4614aaf95e65b1aa263ae84bc5a60ce0d5ba1ae86ab03dd4f46c2b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06