Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
263ab175a0a5f74a524cb592d2bdad6f.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
263ab175a0a5f74a524cb592d2bdad6f.html
Resource
win10v2004-20231222-en
General
-
Target
263ab175a0a5f74a524cb592d2bdad6f.html
-
Size
432B
-
MD5
263ab175a0a5f74a524cb592d2bdad6f
-
SHA1
fccdc5ff6a4235a4e6468c9bf57f76f21db8f2d6
-
SHA256
3b34188f72381c298708361a96ea090544d842cf4c8388c12dbc540febd25853
-
SHA512
1dd497ec6484213a2880faa3ae0f6f5a17f17cef845fb31ec3a7760ff05e3d97430916a6b1877124b4350032668da4ce5d5ff11e27bb7262e23e519497b60f57
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{61A264C1-A915-11EE-B49B-CE253106968E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000087926cb905165365cb65db70e2f7d8e04eb00e12a13147ee58a93a378361fb5a000000000e80000000020000200000003e620497848e4a21ee9bf6c2ffe536286135edb1b849ad65da631ffe17935ee6200000009c98a3d917b3b8c7890a88eaf479192e44c39dbb767306aca156e1286b2b91684000000076a18fcc9b136df16472b7aaa347f1a85d5289494711538832b6cdbed84b2c85a2b342cb7a5427b8089817d7b535b98e98581cad4b1d22a4d5003b3addeb7929 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410323849" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900bc428223dda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d41079e4eccd38af6fc331cd92e7dc305fb0132eb40f747237d2d100460a273e000000000e800000000200002000000023ae6d5856c871f0277f3e0c3d0db7f4f45b2b0f90f7c0435e2bd38dbac2e3a990000000c161052aa28592d3b3f61019b7b45861ddce98b7b17d5e0f87439595956193f0b7306ae3df0d8886fdf7cf08cec4f4bb98abf02510df0dac673a8761ba7a060d6703d74e6ce6ef370acd7cc83cf6d9ecd3d37b40f0461aa51393d294b86a03b7b08ec9e308a0b0f6c41517748ef3316ed440d2a76711a2e0685d4965f466ee4bbcf2354d8ff74fd7222c75becb6ebf9340000000091aa3e8959d163e838bedc61f09deeea553efe969c6b03fc31bd3df4a13b23d64da653b61bdfa2eec96646196f6ed4f8f0ebbe64c8afdc17ef9614eff9bf407 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE 2128 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2128 2028 iexplore.exe 17 PID 2028 wrote to memory of 2128 2028 iexplore.exe 17 PID 2028 wrote to memory of 2128 2028 iexplore.exe 17 PID 2028 wrote to memory of 2128 2028 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\263ab175a0a5f74a524cb592d2bdad6f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2128
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da8a26b8c207d2c81356ae11fdb900e5
SHA17d5bf80e1d083e6e1c84a3e7c93feb800aa25b25
SHA2561db78a60eb8f811d7cd27072ec7d2e09eeff04d8f7c08f0cce8a40311bbb5f95
SHA5128f49221b22a6448272bc13bc88b0aebfd212b7ec412a977db74fd4e2cdeeb7c5bee25484155388ca1149b45b90628b7f429bbc4b2dfdc2eacb63d3932d3fda1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f5af923576f5157e8d296d016e1f3f0
SHA19d854090cf99a7bbb0f8eb95dee45548a8a97ed5
SHA256233011934a890caee89205600598be8b7fa518fbf63d8f7850e0c318f55b3bd0
SHA51235b73faffefc941a371f363c0f3e579ef2055f3f9ebd09b05a6f5ca2f6ef8477db359b853f9a69fe7992cf8bfe273a3342a17ce05edc99d859f70aaca998a817
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db746e2a8fa42f009e6e9ec0a0334000
SHA1c875404324aa52b2bea49aaa9bec2fc40cc3443e
SHA2564fe7791eaf0c12eb9cdecb164ed766bb173386785549442567bcc04251ea4e18
SHA5120fd97db4bacc31d81bfeddf08b32a3733face49d7a9cf398c12cdee07e849dcf43afa947a41c5f7086f7dfd52a10372878323bd2055ad3c608e0763878b31e42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533aff831c490cd30824b2b333e08686d
SHA18d883476c64a4bbfb43d79d8dd1f513215c9ece7
SHA256c490905741348d4a3a8a69f7dd9228de11eceba69d265f62cc8bfd8581b19f41
SHA512d84d246910ea30e73dfcb6ed3e9af1391bd694eab379ae533bdc3fa526ee19c9f594abd622970816a623e9b2123678b0d5fcbd6a087f0ed109ba94c887bcde8f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5255ec685bb443cbac84cda5bcff904bf
SHA1e0249d30cdfe3a9fb8c50e9bca82b5434f3158a0
SHA256ebc6094539ca2fe65d71a44daee8083d5bb2b08e7573c452f6395c61318dc00b
SHA5125e84ce953d1e609edb0d47b414b7d572160e47ac33ab443d0b40ec61244e7cd2f7808ca2cbce07ea615d83bb541bd56812429272a09b1b821a63f4b9ccd1240a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1da1605df2a6c774da5f6433928a07c
SHA1451d968693682ff0d826fe5faebfb07c20ba702d
SHA256fa3d41813f43c6cf18bd3b5db58ffad4cd32cd80a0616e36ed3b296090271947
SHA512343edf6d61ca3abf9e8477d68a980c2a0b65521c2690f8c56e5528605e5f333cb37de6c653c1c4e7b3adf6eea7e2950a5e2d460693ec3c50b9451a23cad28dfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5181cde35f304644f0a62fded8b821786
SHA1a49c085c21a58800c90af550d6575e99147f1f22
SHA2565fe85836bc08a0c57a2571133945437444a35b730b730ab167cad72d184cac9f
SHA5127d9a4d100cc645093eda10a6c05946da4d8b3a1e6a231f540444e73d65bf95f198d9efe399d61675d74d6d7b0aa419b94d1ed670bf65221e124bde04e2ef0d7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c1eea800b3b9d944c8ad4026b9ef960
SHA1535f2c3f8005f52b2d7ab6910128899bcdb60927
SHA2563d13daa1385799aea70727909ce5a5b5b154964690fd5262811feaad5c7e2b16
SHA51290c3df41669553ffc2f30c91aa4a13eb3d76b246a42f1f32973e74840dfcbd970a346f3a50c2e3323cb985f9fe7839a63bbd047a9f1d4aeb808f9f43d683755f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff993eefafb90371889bda576bed0191
SHA14acab4799b5083e029e6d646377cb75b1c54c911
SHA25608d38b0d05b09dce2d00586ec02e031602096391b7f49b756cf95ad4ceb4aa17
SHA51258af10cb697a557aa0b86f3db14cfc95af29674500ba52c7c6fe7b7acad45b9224ad172a586a16e93ea9c88c1d6b8ad2073e7715241ca08c1fa52492e6acaa2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD519dcbf71040f7c6df92e4dab7888654d
SHA1c95a2107fb505b487aff20533ae20739ec35b778
SHA256f76cee081aa3276bc76d30970eb690b17bd9de6df57ede0ac6db0da81c62d20b
SHA5121cc0f59726dbfd6c381a463a34bc6e8cc558aca6286f43cbd952eef6fdda94551025c7760c8523e8d2f24e773ef6f277a7768abe34d54b15081415dfdcf6a822
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c8c59b3939d562aa12392b98ef769b5
SHA1d0f978817b7a48ec5ee25e53cc2168bfdfcb0afd
SHA2565d09fb7963055d516bfb2d47a5fe8983868b2a0967fc0ac3b7e1876b0f3223c0
SHA51298d0f8d7f7303b032bf2239f5b46037f9d6931ef9f4d75b8de1a56c689675d2fd11af685aa098c5cb82bc8aa3d61c3d04916b68b5af5e3575ff13a62fa2f470e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543adbafd3829e03d76c31b491d8c52b9
SHA1ee79947bc555f83821cbc274d96e962840c441cf
SHA256d5f176cb619c8e67bf6b1a2addda8ce0b4a50cb9dca64b22181a6f9b9ce472aa
SHA51211b345226b8421dd63822035503d89348532d783bc922d17668a5312a622a07b113ec1db2fb28fdef758dff4197df2fcc67e95ed6964c20a87ab06c3d4413124
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e2f2a77de8de2f1790cfc414b029511
SHA1453f4e5f992c17c3a09aa32e44fc6e37c12cf70d
SHA25625cd07bfdc4739b8722f04422f443c64e9afaa31af6d4c36c80844aa9098ed0c
SHA5121f4cf0f9378e8e747cfa01200cc94cdc9a14625727b4b1ff6b7d4419b36e26a3d16f376e943e6ce327344fc41abc0026f4fdf076c9c2ffd73ae1f81d4499c063
-
Filesize
1KB
MD545d218b9c1c9fb37a26c873f39e59c6b
SHA1b4e457d942138fd2bc0c404cd9fa6893cc008500
SHA25664c6223c7e241dd33ee520648f956bfce9a2838586ea4d411fc72444e084e4d7
SHA512a46c4692d6db1dc43cb5bb6f62fc03cd2c590543a647d2fa596477bf4e44ec44f7ba8071d4c0bf98ffe1f1f4436abe2359de1459c380fb1dff0c821c65f76f45
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\favicon[1].ico
Filesize1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06