Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:07
Static task
static1
Behavioral task
behavioral1
Sample
27822006f97df3221dc615ccf48621b5.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
27822006f97df3221dc615ccf48621b5.html
Resource
win10v2004-20231215-en
General
-
Target
27822006f97df3221dc615ccf48621b5.html
-
Size
58KB
-
MD5
27822006f97df3221dc615ccf48621b5
-
SHA1
eb478e71a0272f79463a33d780bef9ce1e2f6ddc
-
SHA256
dbac2bcf257021192a404f067213d4530affcb36e997632b30afbdd568d24166
-
SHA512
aa3fcf98e35a53e5f5d192693e0037ebaea01d50f5fe8d28f5ee8ddec57962c52d7aff2f5187bf8464dbc89f7d6669cb52037f880ca61324aec296ab2cd042bb
-
SSDEEP
1536:gQZBCCOd50IxCCxkQfjfJUfxfAf3flfsfjfVfDfnfBfffTfEfGfgfdfyf/fqfR7m:gk270IxL7RUpo/90rN7vJHrMe4FaXS5C
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410616274" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{389CDBE1-ABBE-11EE-B092-D2016227024C} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000122f4ff76c48f420f2c3059e0080625bd8d9daadbbb2ded05b67c6e2f5648923000000000e8000000002000020000000a92bb2227802370b0e705872096c9911840fa9c86c3a5d1c0597bdb98f0e37e1200000005a22a4476229a70b75bcc6916ef7d6ee54dd4a3796976dd1d1622925ab93a4e040000000b850b9149e1101930524c4fc97da4734786866a41938acabd9456ce7ac0c8b7feccb9c1caafcd2fa0c10cccab762c3067a3ae84e9ef019266061c848833804de iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40415826cb3fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d671279468c17853bef8860206f262a5841c9be8c6be53b1e6dd728c028729be000000000e8000000002000020000000d2d57cf56cace91ce74d9018a96dfd1908c5b37734ac125021ec2b8e17a44ef2900000007a6850ffcad9d1580e80cf7b3dde6a16f67121e3478b997a6767b3e54a51f95d444d519c05d7e772359ad1b1bcf1c37c73c6773a906db61bfe673cabe3434fbd1d163754582998fbe3f9d6c4cbe09d6edf6e9d03dea1dae399c77cbd6ae5f5c8ad1ff1e8be5f420739cec6e335391c30e9624ac836bfe1f337c7c333835fe98e69fc58d5c72907037d1f8b162d6ddd2c40000000e419b2b9b28276362713bd37952eb40b50971586d33b07edd12a86bcebff714cf5b78f8ce0f720e888df1018dccd7cd464b738431154791970412a66a20420ef iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2108 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2108 iexplore.exe 2108 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2108 wrote to memory of 2688 2108 iexplore.exe 15 PID 2108 wrote to memory of 2688 2108 iexplore.exe 15 PID 2108 wrote to memory of 2688 2108 iexplore.exe 15 PID 2108 wrote to memory of 2688 2108 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27822006f97df3221dc615ccf48621b5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509013323485467c6c16e26425d90def8
SHA1a09952b33845968bcd2e237b9951c32f515594c6
SHA25690a6bb7d68b8fd465a2fda63f4326421d85ceaaf37805728b95474c6c4545f56
SHA5128b32d217903367c1df5f75c50aae6597d52f8f6cbf97251e65e02c357e00b9f2453d2a116fd4e6adbce07765811446097d19dc630159d8c051b73251faf15ab3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b60978fe016e5c27d9694c76fcb84d4
SHA19953a12685f3a9df19b7166178cf17de21bfac1a
SHA256b26439bfeaa7ec379ef6578440415f396d72618b944839866e255d880a4bc4a6
SHA512b78259d6b61a91623d5e2c52e5e4d112b3235b4bc50142e95bb6d6f321fed53e308da163f6da8bce15d641674322e9d2a2f84d19424b7a1284808da385e3a64b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5904d63a9d4dfea46ed36105001295f07
SHA1fd267065917d4135c743da36a79807b8e62eac90
SHA2567b6b3fb2d9657960f882bb2fd0c08c0ae825f75222b2412960d8dd76d0616a2b
SHA5121e6a76610b9a2374cef5a56135b06fe7541b417392ddd0599d3265e248fed27be0ddbb5e962cfe7f90f9eb2312d2c2a0e30fa01fdff3e5691d3b5eb8de52ebef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ff54a1d3ae939c01f5a9b4cfa9cc822
SHA1bfdf17d6f49e0d5af7010233e18a4606bcd334a0
SHA256d3f9283ded2232d8b0dc12506dc98f9cf6f318cd4bc85a3b3928c2f1576ee06f
SHA5125cd0f91428927ec94f312944458d5352a035b57e81e59d16c93d624b7e40feea01dbacc30dffba3bd1800877c3e7eec722fe36214ec44f376e35f7a4b0dce710
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f52dfd8d27f64d609825bb8ecfa3d330
SHA16fc5c0a5b02554f723b982c3abea859ceba16e72
SHA256d3b288ba024b1a2eb1077fcd63110ab7f47b801cd912fc183bf95c0209739649
SHA5125cd1fbcd20247f5a65d2d33f388503305046f1ce7a95290faf4c07095ba8961631bba435035ccd2c363de3af37154d20866c58136ccb38128b6059f95095245c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505d9cae0dc823f7360ad272c438f3029
SHA1538a4b88bf1fcd469b48d9333fc19472a7f9a3df
SHA25646558c4ba7e96f94587d9463a0cf0dcaa90bd1c06931f6c3539d095cfd71fab7
SHA512408035d426708c8fb8832d0d4284df03ddf6c7c95fc9e8cf7753438a9ddd5790a2616832d23ec42ad9a271c9167df0f8cc80df28a1c154c76843b7e831306118
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58366a746f3e42fabb1b4d42495e1a15a
SHA1d3374458796da36c8b2b0064660a0901e823d176
SHA2568e8a3cea54b3045a2dbb660d4d9d11d0ea4f77d8e945feae094a4660626d9706
SHA5128070e6037bd01c9c21d74f5800bfba63344741cb32c8e54e7e90bdd181ace71f496cb041219308eea4067a8115b1b9a717b1d754aa7066fd9b6597e9e636c8b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8a0c168dc8cd38739f64b49cab56dea
SHA1cbb2eccfedc5c06d9132dd2f446ea52aef35739c
SHA256de82e150ef692755a2ed50058a7ccceda0359718358bc5595438a0802b8b4a19
SHA512eadd04c365a9659042fabaefae323dcfbc453b3693d2d3cc67f3a150735379dbad167a650466d979a63e6640521d319cc80b6b7f8e70c997f394914e61812a22
-
Filesize
53KB
MD54615785afee89b304fa2b3e58fab53c7
SHA13bc9b401b8c609da62dde14c37e4415d2a5ab987
SHA2569bbe5ff8685abac21b2c9230ba312caa170637fe85afd86a7fa94e0586ec98a0
SHA512f47bfb1395ec330e7eadd4162bbe97656931c5c6f2911a836a656e0481f78870bf6baf6f7f72974da09095754945788a2105c898a5b19f284eb58f2e22e9a322
-
Filesize
68KB
MD5c892563f13abfe9d809c3a0bdd931d68
SHA140ff1df7b5e017dab3f77a24bc7bc0492cc91eae
SHA256818e7a5abe3e00e35d43a7fb078ea78c806aa52c7f9107e332d507982766fbe2
SHA512fe59c4ec2b819ec4f4db147e17254595b3aa1e32eb056f239ec4a945e7905fb6622e227eb0d5a108f9f894c02f7c0b46add9eef29155d38ac21b708900cdd01d