Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
162s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 04:42
Static task
static1
Behavioral task
behavioral1
Sample
28a045f5b6c64b092b468b5db8feab08.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
28a045f5b6c64b092b468b5db8feab08.html
Resource
win10v2004-20231215-en
General
-
Target
28a045f5b6c64b092b468b5db8feab08.html
-
Size
432B
-
MD5
28a045f5b6c64b092b468b5db8feab08
-
SHA1
2a4f776a1d0519e23bc49d702748f07a0b15c0f0
-
SHA256
761414ddc878e49a76fcc65af3f6f11af1014409977161b2af7145df3ea17f6e
-
SHA512
21ae0e9022b75bf47fb0fa933069ebce9f3ca93b7f4708a622784620311769e760fe88088c69878c69567978f18b5677bb85075b67ee1cf215b18bfd9b44666b
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32245721-A934-11EE-BD5F-6E3D54FB2439} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1656 iexplore.exe 1656 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2848 1656 iexplore.exe 21 PID 1656 wrote to memory of 2848 1656 iexplore.exe 21 PID 1656 wrote to memory of 2848 1656 iexplore.exe 21 PID 1656 wrote to memory of 2848 1656 iexplore.exe 21
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28a045f5b6c64b092b468b5db8feab08.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
PID:2848
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d43c43c697528a10a6ac6e590eb44498
SHA194cff88d0bb50e485776b2c27d2adfcf69f39df2
SHA256e734054450f55f5535ba5b4c2521204db980b72182d0de4c4e6be041e2db1182
SHA5123481b206a03b0108d334a0579596ba4ff7fae9c1461d924936cced72f3da70a9ff6dc9bf77a15f2fcc19741cf49e88cdbf075db94c4a770fdc6dd19f036bd31c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9f19b34ee5745ae6e3790a2bbb75daf
SHA1084f5b4cc7b2b9824c770b9a10d5b4c5d904d9cc
SHA25696b6d87d37bc2f5a9449d57ef6c3daa5fdc0867b06e1b80f91d2b5dfd4025ac7
SHA5121ca2eba6f988259d8f94dc94d1c17c231225460ffe9573598d2fd9c7f7db3e5a56ac1f7dffa8555b3272a9a2f4c671e92e6915e304b6e775de76c767f31940f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d656759668c85f52f862f305ccadcf5f
SHA1f244bd3fdedd530803bc8eedf41d9845165fe4c6
SHA256d21e9aa1964c2ba942d946ca2efec9bd52c3b357ffd8376513f09d9bf0a72827
SHA5129b7537184c6fa42fd86d414c17f71638235f525085083b883ece1b71dc9fc2ab6f189542f6e4baf279719c9dbac12cc54b63f7bcbab66d4c800c6ed306a6c2cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9b5168ee7c6d5b7061781db2bc72c98
SHA19ffe766b1d2adbf05b58379d2d16012448423d2f
SHA25639ef4166216e5becbb87cd67ee1fec64dd4e264ce574a0dae422eeef1df06777
SHA5124710dcc74532e97d36e1ffacc93ffc49f5109fff491dc4143f118fb12315183d497fdf6cf829871c3856ac43a91ba2391bc19fe6def42ba7abf735c716cf7ed7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d92d97c062e45802f4e3c3769d0b36f
SHA135c0b0e2e14516cab98ce903f5bcbc6387308d52
SHA256f596e302da8d70d16f8ba45afa30056f29755eda5ff72068c0097d412b76142c
SHA5121ae8e8ca788f461f4a6cfa86f048342b12b5086c2e2026d0b304605b807558e5c13afc9b763a30f23e926fab5621c0e6ef4f9415c35ede5969269af5ab549d0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cc376ce19d94dd1b6e1c08cbb2d51323
SHA175b355909f1406c78be604ba88317c0b5265beef
SHA256e262d6127e67c2a53ff0aa8902afaeae38973d132e1afd7946ebccfc5a05c6ab
SHA51226698497674a3c71f0bd81c97e501f490312a269e9bb917217bc3d18ee8fd8801fee966205b14b2f410dff2bbfbc610defb37ee84c95b9b74b4861ec00b4bf8d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53683a85c97003435add1918fc07ebe33
SHA162cea2d47144d379638c5e06e8b1bec092e5c313
SHA25685d15c5dd15742e4cff9a090b2b01433fbe033861170d37a216b8e24f0091be0
SHA51231f06c04073315fb6470da3f2236a73303c678be3da89a329c0d79efccd184d1c07eca5d87cd6ea0350fc4fd165bb1b84dc02ef9c35c090aa2a86310fb0faac6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5834522b0d7b95f7f024f4b6745a896ee
SHA13ea1911623e05d4ffe048ebc4c98537dd89eddda
SHA256c8366aaa275e2485f4823b0d10caf2e34417a00d3bab67070fa5555480fc6081
SHA512f77b6eb1fc3409d056a0128f93b332c07d31bfeac27bb11fbd4f00139cb3b7830e66bcc8ffb76249e21ea24385647fa31bbc883363b5ada85b9f3cac580fe819
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c488ce8bd1cbd528f858675c5d92185
SHA100a81c4a4ea55742a5bea6138b2c1166bc281afa
SHA256e66618097338ce538357fbdc32e2a334d91820c4bcfdf7a3ecbbc75e5b66b456
SHA51245caf359d232b58b23530aa3c8b5a9db67b27ac1a3075382372585bdcb8b2787f39db75bd8ad09a861f75c5cbac98c13b947e6af25591ed8a1eb535d194722dd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f18631cd4868dfb1c652416b82263f1c
SHA1a073c7637ed4625a45b18aad192ef317e6692173
SHA2565f1713f0646582a9face337758578a007e5531ced1c2ee1e816828d719f74ad2
SHA5123b05f321ebd932d5558fcd8be114658f5fb8ea24fc56d749905b0f673d1a24c2f1441a1906a60a32b7cead3898ec1495c23854b791521fcd36e30f9141d637af
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06