Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:16
Static task
static1
Behavioral task
behavioral1
Sample
299dba013b0a4b78403b0996aba163d1.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
299dba013b0a4b78403b0996aba163d1.html
Resource
win10v2004-20231215-en
General
-
Target
299dba013b0a4b78403b0996aba163d1.html
-
Size
29KB
-
MD5
299dba013b0a4b78403b0996aba163d1
-
SHA1
99680a504e3e0eb8b9995a5a8023759f4520ae85
-
SHA256
f46ba74b76ffbe1d5203b76aad7f43713dfdc8a6d22768861a65a01eb96fe17c
-
SHA512
31608845c07ed2a3cbea27d52b0359527abeea93eb019b58ccad5413a368b95f6ad07f7b65fa802e4ff94929d5fe97eb341a0e1674103a74dd8c39985bc858de
-
SSDEEP
768:eejEeCr863O1wOacRNgY5YU/MyiuEeCr8oS:eejEeCr863gBaU//iuEeCr8oS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b194704d3dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410342410" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{923B77E1-A940-11EE-8183-5E688C03EF37} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000e88a789f00b189eb35025db4d9302ef9cfb9f781054fd266073aa6fdbba4267a000000000e800000000200002000000029b7b368258b527e36121d939160a5ba0019e46b2a73e1fcacf82b42c5aa9d2720000000bb397313297c748ceb2334f8c2e2c594c140847f5ae8be4c6eadece7ef2f55c84000000027428e167c91d8f191bac7ccb1295f9de5dc0e8bbf6fa8971e2c9492bef87371cd965c672d38ce72e15ccbe319c01cf461fe13c8b1c4b751678ec8b50980e166 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000001b8a5ffd4a0c1ef4bfe1709d10ff5569315005bcbae7ef95c88a366aa98d52a5000000000e80000000020000200000006474aa7b9ae14f16c52347ff5e0556fe9c819e330d84e3e31b7eb230e2e4949790000000f5a66e2cf2e8a15f2913cb4693cd932473b64e6b0b096f2775254fa0eb3b51cb6493fb3a9b21e87754b1a50ed2037d24571f27c83d62b83da457c0035eca4625ba83a27c747b800fd235ce62ba0137f3807cdf8a4b99d9aa18c481ca87c0a3edc4608fb58734825ddb19dcaaa753066d390795f3c97aef5af432069e41ed93b8c1f202813ddc6674b5d8a3100de4916940000000829ddb2776b1f307d19a87111a601ca4b115e86572c2d8369bad18b82a81739a0dd659539f461b417110997f45e627bc9712fe00c54c32e20b9f3396a5e0dbc8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1724 iexplore.exe 1724 iexplore.exe 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE 2356 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 2356 1724 iexplore.exe 28 PID 1724 wrote to memory of 2356 1724 iexplore.exe 28 PID 1724 wrote to memory of 2356 1724 iexplore.exe 28 PID 1724 wrote to memory of 2356 1724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\299dba013b0a4b78403b0996aba163d1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4d41ea85d7931b2db3a8d978acba56f
SHA15f63f1879356527d62151945507589eeac5366fd
SHA256df9537eb72b42273f52f6b32375761025ed6f39a28ecf97411f2a957a232bf85
SHA512f49d572eec26582e6cce178b55ba8557fd178d0a8704773670ea46307f12d7ad074347649283409d8cd93d8d3c6ba196ffb12aaaa4ecd69d11e86137a8e4b6f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560e662b2ef305a657a3f51ffbe04e7aa
SHA1ef97336af8db4450fe1cf97cb883cb95b2b00a56
SHA256596cd61e2aeff5195566dbb921cedc62d6e13046ae31e290fde39a442b97be9c
SHA512e8ec8279205ae8bf9c812ff6ea09a454a02acc2d8e65642a78b6d30b76283554082c9dbc3bfbb75b3b87dd5ba0900b70e37b34afcb329e7b3fe0f84dce70de81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b23cdd0a0537256340a391ebc51e6234
SHA1e8a97670069256857a70d82b663e82b6d89582b2
SHA256ad575147a47dcc9e6f792d2e4a2bde44af1056b4abde68401c4d5af70092e0c1
SHA512cd1e72e33703f72566fc18817a74492cff6b3d944d96a08a2731fdd6dbc1fbaef4163ff51d8dd7cd05a19221913f8ebe2dcd919653de9518f08f750599f739a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598f3754129f053425cfded2d3d799fec
SHA1f0f73f1f5d443a8515e85b32fd86362b090e588d
SHA256e4a6ba36360651d3206a31e59166dbf9cb448e460ddf746f0a93ec5a80596922
SHA512e062e30b34ca61a00d137291c3e47d86df91aa3c0be77a23a02d5480fefd697ab73562656ffd20a29d45c59d88cda3de7d93ddbb3a4c24d3de1bedcce20910c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e912ca4420b6debe0b385e96e8710bad
SHA1944cb4af1b553b588df4ad9ee58848d789e3ae5e
SHA2562857b4d33336bc70cb5fb3a98b4af18ef47ea06247c7283a4f35ff54ed6105d2
SHA51298c4bcdd93862969d5aafe3024a162abb42b7dfcf269acb42a571e3e313e0a07ffd55f9af2b5f13fff4e0adeac80dabb582da33b6c552bf8d571222c51d0d187
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5356fbeb3cce8167b625e06b496ecaa4d
SHA1f94bd63f7251a506bdd6fb980d59e699130c5339
SHA25641985e76e4eaeb707fbc2ee56492e7170b545525373ccf3bb3c506fb75909556
SHA51228c99990155124fac1c4293b0572fdc763fa7f7fb8a9e27e60a61f2c873c077e4d27725d18b35822af6a137ced87942d588322356b989d5f692700d98de8eafe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59e8c3fbbfb06350b6371cff1b9c1f894
SHA1d9b1111eb26f9cdf29ba3816f1f4a8a654971030
SHA2567601fcba74e5aa1b37f6b54ed21a8e13c00d3e99ee8f63ce9c5d7d5532274b3e
SHA512cd8c90c016ebe83a08cfb3ace1e9245ac658d16b0b1f5908ad2e407149a5715fe8d85f1ce40ced8eb9023fa15f7eabbd481dea80273ac0f54042b0eff940bd51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad686759af2b79982045f0e976d02fb
SHA1f5ec5e20d6aa8690696324c07b5dbcd0e7a50a15
SHA25682244b798dc9d52c2fe058726de05722afacd0df1f11173c975f919f05fadddc
SHA512b3baf1f7b1df3d7717d3f674284602b417d69f2458399fa544042a8d2f822a39cf9c0b0c1efb4f43674c9183310d705a2c4776ff7b7ff825a1d994be2f693102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50a8d86c3f675fe605c1aa548ea188719
SHA12c88bdd04de3a9e3ee09a6c4d1f5e66650a68023
SHA256e304ed6c879baff91ba3599bef24fa049266fcaaf0759912f2ad4351a9f2ff38
SHA51281199456bd94d6c01af869e31b66952364314ade021959dd4fbbb5d6fcd512995de2573ef5a77201e4c6a08f619c538758225c70c1fb91bf1ba6f74004a6fc44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5016124c50664461aa696b9b7c8ab4b4a
SHA14c7e1cc4eebaed331703d70ab4a4d990eae0d8f1
SHA2560c515ceb99f0e7bf65396e5d1cc3e9b4e9c6b66e5fe37cee2da9aad9357a834b
SHA5121c3eabc37aaa90c63b28416120dd1230f0889db6fc17b6d9e52b01fe79cfc0849ac082e6f534f87317689c78b4a577f787dd29b04b76f4f9cc300014c93a876b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5c34de824005f79c623e8b463636cca
SHA1ed9a0d9d7bb822abb00d132328f0fb045a131a86
SHA2564bb7c931bf8bf584635575a0625e9d432ac0728d3d1fb87c2045877596fc03eb
SHA51280be08d3097325c89e9156f172c50c766b1d6aa42937e777b22f49869aceefd7f1e4dd9e8e245034e3da0b5151fd0bf630d7690a146964ba37360265dc8e231e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512caf262d7d55f986696b7de57c1c01a
SHA16afd7b1a6425fc57510a54db13cc59f71afa2a25
SHA256bd06670cfe552c8c3d7bb9e8ebc43218f31e0a84e699eee985e05eca5b762820
SHA51233609850e3c4c3a9f4b92aeb9695b54bc7efde7dcbe453e3abe44a3eb990b3e231da66ef57d305c1e2b3de7ecd43e08774d7b207fb29fd915aea51fa725315da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58564d1beefd61d3859f537dda726e96e
SHA1d4a164684f39828358e874212fe3c2c6b5f23225
SHA256874d887b0b51ae7fe5e35e3fdff94e4f54a7b05c2b8c31211b0de84870080552
SHA5124c9afdee317aa495544263772b82490f76a12139ba96304c98c39883a5861581b6ae99126e345eff8565e27df03cab5981e394c4db65721d41d205dbf02f58bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea6517da34421859e65a8e73e10d9c08
SHA101bed6f52083a33248cab813eb29f4e6232c0eb4
SHA256b4412878028028a218311a8bb1ed8e1e7b6d88d1701e7e97f4c501933d24cc1d
SHA5123c559368dbc6ca100ee51f3fcc3da9e7623429c4956dec4d75c237f0bbe6156455a1390d3ac1889702ce12fe0b76c5d2c710d412435ba198bcda87e21945e28e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9060f9f0580fbae62a6c883a7725999
SHA11bd2c054240122adeccd3767c543171d9e6bd7be
SHA2560ec43e6c1aae2b90455b973889df56b4ac6f1bbdcdac671cf477e6a2e4412299
SHA5129896125af713a12a24580f38e1d71de5efdde154584561c2aee345a69bf3d5b5a4a0087c94944d3c3d247287f885875d39422b5cd11acde877d73bc323564191
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d6f26c2f501f6826d561410d9b42406
SHA19215eb693fbf06e7f2cfebce62bb3bbdd2ce11b2
SHA2561e33199e94afdaea2ee84df320f34f661a57f8a9a502b28b29466da7cfe402d3
SHA5129474403007fd29fc9270680d5fb173abf4e6ef99ea66710eacb7546c0057d2169d672c323aa679133909faca9557823c90d6247e5080fe1116c1dc35a5f4e96a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c1e86d2ab5baf31edc9ebb4f96d9783
SHA187b07153da278d993845ef21f502198af7b889cb
SHA256c23c9124d69c278140c70b7939f88f4a20706e3b5a1ec5121fdc909e3eda377c
SHA512abfd366a0eb2c05c745fe4d29cd1456278a6b0608526cb67afc107f9da1724b2e4f8c633f279259e7d9aed1b39eff3c5685080e29454c94ecc965d431c317cd2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55505ea899ab6b586801ed01567eae634
SHA101f59068ea786a5c42b3937b1886d6124c27d3ba
SHA256138b97977cad7ffd7fa3ba96771b7f11218d9270da4545b980d1675927adffe3
SHA5126ca6c3bc845d327f3c3fcf0f346152e81945b888acf9bbf45026ba3594305a3dcf95193ab930bfd219158f0fe0d8462bd314db87280e39aa0faf163842127d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5bd7638cb911c19a6cc1fceed55d3a1
SHA183ba400695ec14f880fae6dc12b4b55109e00bee
SHA256df1bb8fe5bac1d95182ef7adee4909e74ca624f43edf502d4fbe7a7aa69ac1c8
SHA51244d619f4af3aefb17f2df6951407126c660f105e57758c1bfde5a33c91d90d85f739b822af2f9b2dba951a44a55164162ac669f18958fec37ea93e85af90c26c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06