Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:17
Static task
static1
Behavioral task
behavioral1
Sample
29ad4af84bd70c454203e3fd0c8e09f3.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
29ad4af84bd70c454203e3fd0c8e09f3.html
Resource
win10v2004-20231215-en
General
-
Target
29ad4af84bd70c454203e3fd0c8e09f3.html
-
Size
189KB
-
MD5
29ad4af84bd70c454203e3fd0c8e09f3
-
SHA1
fefb7d7c4dbbeef21f59045e8c231f0301adc7fc
-
SHA256
fec531c3af4b5565abc9f4d5e6e4b0190abfc48b320c839bf72fca1d32f59731
-
SHA512
c26413c2975bf600b2ad9f541b87026fabecf18a5b5f40f708a48e9fda4c35a7f96dd075dc39ca2f75dd8e787047ed85ce2315ea141c434b02aa12b0e2962330
-
SSDEEP
3072:BJ/qzXP7SZ80mt8zQ6RuJyk5eTI0xCJUZPeQJNZyJb5Qf99//Bqyiq:BJSD+mt8z3wJyLImCOZPeQrzBqyiq
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{320C3FC1-A941-11EE-9FFF-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1700 iexplore.exe 1700 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1700 wrote to memory of 1812 1700 iexplore.exe 15 PID 1700 wrote to memory of 1812 1700 iexplore.exe 15 PID 1700 wrote to memory of 1812 1700 iexplore.exe 15 PID 1700 wrote to memory of 1812 1700 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29ad4af84bd70c454203e3fd0c8e09f3.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:22⤵PID:1812
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4bee35e21434bf4c8c8e4572636941c
SHA1cac668d4e98d8322958aa03ce9a04f3b39a06f90
SHA25620289adc1a07145329bbe9d012aa3ed46fbcb17e2af5204fa757a8c8561a7f5a
SHA512e94fc1ec65233eb6de6b52fbd03a5209be59504ceacd25f985b96beaa510bb45a28a0b48f10d17d3330f9a15db4be9fce68b4e4cefee193217a78f13907ff96b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512347e54243c5e885660200372d9e5fe
SHA1d571b6b0d249375c045b9dde85151925150b6dc4
SHA256119c508f879e69ec64ef0f86cb201f812c73f738f12aa7da71b4e2fcbbf95ba6
SHA5121e06bc07148163ad94a39194b1176fa3cebed6418f15f189266984566dc00c027538ccacadc3bc8215d5703749e237dfc70e94adaebe60b10a2653a6989ebe9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df08534bca5947ffeaaeec77423583a2
SHA134fd2c4abc90469d168ae6b1ffa7146bf3992aed
SHA25637fe3ec0826ece795715d7a806a56325d58e0e79682859716945557624bcba2f
SHA5124ed38ab048802796fd115b0a8bedd452e74b64f23c74240f829bbaeb5d0431bac8e5a186bb20c9771525eddd242461f923c6f3ee81ae9487df831492a3e6c290
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf2ac37b19d3b44dc9c0ab7677b9afdd
SHA1c2e520e55ff4f7302f5349986fdbac169879b4b7
SHA25636138e6c38dbd5ad37cc259114195472e65c4deb74e800d54e9f1419dd8eef2d
SHA51253091d2c450b12e74a47cba540885a3864e7a9e95574128776b3ae7ecd197fd972e871ecc3088e7dee11bc282a10fdaf3850223dd4e78a4fd522761b4ef36ea4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3367efb0ded8e81e164dd96abb7324b
SHA149b4d1ed9fd6990ac5c2af924eaac89fe3098858
SHA2561b281aae872649b75d3e43d7471338aa9c20cefb17d372fd09b673bfcc9a51bc
SHA51227cfacbe23c5fe3f7942f43d69821a563360895ae27f140f8ffdae915ae57cae15352e06866ef46ee5a63f63c2583f0763aaef60950b9caaef7ade061fcd1383
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5979c09878c2dbc835c264d1a057a02fe
SHA18d53ddd7310a4dcb7a0f2901b9b76f0c55650213
SHA2565763233455639df746f91518dfde54d96d894ec4a251ac991c8dc8de885cacf6
SHA51283f1c4f1be792cf687cee63589efdd6183659e79b0587402b0f36efdc709106af4e9e0802df3bad95ad0207b06ac0965d5063cf3d1257a20172c99a9141c6661
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5946ed05d19cbd50153c5e37ec5182db3
SHA1c4f981eb8331b09e95d09bb5fca4020024063439
SHA256ef428977a9bdbbeffc03d0cc0e43c56978dbb52f54676c7ee803757c6ac7deca
SHA512fad3617f6578ae093df809fda0a08e81477a50db55073dbc78ec30bfb04782dcbf900041dfc75a4152e32a6eb3956c3bdb22a62e53b26da516c92ac4e18b3711
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52cb6d36c721ff0fe87fc35200fa85841
SHA154fc91af60ff9684ba01049fad155968e4a61f24
SHA256a1297a9ad717d688842a1900b304814a081619f1dceaeedd17216fda6f750b41
SHA512285fa4bf97bb04d12d52a218ff33d288902a8d56f6136a69a20a85bb58509a14d31d0795e3ffc729d7327742849703a5f354fb3697196ce768097028b64ce7d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546d1a47bb7dad5d1440e1dce2390daa3
SHA1e0a8c8ef3d9cce9b2a0da9db7b526fba18de2441
SHA25660d4ebd6ccf1858da4ae1b017eaec9603ca41b0f068c6e4cb552ffd2206c74f0
SHA512ebd9cdaf527219dcb8e8dfb3346a49eb7196ff474767d1f254413e8089e2d453cfffdd995034a2f0a3e16a05f69523e458052dd2f7c931ca3189c8f270da4e07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5539a6557a3a20ac88b2d4c716b6ece56
SHA1ccecfc4c2640d562267bc4c60c1072defe2b689d
SHA256782a942ede5df80c8f94527bd97481b1b301e9e6da7f5387d80025baa372bca3
SHA5124cf0f86030606b41f112ce808c6edf0434862dd190a0ebf9b5ededb267dc2d4265a890ca502ff4cf403cf258aa677c283729b61489d2bdb342770db0b78357ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52752e47189f36070e1da67a5a6592209
SHA14ac62c68f9c005bf7823e04db26c9201eb6a4fd6
SHA25609bae2094e4447209bd456ee49d8104d18326484e9ea136485ef99ca77ebefb4
SHA5127e03ecda6d5d9f1362dd5a96ef893f66c22422f9f5ea1b7c13aa04eff9c48f3ec3bb65837eddb97570bbe8256501ed43f21bd658d113421481ebbe42e890cbe7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5497db2f2247cf138e5e3b24aa1351a4d
SHA160e079af870e35b8e3b0caf06e73b68c7720bb5c
SHA2566241eced365146d6eb75ea282d3cf0e0a82ea1b79ccec37bfce53c01d20aad17
SHA5122ff8228b0fb1590b1ddfb0e51797e28eb8b0a2b7f34b712feab24502a1b156d498e22493c3ea7a2fed11ef9cea540ab5826b815b7779ae0502b102a4f2354201
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561ebfaeaec7983ba0aec59b8a4ccdc21
SHA1726281d0bf8d7ea2e6a383363ac5f3a6473e1d68
SHA256ad88dcec00389731c6c6ed95862643d16b2b979980fc37740e384c96961853fa
SHA512b70094519ae249293ca0392814fe4e13e152390378d65b77d3aff0171ee1192167f33b669721619b4b055fae4986ba37e19eb82f97c338f3c5469425995b4e89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eecc0330938f22b47deea23fa9f9b589
SHA16dee5cfcbdf43162d07ec2a0305c8cf05260eaec
SHA256cbc0b4037de07bc30cdea5d7f0d3432c03f29a5e3a9570db0d49073ffa56fefe
SHA512cdbed81603202bca0d1bc3b0aefcdc071c5e56f2eb8e8022034599ccf67b16a15b8b3b082f1536051f1820829f7f7f2c839f6c73f7a181b689b4522ec1b8b761
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed628f59858ea15639e394e95f39edf2
SHA14cb278058199412eb24bce0654c5b605e824ea25
SHA25657a8365d8bf41ef079c6069e97f44a46fc6818b719583dc83a7b0a2f7afcbe95
SHA51215241ee91f2ae5b6052d8d8b5094086c3c0f4855e80681a77b47340ad8698415ebe46200eeac96bb0a88cc629ce4aa2bcea225791e254e864c69d7cb54555ed8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06