Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
2a45f15820c32f7cd70bf71e33ef98fb.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2a45f15820c32f7cd70bf71e33ef98fb.html
Resource
win10v2004-20231222-en
General
-
Target
2a45f15820c32f7cd70bf71e33ef98fb.html
-
Size
45KB
-
MD5
2a45f15820c32f7cd70bf71e33ef98fb
-
SHA1
0fb306b384807f60ec960a571ae0fee71045818b
-
SHA256
ceae73c424147cdc1b2faea05d0b8645a65d72aa68073bd42b625968168863c3
-
SHA512
f71f647b426fe858aba415ed1f2977f3864e9f8acd6940d196f122ce002ea1b737e6602b5c38b17a601ae0f054eae47cdb990c295e3e913f25d3b8653744a52e
-
SSDEEP
768:RVGJ7+fDsb7KPJEtVI4OKO8RrUbM80DmOz3P+:RVGJ7+fDuKPJEbU8RrkMtDmOz/+
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1E5B9FE1-A949-11EE-AA51-EEC5CD00071E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410346078" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2320 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2320 iexplore.exe 2320 iexplore.exe 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE 1928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2320 wrote to memory of 1928 2320 iexplore.exe 28 PID 2320 wrote to memory of 1928 2320 iexplore.exe 28 PID 2320 wrote to memory of 1928 2320 iexplore.exe 28 PID 2320 wrote to memory of 1928 2320 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a45f15820c32f7cd70bf71e33ef98fb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize724B
MD5ac89a852c2aaa3d389b2d2dd312ad367
SHA18f421dd6493c61dbda6b839e2debb7b50a20c930
SHA2560b720e19270c672f9b6e0ec40b468ac49376807de08a814573fe038779534f45
SHA512c6a88f33688cc0c287f04005e07d5b5e4a8721d204aa429f93ade2a56aeb86e05d89a8f7a44c1e93359a185a4c5f418240c6cdbc5a21314226681c744cf37f36
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_9E9C5BD522DEAFF0AF9BF0B0877DDF33
Filesize472B
MD53da301bebfc91bc17293860847ab380a
SHA1642cbe49e91a191ed8a6e16d5dcca250e28b6f6a
SHA25633b52377803e57e80cb1f8c91a636acc60de3cc76cbfb39fa4344c144be17d54
SHA5125aa0202856066deba89f096310e2198b06daba299bf597f5bf9f864ad963ca6ca038f4c2fb8cb41af92dc5ed4b6e87c866d1f9263caa64a09ca3c75b152904ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5ef0d4089ce78a0be2fc54779a54c5539
SHA1ab68149523aa01374747dee0a34271f6cd0d2658
SHA256d1664ab048e0fc9608f9a83502a180413c500dfa307d28453634e6bce1ddfb4e
SHA5128036b84c4b65639dc834994adaf5b9deb6de9432e9bbac2163edb3bbcf8e5de139d739c61550fced9183539c4a7d13783b3ba581f8a151a846e6943d8d4aca26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540fce45899e0869d8efddb2b69087edd
SHA1c5144a074a09605dd9b3ef8f187fce886d0c9bc4
SHA256a724e6cc262214ce406cd65a02daab91c735d373377c063f7a99ddafad4d60e7
SHA512e8ed5f267ae1f9b3b43a176238b52fd0dc2a2512476543d31f3f1d11d3b14a4b5420b903071f760716e9605d152d114d912a84737ecb1b6f5ce58d824f9754d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a5906b84777850b7e8698db44ba126b
SHA1c7b48fe0a1468f7301b54587bda4fa52260e25b6
SHA256c95d5dd964d9e17f0cb116d9e0751bd6e14a32e828a513d106246318d2db4601
SHA512a0fb8cd4cf36348396e08be4f91fa23dde1c1a0af2450d161adf67371eb3d36e41cba24f51b083ffa90bbd9418060478fc803fbacebeb0108ea0e13f028401c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55975ba58551bc9ccdf4e482d1556c517
SHA18dceddfd2b880bdc09a487af61b734a0bf94f39c
SHA256f04c048390f045316f6957f447db0a1d380dcce08d4b4135d373020b73fb2d35
SHA512b05ad8e46195439d86a8564dc18154a975dde65200c5a17052af9f98644a6d434e4df2f0c8ae7f99b9e5b5459664a1989e9c54569b5a74afb037bbad6d9fbda6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb704a0406c9762cbf1f200021689711
SHA1efd750f5436cba6007e520ca4db42baaf22a2ece
SHA256980fcca73c9d26ee15b36044286d31927a488ba0cf585cd791aee0b05d215d83
SHA51285177675c08ab13ce5bb8429d835a46b1c047d2d6b451eb27067825b6a23606f84da1bd17ad6d1e4a1bec6b68e775c6cea335ae61640f8a04c49f51d61032a2c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
91KB
MD544384ac4c0d7007ef04317a20cce7a39
SHA10402f8d38de81f8587fd63ba15712e9148c80cc6
SHA256e55ccd62ee91304ddc5762ab05cd25fb1a12748ecd019f9ba791304fac45cc17
SHA512f81455803ba962a0a60fd65eb15376499df0d82cecd9a49f46e2577e87a56b11c9f91acaebb2221ff8ac8a34778cf9bc9bbc4ceecf9d9c7370334e16a13ffd13