Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
188s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:39
Static task
static1
Behavioral task
behavioral1
Sample
2a59d9eb7d70f8b324ac7e2b9eba9efb.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2a59d9eb7d70f8b324ac7e2b9eba9efb.html
Resource
win10v2004-20231215-en
General
-
Target
2a59d9eb7d70f8b324ac7e2b9eba9efb.html
-
Size
2KB
-
MD5
2a59d9eb7d70f8b324ac7e2b9eba9efb
-
SHA1
f340b988d559a4877584b97d394a1fb8fb616208
-
SHA256
ca38454bdbd70829417e9f1a3afce869eedc9ad9adb3478ae7a494e89175a07b
-
SHA512
d8124849584206785a031e888043823af135ab999aa0284b15335c0c3ef4c7b06ae0c9ac19b15aa0d06cfe4981ff0188407a12b8d3c2aba7ee17d82dc3b4c45e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd769173341890000000002000000000010660000000100002000000031720dc1f212ed6e2d9199fe904bba86aed62fb7fd814645a8d86a8ed89a9500000000000e8000000002000020000000b2948eb3198eba28280d69bf335a2a62a212a2f001c5fe93c794391ff10c65a820000000ae99dbcf543a62676e5c717fff5197ddfbaf75f271f7929edcfc1579522603734000000057a423a71c0492112867d73cff522cd6fa8fe4ec958e9705baad6e2f76591585956e97acda6396a5a1bd8eda21b6a41b46148a3282ed20f5b8f8fda443e756dd iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8065abef563dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410346493" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000c86d4a21ef35a2536769373ea6c72a0442d933f808d2e696294103aa6f3d7c92000000000e8000000002000020000000227aae6dc632864ff0c03cb6ca72c78b06cee6070afab531a4dc144f134ffbfa900000009d4530795b69e2f0f112c27e4cb97293ee7739951824a39e371054cf84dc35d4646925172d2b8384f9f7c917059784fa13e8460bf506dba582300e051ed00b19f6e8a068bf51c304566f03c373140c0ff2d96ba69dc2e552730d6feba0653594081b9443c7d8a5e88ffae7d16ae7b9938542e0c5b9991988551fce6048d411c5e6005cf7e85df4a5133dfeffb48f355740000000e84066571ab3afbce16460b75c89273b087242de01224df5260f42f3a05047f210ef1f93257db9fa57ac8492e8ae6748ebe5b2e5cf3839e67e4e72d34236ba5e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{185DAB51-A94A-11EE-BCA6-6A53A263E8F2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1212 iexplore.exe 1212 iexplore.exe 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE 2696 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1212 wrote to memory of 2696 1212 iexplore.exe 30 PID 1212 wrote to memory of 2696 1212 iexplore.exe 30 PID 1212 wrote to memory of 2696 1212 iexplore.exe 30 PID 1212 wrote to memory of 2696 1212 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a59d9eb7d70f8b324ac7e2b9eba9efb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546ec93a1b612484434c994156d42ee16
SHA1f9cc64f5ef4a26e42a831e21f6fa893949a6b74a
SHA256ba149fffeba363a2fa506accb0139aa052868c2f6591d31c5485edc599de49fd
SHA5124788778f92bae0c988ba73003dd3525e8aa10acefe2feec4239099aec5719d392d9dddd7c947941c5b354470d94583afe0e50bc28119ce0096affc1a42282345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5460854b3c9dcd50bcdd3fa8e0a1466a8
SHA1d4077d182a38da96dddf2f58ed454dfc236bd8e3
SHA256b69961f6c23d358ce8dc9a2b58fed7cecfe6cf18f84bd9cc8d9594fc0ba9d606
SHA512411a644fefffc89e72d7f62daa7823bcef9c77a1812e1709a29e665731aca46c917aecc6a0c9b2bd7d3bd7af4e961fcfe80eeb43b9f05cc5b6616e495437ec50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550a678f39c13cf8440dbfddbd4e2a175
SHA15c40007cc25cd08cc5dc85e20b66313a92b83d1c
SHA256acd4c0c5ce418b43cbfb022876127bc819d5cd9a98d8662f90bc02b92d334ca5
SHA5123b9b7624d11a3dece1e03b9e1b5dc480329eada407d54931b7b971aa798e60b01b93b5e14639e56bc4119e1582b4928eb35c7624ad5e34c7519d3e1f6f14fe56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59c729054c233bca35060c8c6be975667
SHA158cf00f82607f18941ded1221f30433dc1f295b4
SHA2569033233ab56c388ff80d5b233a6a9a10a98c22d0a0d60f7e1a53cf4c9b7a1817
SHA512acd9c13d4bd1ffe18cbecedcd3f7309303437bb86083e2b92c66b6938195737cba52fbab5091b2ba411265eba1bebe2e408c82d15136b9b6f2ca2b3087aef5d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2a9caca73084530f8e80c16dfbaafa1
SHA12025321e997056fc5fa1ed6df4cfa1ddf24eccf0
SHA2562faf35f06f71e1ce80d95b612daf2cd069b6932f39f7936a05baa1e0ef2e85c0
SHA5126f8ba17e0eaab6f4a88db8ce14ca5681e7c12c5bebffb20e328907ca8dbdb1599cdf2a6770049bf76dd3af179b5b16861aea14618a9dea7e6c8b9c55cfa195a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c2396648560dd5dcfcadbcfcf0ea293
SHA124c97de985d045760af9a0d3525ee2bbbfc66dac
SHA256818300d4e9da5a46f2b5c514902fbf1b43fbee1be1096ffa58421a1e45ad3d78
SHA512467ddfb74620f02150d12ac75ef57fded0e9957a8811358dc024daef880ad2e75de866c01b11a8f1680f577dfb49539f168e6fd72f54ebc8533d1dd06137d433
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510849d9a8b389a82aa2085bd20295ff6
SHA18c044352f1986236bcfd79fa613c0e0b3d4374f1
SHA256aa17ba93c51d6e2add5cfaf74728f6263163a9c0f182d06610b577863cbaa338
SHA5129b99ff9596292d17e83797f3009044ffc1936dcec17732d93d05aa3a17bd25e43285946406ef2adf0a4291fd67bfe1073d180dc981bf869a78f39311fcd58404
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556fcce71f0dad16cfd2093f644b5df1b
SHA18b951972926259baf3a7c4c59ecd327240ddce2e
SHA25603eb99d01ace9229010f67ae7f8e614407e3dea5f38850fee010dd62e4b4a376
SHA512c871cafbeca54dfc2c627427a2ee4cb0af3cd20bb136809634c22122a45f0998c154d0ebc4cfa10c1533bf6cff92aee510cf84757ad06171f299981a0ff48d86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57803121ba8a546f154a29df3e9a75c31
SHA1557dae6ff8429ec6be8a1b12a8fdb5407c6c26e6
SHA256d4afa5be7fcf662844f9610d96b94c662cbfbb1451094ba06337f9130aa5376e
SHA512adb3aed22b0a57dc10b79cabe227f0a36686f2f2be4b793abe9e3fc77c4ef15a22feed00f7f6d1611367ae1f739b6a34c6ad871bb79e7b0c56546b74d43aeb13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8ba48916354b29b237ef81f2cd04176
SHA1f8ebc143d52847bcb4a543db03abe8541f44f4da
SHA2563c853bd6032bfe0931ffda4a2001543662f54118827bc2e7385194407ac2414b
SHA512ad8834e734571f955ae01afdd63bb9a86194062ab12e4a612ebfa8aeff1c786ba693db6daec2042dbc2cfa49071571aa8090827a703ef87592daa0f7cbcd5ed9
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06