Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 12:55
Static task
static1
Behavioral task
behavioral1
Sample
36e7bd9adf5eb9ab469a91289b82ad08.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
36e7bd9adf5eb9ab469a91289b82ad08.html
Resource
win10v2004-20231215-en
General
-
Target
36e7bd9adf5eb9ab469a91289b82ad08.html
-
Size
48KB
-
MD5
36e7bd9adf5eb9ab469a91289b82ad08
-
SHA1
87dce2a1734a0ef828d60e18ce1f76b96b8092b3
-
SHA256
48a1de5f0d0943c03eb04fa53780f96ddddcc46ddddd4a1ff818de0388db2359
-
SHA512
e2fe43873748f0a882170f75346fff9156815db70c59eb00704a5752328a73dc1a07d840fa97d61f9aa8206b4db04933689dbe7cc462111461b7d8a87e78761f
-
SSDEEP
1536:WlbXOdsJkw0hzY+OyT+xATF/L2UxHByXgIYosG:Wl7OiJ19yT+xATF/L2UxHByXgIYo3
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{29F64041-AFCE-11EE-AA51-EEC5CD00071E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411062932" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2672 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2672 iexplore.exe 2672 iexplore.exe 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2544 2672 iexplore.exe 18 PID 2672 wrote to memory of 2544 2672 iexplore.exe 18 PID 2672 wrote to memory of 2544 2672 iexplore.exe 18 PID 2672 wrote to memory of 2544 2672 iexplore.exe 18
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\36e7bd9adf5eb9ab469a91289b82ad08.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
893B
MD5d4ae187b4574036c2d76b6df8a8c1a30
SHA1b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA5121f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586a7152ba7ef19933fa5230516b69b0c
SHA1007cb2cfa6ba1cbcccc0059f56f9897f744cb79f
SHA25688053aa1d24179bf1f3c086773b9d66ef8cfc85efdd721163ce309385f3c7701
SHA5127169f0e27863caea1137c6a5d6bb1f0deaf478162ab04040fec2f52306bd1880f2858dfcfbb4d94ac659922aea988e231d5f32c4a5d0297b36d645cf655e1380
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f74dfbdc77793cec1f79407b929e3065
SHA1231c0b2a6a81de434bde26d7389e7b7d84c95973
SHA2560f9bb23c26643ffd767de15aede357396e5e77e6c69134bb198097ec5a017ff5
SHA5128572e2b96380ad69023e752b1557ab91af6e3be5b070c52664189dff089991914887826db7feac32243c97d0a0c4fdaa85755ee899d53eb8a5b924fb4f5391a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7a5f9c3f163f77d2400bee063d1ec67
SHA1cd84bedc75e4b83d75d2b4be968d9ce798d0b9e9
SHA256de6dbddd52139fa486a1f0db9b679fe97e68ce97338c67a3be0fc3c4db276362
SHA5127645fe6b83ff7ad47c8fe6a52c4d41842fc9004298aaca27db23f881160da3872ec9c3e216ac8723539d5f1f4aa34836d20b4b02b4ecb560cec1b192e989464e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7d8a8c04e7d9eb7554d52c3c50c1d33
SHA1359752aebde94286e17b730ad26a059df8f18d26
SHA256add531e012e93a0acd111f760c1764e189cd9b57af73953467dfc5398b0ba443
SHA5121ab0e9585008be3e7a6f7f7938c5f436a96cf15d5f15ef7b7d597faea6de370a78dd4a515b3890a9e624bca74660f334c3a09b04faa48a9021d928c9a991b491
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbb8629e0acbd80b942d87f0f60a00db
SHA1f18422ef8328d1dd438fb24df1ea9cdd7ff7854f
SHA2565218ca095c9d41399f7b6af54316fdd74eda38d4873447a22d30a15778261bc5
SHA512f350fa3987a2ed52695132986e8846b718a83b3be476d653366c61d346ad09d7bd386d22296e358bcc68935dcb6378bd2f4c630d853d97554ee68b021f0065c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d79d74daf74abd02a246117ec05ad6e1
SHA194facc382c5365be61fff4cc9177095188a75fd8
SHA256c5b612f67f805fce17489cfc9edea8dab95a39b03fa374fa4ca36c35fb165ec8
SHA5126dafa45a2d0a92131e876ef8e37c721098badbe949d8c06fd052e51c74d5bd0c0f9a9ddf66efebf5102ac2ec8090e7e826fae1c394ffc732cc293edd3ef0e44e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ad399f13df46d4beef4af02d8a2a3ee
SHA16ebce4e8de2ccdd206eac1a71ab51a0647a1a470
SHA25684aeda64ea431a9927ae42d9aa0d403d48df80fd685f1bbdc41f492a201f21a8
SHA5123333cffdb0a6237f311398d52d436378eb333155ba33d63ba671b7c6b3c869a5c744c0052ebfe6d48e0f753a2b0fb39325b5e956cc85f86b78210b65a4b6f375
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aba5bc5589467ef0ea25e99d96dacda6
SHA13004b07fbe509b468d4a9a33b05b663b17540d61
SHA256ed77db4c385f2c39e178eecaf2d2280a2a4187da6bb5325518965418f8e4eed6
SHA512d5dd02a07de4b25378d28a701e97b8c86ee703961f0e7a3e134980cb73aeac33ef386df7a495e0f775c2c639c83bf47ee8b46a8b01d3caacc438ecf83af51792
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a097d8318b95fb14fe4ff267ac886234
SHA1a29362a7dbd39097628f05e463287ee494180c93
SHA256bd975bcb7280006bf7ebeded6d71f2d8e2a99601d9152275407b7abd89d3d152
SHA5128f4c4bcd5ae9964dae8bb314c10dd363de0936a981e6f77a6d834201fbd2134bac3f1e12202fd2358fefb0a8677ecb43b0ed293581df9fd8811453a37403fd66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9a4841c8ef13657e54b4c1186fd6b77
SHA18f91bcecf0af2ec9573b578ec33f0e15a1ca6aa0
SHA256088ad8e85ad37fc5596bba339ae2946d5049280382b3f1f304c2fca4fe48b72b
SHA512277ce0a6cf2f8e8d8e26649f75774d298f74abf7c5ed7a554e11237529ee6759121b4c35821cb775ac7d7ee80d45fd049f5223ad5acfac17792ac600f62b0ea6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b831844823a37f96cd6894309ecb1f09
SHA1d01252fcf6281f302f6f7158c61722734beb3966
SHA2562d5903a84586030b48dc48f6d58e3bce1064e344dfb094d332a1fd7ca60c8568
SHA5129b4c99f117ecb101fc64d680bbf4a189aebfcb2ebb695cb4db5c614b50c254788c35beb565893b4f46d4322d5166fd46083a0323b08bf58045a6ba0979faf8a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8b6513f236da1c66f4eac115cd3d032
SHA1d17afb0d092c0d12eb093bc3233b2230284ee007
SHA2563cb9f0194cd1657764cf4462fdd30431327d89b54170f97cf727e197502a01c4
SHA5127437215bf50f0b7fb2a21ffd8c550854f674486c33c5c16e378acfc1f32a6317567688ba5416bd525301c08cfa842c6567af22ac061e8cdf72a38f73175da120
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5318222707454ecd55b47b11fefc4e9a4
SHA1d71e2f54fc479f0f8b18d5e55229cfa3846e048d
SHA2567b22379b3013a3e50cec163aabde148f37c7c2eec278fced52b446afb75e8ffc
SHA512e2543401ef6284ef977c0fea6f30c5f3f38a52a629483cff98dfe16f2a5a6a12ed3003778c655564cecab9c0d8955f1de24f613471c9f3e9a533cf4f93ae6de9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d74bbe5794b11ad76c86efc504bebb19
SHA17f988822871516d28f479bcf3cfd03736e757419
SHA25606beadf7055c5d52ff5b0baa27f20a882b7e72d3c19a886d64feac6d84fb0bd2
SHA51268d6442889ed7a9627981e75b4f3d954b6491bd545e98203e18bf0896568eea5fa7e6295aaf0830fb16650230e784c73f64cd37dff11309a503f284a4bc36747
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2d34e2595c913affdc59490cca92b8b
SHA162fde6db66084b65ee44040d5f736036141b0aad
SHA25645735111651ad39e94dbf9846291458408f3980e0f6a0705ca34f272355ad8a2
SHA512c4678778fb9245ac8126d0f093cee65e5c60d1fa1253dc269579746680029dfe7b2bf0e5a601cc4541e22dc106017167a8248397a6004517077bcd24d6348f01
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06