Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:19 UTC
Static task
static1
Behavioral task
behavioral1
Sample
37b59454b3ddc9333836ce13bd75adca.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
37b59454b3ddc9333836ce13bd75adca.html
Resource
win10v2004-20231215-en
General
-
Target
37b59454b3ddc9333836ce13bd75adca.html
-
Size
6KB
-
MD5
37b59454b3ddc9333836ce13bd75adca
-
SHA1
69a1c9946b3a9252fbb58d1445779cf149ca14b0
-
SHA256
e20a97b0dca2f8d69a5f39e24468f65b5881f466ae4953011722d5045320eb81
-
SHA512
b99c4304f74e73b45363dc6a1ec85418a99f53801f20c62c2e73d842a0d7c586e036e7510c19735540ef3c361e2be35cd9af2f64606ee487033f5a5460bd400b
-
SSDEEP
96:uzVs+ux7TWLLY1k9o84d12ef7CSTUHZcEZ7ru7f:csz7TWAYS/mb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000b4b4fa9c3de13ef517084b788c038b0e4d5c162ffe781525cee183ccfb2bb304000000000e8000000002000020000000ae4266536471cb0ef041b5d926ae85405a1b9b074be13c4b80cd83141476907020000000805b612c56e5267760ded9127ff721e9d19252eb91048819fff4949e718e72a940000000543aafad72ce7257acfd7c57ac473955eaa417e10a2349b591f53d1c2b7f17ccbf8108f07ddf31bdb0ba434304c2e726c064eb161b3d903805675e5352e665a8 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411068282" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2069ea7ae743da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000d64624fbb28708e1d665e2518a03c6a16583340a7836819d45629f2d1270ab1a000000000e8000000002000020000000202f2e10da94189f9cc7958ab42143b00d1999d9b3ca8276aa2236eacf671f9c90000000b0b1049b611466214988088e17ab2362a883b9c26ea9b12d34c9cc6ad628067696cb9cac15e597424fbea0837c3b2af43b730227fb21fb6475ecd42e2898e48bfd1071c26c2af3bfa4e4b54e1024c0738310f492bff712315dfde3b520d2b016c089fca6d3931894351c2fef083613bce4f8601390ae5e207fd84dac935a6015bebef6899bd86b257a4f83542557b3b2400000004b869067031e43f8057664d25d8183f8c5ff885496d27334e8d548e9fabbef3109c4a9cc9db1cabede2e99a3989e994982e0f230aab9157eb280456f0302f383 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3D56A61-AFDA-11EE-88F9-76B33C18F4CF} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2224 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2224 iexplore.exe 2224 iexplore.exe 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE 1372 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1372 2224 iexplore.exe 28 PID 2224 wrote to memory of 1372 2224 iexplore.exe 28 PID 2224 wrote to memory of 1372 2224 iexplore.exe 28 PID 2224 wrote to memory of 1372 2224 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\37b59454b3ddc9333836ce13bd75adca.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2224 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1372
-
Network
-
Remote address:8.8.8.8:53Requestcounters.gigya.comIN AResponse
-
Remote address:8.8.8.8:53Requestanalytics.hosting24.comIN AResponse
-
Remote address:8.8.8.8:53Requestfc01.deviantart.netIN AResponsefc01.deviantart.netIN A35.82.170.47fc01.deviantart.netIN A52.40.105.29fc01.deviantart.netIN A54.187.148.60
-
Remote address:8.8.8.8:53Requestfc01.deviantart.netIN A
-
Remote address:8.8.8.8:53Requestfc01.deviantart.netIN A
-
GEThttp://fc01.deviantart.net/fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpgIEXPLORE.EXERemote address:35.82.170.47:80RequestGET /fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: fc01.deviantart.net
Connection: Keep-Alive
ResponseHTTP/1.1 301 Moved Permanently
Content-Type: text/html
Content-Length: 178
Connection: keep-alive
Server: nginx
Location: http://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpg
-
Remote address:8.8.8.8:53Requestorig01.deviantart.netIN AResponseorig01.deviantart.netIN A44.232.141.196orig01.deviantart.netIN A35.164.248.218orig01.deviantart.netIN A54.188.178.16
-
GEThttp://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpgIEXPLORE.EXERemote address:44.232.141.196:80RequestGET /2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpg HTTP/1.1
Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: orig01.deviantart.net
Connection: Keep-Alive
ResponseHTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
Server: da-redirector/0.5.2
-
35.82.170.47:80http://fc01.deviantart.net/fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpghttpIEXPLORE.EXE606 B 650 B 6 5
HTTP Request
GET http://fc01.deviantart.net/fs47/f/2009/249/a/c/Red_and_Black_Vista_Wallpaper_by_Treber.jpgHTTP Response
301 -
190 B 132 B 4 3
-
44.232.141.196:80http://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpghttpIEXPLORE.EXE746 B 507 B 9 8
HTTP Request
GET http://orig01.deviantart.net/2350/f/2009/249/a/c/red_and_black_vista_wallpaper_by_treber.jpgHTTP Response
404 -
236 B 172 B 5 4
-
845 B 7.9kB 11 12
-
1.2kB 7.9kB 12 13
-
1.1kB 7.8kB 11 11
-
64 B 129 B 1 1
DNS Request
counters.gigya.com
-
69 B 124 B 1 1
DNS Request
analytics.hosting24.com
-
195 B 113 B 3 1
DNS Request
fc01.deviantart.net
DNS Request
fc01.deviantart.net
DNS Request
fc01.deviantart.net
DNS Response
35.82.170.4752.40.105.2954.187.148.60
-
67 B 115 B 1 1
DNS Request
orig01.deviantart.net
DNS Response
44.232.141.19635.164.248.21854.188.178.16
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5780de2339575a4ec616f3f903f92e9b8
SHA15b5c59ac54c83161eff4246a577e2a7d187dc2a4
SHA2569526023716fbdd77a2c7531027cea1304fcc45bf55bc29fe77953102d9342af8
SHA512546afd73e033c33eb837b8586949bb5ef8510051717d59b2c57c7d1b5583b9ef8c1b3ae6e3d5b8bf8d35978f545054803b606496f096925ff948b2f551e89266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5802a85590b5fdfa332229b73788be081
SHA13995df1978a6ab992587c3aaa7a71db39ae5b22a
SHA25651b67819efb307d4ec9839998b954e6f7f31715baf7dae6ce3ab99a7bcd8ed23
SHA51216ef6ffac4cdeab207d3883804cbb414e4b082b8cbd1332d11e3b7f84e767eddb83bc06844fdd63c9486d8a8513572bbfe3aaf70f4f80661aaa2c528b15b94e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52835813e7b06952764fe24e8ed4fd9cc
SHA1c93271b45df5c9d356531ae7d61915d087e74c0e
SHA256be68cff22227c1e0f5e2798baba616780a1b58f5ef242bf63af25a0d80318edc
SHA5128b488c8bb89d8330cd83aa213b4ab303b45b24b98b464c8e6744eaadc0d540b5829933742bda4a37f7cfd13bc9677066d76bff6f70085fa0288a14e855bb47b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a3baaaa6b2e4067b1902da432b2b699
SHA141a165d6447febb190ec7d93c1a3881004517455
SHA2568bfffaa3ad601267fa3d2cb9506e4f66e2dfda11572ae25f6c2bcea9644793a3
SHA5123a7e90eef60c373b7eac1f15a7b70e8d713c349fca13e76aabed01d7c6de77da2092626b8434b97fa9eadd4aecb6806ef757ff61ae602e4f7cf421cf56ca9cfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c264f41d4431c49cef611cbf9eb8431
SHA108f9970b47a2692bab9d71efc7551110d7449892
SHA256e12e88908ea7f2ef5e15f364a9f7158bc6bb692a35186aa5dfbc70df574b089f
SHA512cf05226c672d6ef97c00c0f8574b7a8b94326116a4c8aa696ef9095b0f86ae7da277e53d1d08a67d9d09ea3251e03fbaaa864f731399901e4f32e9ecdef02505
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c4df7645f9e619ccdbb2dbb2a676f65
SHA14de3f4cb9dc1084f933d48ddaa1c49b3da25d114
SHA256507473fa06136e73d07bc094a13d243e0dd9bc6cd22ac7766467d4717ce29e5e
SHA5120c1888773817502bd6d8a445869b72d5648cbb10f75ed2563089a57be81267683c9497a516f2f441c8e77bd2311be01c6820349c58da3a61c1056dd11e5a33bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9934232c035987d2727e98ef78a32f1
SHA1aa9a5e6e8c62139deb13afdb465b24b833ed7702
SHA2560b48638e337c9485bae55e0d8564f6fef36e2af7720ca3bdf49a76643bbd1a84
SHA5122bd652aa47e61ab941984252470cc7c282540963475b292ded2d6c5b99b2862738040079f6832dc5399138549587c994e4287c5606c6726945a6b9abac91d732
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b87f6dd152ea0a327892f6c69a29b6cc
SHA19e48653efe5f61838e5de206dae82f9e0d4a4713
SHA256ab29891add5c1476bb20c207ddc6ba8de733b52efa7da0109299ba37b2a15e20
SHA5120a874dbb47c6168fcdf095ef960fd13f515124ea3d590ef2901e823ab07ab9a605a56c3d815485ce80be0e83b98afd3895c0e25416063f270fc87c3209aeafdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53edc5a7227eede3a5996f12c88cd541b
SHA10bf7fa8ed6297692edd9969631d19d0f83ecc727
SHA2567ddb4bfb1750a310619b98b342ce2a5600b1c8a0583707e3b9fea129d7ecbbb2
SHA512e077790192332c79b60706b7b06422b3b9e2f56c5a920bc5592db5f2715acc1ef00a1e1d3189982354e4800f621033142a6bcd7e5b9e0b597ae61fd94c407f86
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06