Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 14:12
Static task
static1
Behavioral task
behavioral1
Sample
3959fc5f8834eea3247aa9d4f7b103a4.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3959fc5f8834eea3247aa9d4f7b103a4.html
Resource
win10v2004-20231215-en
General
-
Target
3959fc5f8834eea3247aa9d4f7b103a4.html
-
Size
33KB
-
MD5
3959fc5f8834eea3247aa9d4f7b103a4
-
SHA1
3985052ca5b2db6f1daf413a430a6f7e62a195ad
-
SHA256
49a3a214fdd96f9803beb15f1743f5f68fe13144819ef2538c7578dce3f4bf7b
-
SHA512
f964e5cd21e3e499e02fdc4ab62fac8a18b731278d7d7ac8102924ecbe7a7ec45b5f6a08093ff0dca0c9362e491fe17b3e52e851984684a56e93c0638fb6821f
-
SSDEEP
768:Vnj5hC8r25rTQiCgo19UIkCXboTKlw3B3VOXhqsAZXscO5tsebnv7LKPfCkD/fvg:nhC8r25rTQiCgo19UIkCXboTKlw3B3kF
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8AA2F3B1-AFF7-11EE-9DE3-E6B549E8BD88} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000298fa3e13193676b5bab91aabc96cd1c8776d44fa92aaee2edd3239564cb62b8000000000e80000000020000200000009e064d14bd4e21ab91b3e931ec2f2b025241acc0088b7ad3af419f63e41dc53b2000000082c116f5a0d661623874c270413f40e2b15c14af7347347bcaf230de6a45c1324000000045444c859dce7f2db94a0a52325e26dd7ac9b70e10322d7db60ae50694d3280e667b03bf625d32a002615b41dad5d9dd9995448d3ad6901fc53ec0c7bb19e436 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000059c3ca2be554d78f9d4db6629ed9d422c1d570cbe3e39ff47c1751e0ff686b38000000000e80000000020000200000001dbcbefa6ae5da4a5163d1ea09975347b65c083b76ca0103decc5e94008ccb5e9000000064eeddeefd4dfb12c4e4e29331e1814deb6bc380d20f1455f7a8a4fe0c5caa9df4ce39f522c559406f3407fb084bc14fc9289f3e53c3e4deb182b087278bc6bba64136f19a5ba144216a5d5dae94dd90627a205f341197a4504a35180f57fb8ebbbea833b32c128da95b1acb1f00a8840178d39f82d5333547c187cf48c089a32f2152e3788b134930550381512bfd0540000000bed3463be493fc1dec98b96d8be1b02f6f109fff4fa3a079d59d25b61bc8d3b8de622c1ad36dc88eec17089804d678c824572f495a303c67458e1ca0d76ae07a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411080692" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0c49d640444da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2724 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2724 iexplore.exe 2724 iexplore.exe 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE 2352 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2724 wrote to memory of 2352 2724 iexplore.exe 28 PID 2724 wrote to memory of 2352 2724 iexplore.exe 28 PID 2724 wrote to memory of 2352 2724 iexplore.exe 28 PID 2724 wrote to memory of 2352 2724 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3959fc5f8834eea3247aa9d4f7b103a4.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2352
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD58e0bf32b91e23de7e6e15862056f154b
SHA126853de9cb0f22442c9e425aa89c3136ee70d895
SHA2562483ac5d7b709e2aae682ab15c8adf86fe18ed000e99552ec5e0ab5856cc61aa
SHA51284785b93cba48cd7a917d9741c3b18ed638a0e2dc291200d0b2d3fac60ac8f39039ff2aec81ce9e9dc50e5212160d48d2b0638dcf48a36fc9d727c8ccab69225
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594ffbd96c0524f5bb7c6d51cace01d6d
SHA1c767fb42ccc636cc46f254d818ddb27cd2185916
SHA2569e53164fc30034904b19c4fccc65d4b903ba63b5921af6a7b3794efdc689b9ae
SHA51262558331c30f251a6061923843a1ca075153753f4254a54b8f881b9a0c62f2916226b7cbfba1bdcc68d63c829f047a1d3e38add4b923e3802c01c58024b2f454
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c21f70bddee05526fb6d6137cc14333e
SHA1fb637bc436908c67d052fa17c1d0800e6e7acf6c
SHA2560d47bcf8905c9fcea4815a5c10b382721a5ef1a8394b8adbc06fda4c1a59d2bc
SHA512d741f56cf2c0803fd0f3ac84f82e58bd88c635d7854de16ba456f2a2b6c680acaa0f1451333a60f7df8753add605e8517fabc127002709a2d9d75ba6e2798702
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f52efd3117d6c00c3c66a2a9c9486a0
SHA18a8f142c702281cd3d6c1d00400f3ee0a3d53bbb
SHA2568adeb937ec6bf8b9b801d8d4acc1c379bc1eb4fd320806e59aaac351b70b35fb
SHA512d637c4ec3d0881cbf108234df9fd743576be48e487c5e3db8f6a3e87698f82e11c898b287d505854a2c909a8d97acdd9e5d88eedff1e6e3ceaf9b9ff375da2d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f394138284cd02f66787e060041d1d8
SHA17d4ece9ee73b9beeb2a1fd498055ee235ff6ae38
SHA256dd98d1a06863343d2094a303735831c8af4d6c9a43e2ac2f21a0d44f2574b4cf
SHA5127a8cd25d8f20077ab80814b259e5092b91641a2af14dd61700a522bc6d31312ed0eac4ea763b68a09104dcf9542c992f742583d5b3108957f6f566f81437fe91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a564e38e2f554f2a7dbb83f097da6d7f
SHA1ae83201fa5f1d546e00ede31a20cedcf8526551f
SHA2560964be3ae6c3216e123c67588d27205ce466c540e9e8fc9fc92c4535dd87ad97
SHA51296fa81df515c3fd5a9590366f3699497aaa3f231ac5a7e00ac3e494ef955c68b700bf0569717d6d8ccd5da8697f1ac29035322b3b72f4ea1e31db76450cbb6c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e13bd7000e35e1dc83f050750d0bd547
SHA1f7368b799918b9f85e1f53cf77baf7f26abf8730
SHA25669d1c745c60e00da5c50882563f32f46abad012b17e743f781bfdf19a1554c5b
SHA512cc2164b7697c54d7f33d484ee7d5a2122943677d0120def74bd72d82205cf3d5679c291c2a2a0c4603f1fa47b841397aca9370aa146065d41107a1c2bd62faf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512bbab78615fb6589d2b11bda0e8488e
SHA1b79288d5b53683ed0c49670a22c9fbaf6587bcec
SHA256122be133476d350d2e4423539cdf097f80bf30a7ba1145e789723f23a49ff621
SHA512e55ca43b52d2d1880b27aa2a3f0f30e5eca4394d641629677c457eb3caf154c5096d219b4db7638e4be6dbd46a0a24ecc3000a49fd7835f29d9be06fc2590a22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD59aa2e19940792743ed2e804a3a077b49
SHA166a98a889f68d0efcfb6abe6153c8c02f3101e13
SHA256a61c31c54ac4519b90bdecb7b619b4142a6a28ee937993c18db393052af525a9
SHA5126c5889fd0fa5e4b52abb070bd3606ca83022e7024b7efeea08690eed290346458f1593a772c258d9ef8274f9e725607718e0bd41398f3c9dad8809db4cfdfd30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IREXL1SO\bItdLgimw[1].js
Filesize31KB
MD559322eb1e702e43fa4d4104c80d7770b
SHA1eba102cd3fef8270e8703d15efdc3d0d0d4f1da8
SHA25642789b56ef9ea52e8ecee805f214f4ce21beed10147a76cf648399f20318ddbc
SHA5129e7f21f9d0cb51f916db08b23eaca13bd9ba77d235b670d0f85e867e6300b9c9974da21fb3034b5c6158743e71cc6f29dccd26332c282184c105308236b3c7e5