Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
3a43373607bf52fe3c1d69f4d5dc21b6.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3a43373607bf52fe3c1d69f4d5dc21b6.html
Resource
win10v2004-20231215-en
General
-
Target
3a43373607bf52fe3c1d69f4d5dc21b6.html
-
Size
36KB
-
MD5
3a43373607bf52fe3c1d69f4d5dc21b6
-
SHA1
1081247d88d0cff5cf824f059b9b901456404536
-
SHA256
478c1a632aead03730120a5eb4f291186b78494b68ba3d7688bd6e8c1bf70c2b
-
SHA512
0a95b0f68bffec6248c454fbc227cf387982cacabff86e225e483221cb6d79b4047d53c7ea5d1c6385959f7c7a726bd23c1e327b28f58acbaf36df6860f4d1e5
-
SSDEEP
768:S6VQVwdQXKhtcxjyMPv6g55jDaHwkIS/r37FXvuYFHoeiUjclGbJf+kOpbsWDta+:S6VQVwdQXKhtcxjyMPv6g55jDarIS/rI
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6013CC21-B004-11EE-B49B-CE253106968E} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2964 2028 iexplore.exe 15 PID 2028 wrote to memory of 2964 2028 iexplore.exe 15 PID 2028 wrote to memory of 2964 2028 iexplore.exe 15 PID 2028 wrote to memory of 2964 2028 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3a43373607bf52fe3c1d69f4d5dc21b6.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541ba23628b8b1203a0c7dc3d14759409
SHA1889d0e419b60415fbf039ec2a90aab0b8a1d82d7
SHA2566084aedaf9442da3322d0e2ef47e52d050c69dc437ace15b728aa0155c908c98
SHA512d9f3c0ce1a32aa3004ff2d5c14fb8058e40303112afe86a638097d62553040cca9a30bad788dd0837c8e0ec64f1d182dad78881073a2626da0c2a19d03513512
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3303c98a9edce21019ab4016e516423
SHA1f5301a6eaf38275f1390444cef4044efb5616704
SHA256746828612fe540d5eccab3b7f72c9e248dc1b543e18038abd8de20ddfd8830d3
SHA5123c28073566d17ba89ff2c7cbe22a2c45f5a484554e51baf8680294f11d94b4d4c6d43545c5ff76f4abee00a68206a5bca3f29877f232a34f4df085e99b03e9a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d2f247f4add3571301ce8db39c881b9
SHA12edfb9265f0ed3f448b8e1860f61925b978702b3
SHA256aa011b7559da5eea6094a1202c4fbb64023e78a81d4cb332ab3de32dbedeb57b
SHA512715076fc2ca2dea3154c958d820f3342ea3e65b3d556392e3233c99143a8cba686a3eed0cc2b1261e098b68aaaa3108896d783e39f19fd3283d1473a52f7493d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a25652c7111aebea824a011cae063a7f
SHA13ce2cdfd5b8fa55c46dfd4b00d28023ba29cc370
SHA25627b757734b944cf4d06107420a6d4f4ffd7ef009c40aa4d2a5225cdb0e0ce310
SHA512f9e4e6e3e9a7dd9d324fce688df7ab5aa743f1dac6c777395f6788857d3206c9caca026144e6a3b0d13874f5de435a456e4d6dcea12ca9521a6eb525136cef86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b876525f684a55b30edb06775d46870a
SHA1213de1b7915b5fc0ddd7efa45ef25523cd43bf4f
SHA256cac4ac65d531ba908ea91e3641a8382423d7dfb335a52c2fc9fe5dd42b205905
SHA51203e6637df2dbfc88c3f5673ae025183c7a4a866fa3e3aa9a95f09a016a770d06285c9d7ed5e6546119cff2892ddc3ca859ac0749108ffd49bab24e841af627a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fad03dd4f9a542dd6d7bbdd43663191
SHA19860b71eebf0b27ae5b7a09d5d72a91c1fb51938
SHA256259943116b012b825740ed8834ecae2eb0fa21393d90b7d48539f1881e34585e
SHA512226a58a91e0bb554f9490dba785ec7ac8611eac7c563c1e58ac19c5e38cc66967e53c2e8aab718a30bf62a47a0c0ab3665b3249c1033a7df55c1ab609c0bedd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ae1a79b690bb5582583c4d509cea7db
SHA198bd152f7df7f41a180dbc751648832aa7a59923
SHA256dcec7b91af038f764f89332962cbf133cf3dfc3d9398d02b5d8c22cd34842c8d
SHA5122f172e244c5054a1db5aa7cfc7cb9788e3d98f19f5402e0ab0cbcda17f9807a9cd7b5e1584dde2ac0fc0ba83b1dfd07a5b01c65619e5f36eb4342b2441bc7bb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddb55ba042c9fc774a364822d942b1bd
SHA147d130cc466798b12c9c40dfe07fea1cc0d0673f
SHA2564c9ab83a10fbe9e3cd89a01e04c934c5b45908a53e041a41139c0584053e2ca2
SHA512d247466a735639f535db6d6a01399487f1229cbceb21881f43f8b2e5bad9741e9f42d9b1490bd7373537326f8a15897469d5018d44d46c128d2cc37d39551039
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fac4a66f3c536cb9b6cf7a644cdfb55e
SHA1855dd2b979ee5b838a549db8860ab043343eca4c
SHA256bacde7a1ec4bb63f183041e6602136ee851e3f6ec1ab6001e586f633af066d58
SHA512433f434d078da50c6ca49a492cc9aef19a0750c164ae5193262e5046cda1d5fb890fba5bbbb9ff1a1b745c64f763ecb64bda88ce600772ef3b7676dbd1748f9e
-
Filesize
92KB
MD571e4ce8b3a1b89f335a6936bbdafce4c
SHA16e0d450eb5f316a9924b3e58445b26bfb727001e
SHA256a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5
SHA512b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7