Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 21:45
Static task
static1
Behavioral task
behavioral1
Sample
3df65e99d14c9aef550acb74b340c8dc.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3df65e99d14c9aef550acb74b340c8dc.html
Resource
win10v2004-20231215-en
General
-
Target
3df65e99d14c9aef550acb74b340c8dc.html
-
Size
38KB
-
MD5
3df65e99d14c9aef550acb74b340c8dc
-
SHA1
f7f5a2e0a717df4a7070466a12dacccd849e8343
-
SHA256
992b0eb95dfbfc404126084014455c23342d180e4f3ac4fbbcef6991847f0315
-
SHA512
d36950300918a49f0ccdb134541664a8ec4bd5a011a6cea6e27753e9a42cfa470c3b5ac43865afc39f38e9ed1186477306417cf6b86dbaa72cc5c34b9313bf55
-
SSDEEP
384:LYfeNIS2ZPxiPavHHw/PjU/vHx1ZaMD35854zCwhzURDIeX5vnebawn4CYR1rT9V:LYfk27vHHw/PkawW/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000963f6b12cbaa07785fabd577c88018c52b6bb7e1e02e1d84dbe9dce86b41dfaf000000000e800000000200002000000003472f0b98553ff0855707fa33e372dd92181f7543d172b0d8b44d085ceaf07090000000d1b04e1a3d585b9845020a2b5b3cf5b4442b65ef748320d9073ec0df514ff38cce710da2ca65279b052d0496f2e8dcb10a33831045939aa67893727e87ef62d6885c2941f9b1719c33b9f2d65c71f0eb608c759ceffc032177483fcd59627332ebcf75350daa042e6a003d1e279ededb0fe49dbbcbf6beb619010257095253f324c4bcaeafa78b4bba5cc78136c61d8b40000000e055be36c285ecc28656413387f4a4502c0e63b0f40e4f9398ed3de0c53b71002871271fb6c6d924de605cdeb1aef816fcda32b6165c3716130083c82d6368f7 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3F364F31-A8EF-11EE-AEE7-F2B23B8A8DD7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4088d614fc3cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410307492" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd76917334189000000000200000000001066000000010000200000005526aab1a1cae658009ac6860d8042bfe6aaa1230f51117b2a8e12f90396577f000000000e80000000020000200000001f2450bb8dce92448f66d0b0077d03447011612cc5ee59f75274b70334b9d1e320000000aefcf8dbc433d3499c088ae227ea2d16f072bdcc9cede9e6fc1550047f228ed5400000002f66659eda584ac53c0e7684d6e1cd65472eb3658d2c8b8c5fc160f9bd5e3fa16168981d856d17fd72730fc6216d0805c313d5402a2e59a3ed1cc231b3808f2c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2344 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2344 iexplore.exe 2344 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2344 wrote to memory of 2700 2344 iexplore.exe 30 PID 2344 wrote to memory of 2700 2344 iexplore.exe 30 PID 2344 wrote to memory of 2700 2344 iexplore.exe 30 PID 2344 wrote to memory of 2700 2344 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3df65e99d14c9aef550acb74b340c8dc.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2344 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD571feb0f48d9979a8f322ba4daafd93f0
SHA10c218bfb0c4e0ce29560734ca96fd1d9005ac9fc
SHA256cf94a22bcbc9f8e7578a1874b1a2ecf80e1af784f3d8466f4375e925973eff89
SHA512d007731389b6da70812885ae12a66e1b173dd048204663b5b739f3a6c69dfa521529521368741a2968c7f9ef56aa7ac199aaaaa9bec723304cb41e0b1fddd5ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD541132cd0374e724ec2066cebbce16d67
SHA19e035f3516097d01184f421210247fca618cb778
SHA256025592a5b3af0abf9a892b8bc20c3f5b2f608d05e546b16e709a67e0af0c9d64
SHA51210c1683a1a8bdd9d5f2580ac7ec1dad022d14246219096d6f726bf78880b66eb67618490d5644333ac281974e781bc7389e29dcbe09d76d3989743d17cc05dd6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537a6a303617bab2de1f5af0eb4ca3ce7
SHA1aab73870e290b97444a549d09ca791012fd1565d
SHA2562c1bdb7be6c4dc6fc759238d68db5a4d1754174b551b5afd97a6445d273c21e3
SHA5127628911c9500163921ddc8496fc166b345685d633f461042eb4ffc7e75b57e66b9e712b0cf4c4166cbaceee98c53078a26b372e3a6d4d42f9fa4739d1f5c7c78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576399846a283f028422aa0f94d21ca30
SHA17082250b444690e865fba4d06c8d21e0b12f9abc
SHA2561621a4cc40622c361fb98b4a2c172a02a61fbfd8a3ed7129c5a749620813ebd5
SHA512ec814aa36d023a46fdc236ed333a7324f1584eeef3ada6584dd05a570730dfb20e82fe7076b95c3fc7e75c0844122a602d9b88626094a293e0b619884d2fe2ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a5527ec21cd5cb95eb3fe35bafce0704
SHA196b4015e520c4e5957640a0d3c21f5f744b008fd
SHA2566d15e949002ac587abb439ef668dcdc5c933201e343eb4f29b53ba2b6bf1440e
SHA512be1bcc04b238b3d5ab145799a2b2a8201092988e97de296156eb971e3cc303fcb5df80a44ea6b1399462385e2916307727b15213d46dcc9a88c537ae84f77781
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a4cb461170a5b5c85f0074b55d56e41
SHA1f7ea279767a8d054d5c916f68823e0f495e2dcc4
SHA256f554e0e21e249c3bac4dd856873e8a0aea9fc2f9df1c658f233d91801f6c1e5c
SHA5123c4aaecb5aa0f2e703b44b2753dd1a91e48f309fae9207f72c8bea7accaebbdae5c4ecb5065d451f8c255735130756ec8be1a204ed8bb56515c76ef45c4be153
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58390aaadffa8731d4927ce848c1312eb
SHA114df7c4d5a7529cdbc6b25e1b8fcc7bca7802b3b
SHA256fea8bea4d672c88405424016cefa55b0ced9de4bbac2a194d4d748ac1f6fdcaf
SHA51269887df73a429940ff2b2bb9f77738e524e2a4951a88ffea99d6673a0ecf8ee34adc9de1195b7e32499bef9d9c0f31fceaf233dfc2de784552ee864b1a851b33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD577635deeb10f86b664f75a456854e569
SHA10707a2546a7b6806c85b926f4f9645d86c32b531
SHA256f8e2d5bd58932433aee7e4552e56801ee441b739512bdd54924f381aa79a2b65
SHA5123e47fafa5158df2640dbbd99983b9949106d16cfad0ae18166fdc240ed480966cab7849dda6bd70b6ae885ca97817ef18a8542de7a47495ef969aa047906b493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e3a2ff21d425eb023d15ccc156eb3c67
SHA140851736f79c20cd55b2f903fe0e8348c261dde0
SHA256b4baac899e4ee1c19f81969ec246017f1e546a60945397ff5a59a0b86a2c5462
SHA512ab120c3d72e3bf84f2a271c020295c4c2deb5bc0d3d54247937d9fac15bef17f69dd15792cf7d2db3f4d46b2d72ee0377e784babf6753f3eedf41d3b290dbcb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546cdc16b99f93ed184147f2a9384194e
SHA101815c97f1f508cc0f7db45f832ef4ef82013ddf
SHA2563bff44141a6d0ff5bfaee29ed4b3e246bb6d7d40fc92a1d094d33ba905aefe97
SHA5121069eb1acae571ee976f4102b67556d70f1af45fc1295cbaf541a63cad78b38104ce9634fda40e037050432a4d97f88739558a253367a094aeaab422e137eeb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD554140fe1a5547015d8d17970d7aaa7d4
SHA1804743ae0291ea7e161c1d3bf4cf86eaa8589abc
SHA2562782d924befe254cdac0f54c1f9d5e90b5452816f824d29a6d5c80e136080989
SHA5120daf989f00b75d67e2f1406efc3a71739c4266db0b52a1539f18502ec3a7e8efb2a4f5874fbb8189cdaa8eb21d8329b9fb283b4a93f9e3b0c446adfa37bfa0e2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
148KB
MD531a7077a5dde9afd73734e0a1f67ffdc
SHA1a7861242935919453c344c0daea8480d1aa952c2
SHA25689916421c65ec37c339f3d0d1848157d3997a32ee81e4c9e5a103880f69fcc3f
SHA5125cffacdab3c60e8635c84ced7c002cc2313c87ef9e84e359b50b4cdc825ee66db278f6c30721ec3b2d7e62235a32c1988f8e6be903a1043c39ad501407c65202