Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 23:54
Static task
static1
Behavioral task
behavioral1
Sample
3e3181537133d556cee8ce7811f942b2.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3e3181537133d556cee8ce7811f942b2.html
Resource
win10v2004-20231215-en
General
-
Target
3e3181537133d556cee8ce7811f942b2.html
-
Size
3.5MB
-
MD5
3e3181537133d556cee8ce7811f942b2
-
SHA1
8ba85f98dd0d4a353e00f1d617c4c6aab3757076
-
SHA256
069833d50dd0b44bffd46d6b7f49f42b1add46a67b5629f5e505008c6dbebc60
-
SHA512
a58a2153b9612597e28eca8c6bad8b22110764e90f7300ceb31796bd71e9b77d7214ca17efaf37ad075c61b61864e954ede3ffae63d59d8971b6a79248876bcb
-
SSDEEP
12288:jLZhBVKHfVfitmg11tmg1P16bf7axluxOT6NNs:jvpjte4tT6Ds
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000276fa69d8ab8458d373e56e62593ccd14725c2b6df758dd9a4aa976952ecca39000000000e8000000002000020000000c3662e5b7f1f5ca2a101f789519aa8586ff6ab548d1581130451c19a69226dc0900000005a05fbf1bf2deaab804b282e47a97f1934bf08caf4c366d4faf568a5f4f7eef8cc7d370399e31ad8dea6edcbbde2c3579567a18577c822837f2e8cc89e5d49babe5aceae9968e39a4b9d20b7474a08d1d5b82b017323102461a9ec87f39feb89c5c7b2b773fdb809555a3e632541fb3969cc1273fb5bb363f818c72c711a5a27e40a95cddb1999a6742e4e2fff57c5a94000000003a57688103d4ac008d1d056415ebda8e484e60faa60c61ad303b7b63d51aad67548b37c9ad9251deb13c31541a0fb4a8e6ff9015a4de57d7065103526163b5b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000a7c1e037974446ab7c1b9c166d4cae903fa67af78c691ffcc921feb9cbc3e5fb000000000e8000000002000020000000a4897728a7c9a1dededd824e1e6aaab3be326cf5ff733d852a777b4c8b733d4720000000b4ed4831851c15ec17ed3b4cc23aee82bc30d2764dd6e9cf1e8c2760b2ed9c3a400000003b17925784b1d2c381fc905ff066a566bfc5e1970134aa94dde19a44eed77812264ad6e8807924ed681dbbcf3c87c58c571469bf5e3a66b9f41280e269cb2dcc iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{345076B1-A901-11EE-B092-D2016227024C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3045701b0e3dda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410315190" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2268 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2268 iexplore.exe 2268 iexplore.exe 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE 2004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2268 wrote to memory of 2004 2268 iexplore.exe 24 PID 2268 wrote to memory of 2004 2268 iexplore.exe 24 PID 2268 wrote to memory of 2004 2268 iexplore.exe 24 PID 2268 wrote to memory of 2004 2268 iexplore.exe 24
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e3181537133d556cee8ce7811f942b2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2268 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575b3b93d5b5d4bf5cfff5d49275274de
SHA1d934523b6cffead518a246c2926aee6e31e8ff30
SHA256b25fcd18955d73bb5e8a1d6f708293109b3972593525ad3175e8573d7304cc9b
SHA5125249f8165c79e54340044aa5b3a64c2bbb9b506889eaddcd2c1601442a0483b9f6bc8d67cd1ebbfa2cfe56073dc3c7acc36536859d19fb282d45bc2c5c079da2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521ae741b6876f566dd85d7e6559ccd55
SHA121400a7981c8d2befc9d901aec39c65ddef5ce84
SHA256a99f5f0dad12c25d9abc506b4bcd881d31d987969e6488cf8f7566f289c2ea9a
SHA512e22b7da39c87fb5e868e33ba780c66a8679d046289be4b5965a898bfdba75e45076f1171b315a082976d991f271b943e8386bf0cdd993f0e8b37ae8571b2bade
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd7c502fd6d5f7987012ed57554cebbe
SHA1b54e54a9f5da7d7cda7c4e0cc1263437c11ff6ea
SHA25677d323e15d90586a2969bd26c839afed85007c8a2f898f71d692839fbd0f56ad
SHA512810f1357a34440d63504c995796d4ac3b63b60e0709e1a1a549552da67e29bbca07f79c34c15a5637e14bdbc9fba6c348cd9e351fafaf6537dbebd92f245a7e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5312eecf0c15dea5adc9a99e181fa9357
SHA188a987fdf3f62cac838fea7e7abc06f8301412b7
SHA256fdb65261f60a8609a8bc602bdae47b619345e0352dde25a9d427e4ed37d93544
SHA51282f98967b81edaa12e7b2d1f00bbe9f04e099ceacc68daea8543ed4f75f2c45c77d91dbd571c6e555d97e494382cf8b7ef3b3aec3e44cdf3bd4c46efd66c9aeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f6a94b1c20eadd5999e6d728ed39fc6
SHA1d71e3b22247473892a53fa61952aebb1f0745b2f
SHA25661d093241baac8767369faeff4c0e986a4ede10738fea7681677681153673128
SHA5120bffa25d61fce22301afc288425c980dee27feadb30cc69706c33c3a656634cb31ef63f1193289e61b3c952c37bedc83c515e9fb1d8ae3a8799ec2dbc6b5a5cc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54332fa9e71c12c380e23fd6ad43aa79c
SHA1f5301405dc2fb21717da73a2b256fc870f9e7139
SHA25693f5c869d2ce89996edc0463ad702f4d7b91fdf847898ba4df392e40b17b5280
SHA512a962f6c15e053b9135029bef90e6992540c8ec3ab8e99f962b3826afdc04d8d2673501bf46e20d0fa85fd542a2a71aa157ddc7f15b9de7e56a0fd4b71c5b2b85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544e332236b0ea909d85eaec93a329b7d
SHA17c0e6a00b297431162b5a76742df8996f36a2bd0
SHA256e90333f01a25e093489b21b4bfc66d825e31a59790bc0041be013bbda3383130
SHA5128b65f93a375840cfa6f78edbd891e71b816b5f837c98415cd39302b2a96a97360de8f8ee87513c7a0185fed12794d72314562871384fd072439aceb9f8c7141b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c825ca92f929eeda0a7261b18f683db8
SHA1ff089d0003e7b61e25df2382c09e0f4d7333e167
SHA25665a1a7c7df8813a45699e8fddd2df722ee5c8d828b117aceccf429bf63e701bb
SHA512e19ba7dfdb556079b15c80b88067168bc5cf4f9451c606a0249ed535c58a548075c1d3331e3b4307ba6c0f3b866072e19929e26965d3accf4ebc2cfb531d7d13
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c31912610daf1fb7211c96c796077c0b
SHA135b686cd1e3e455704b21182174abdd59ed2ca74
SHA256c9eb58796e38e68edc137522b4261a6a1a5a33f8716480bb3214177140a379b5
SHA512e264f51f48ab3b4a73865723aa11556ea2713903fa0c577f580a925b5cf40644ea11835edff8addbc13be371f794ecb6c96021a152d3f5dd7fdc1a6a49fad266
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ec521b180c0de421ca48b1580653f18
SHA15d970367c96406c79675b46895809c4926980fce
SHA256b98b3176734e53fca1505f5260cb18c6565623fe815187271998778f71cefbe4
SHA512a17d5f85330a676d1fb1ccaf304495e2033a14496d0cb5c3bbb922e08e85021385c8bae81998a2f383b60f27bd0b36a9699ea8900d014c3ef00399ae210f7d4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572132ca9489c55d65382ff98ccd19f98
SHA1db8cfd7a650c8cb24ebf9edc16d32918147ae22a
SHA2560072cd7bc3a3b39da24a0a001b86fe852006586f90c849422cfa61c3b68c76f9
SHA5121bd17fae72e64b52375900731c841170ec31ea7414ddd944bef14beacf990f22452835681300dccf72f6d6b37af1409823eb4f1fec1acef1e7c74847c5950189
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5456982f31dddf3b642046d4b2da9346c
SHA1522079a32c7454d8a1f16e69364bea7aa2152562
SHA2566d548468d30d09a6462ba1f467501cfa3caf1214121deb97e89a1ae6a13cee3d
SHA51212a4792d600f096066cf80582a09d7eeb92d3cd6134419d49b3b6f5cd6c5cd5e14d7a372ed0d7779c77b89b20cef7809961c8e7fa569aa2dc3452f0569db3ca2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a6b2892a842697b9631649e987db3b2b
SHA1325464f01216d0a5d3c69693b8e7b6dbd7c46042
SHA25622c429797936b491ab90ac019ca9bbb529505fd1f130176aa3ca00770e9b4136
SHA512d3f5ce2167b217457b074e9c269830d032bc695dc8ac698214b6a26cb54390f76ecaa61946e35ff79fd84be8d4c61f8c05596e5719ebba7964cbd6160afcfb07
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1a9f7f611869f242760814db3084fea
SHA11d358f7ffcb8fdbae5fa34498946cc4a7769336e
SHA25620b9b4f69a07172da44141dd793f7cb5e5dfa90a1947e31c6eb33a1d445bf205
SHA5120385fad29e14a0a8aef623624b46e53471c2026772a3e29d9cec5d542a6153e3228b6647035032bacb5ff9a3f6127a1cf9fa0dceaadc7531f1975bae21ae0b42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549d9155787acb82d28c9ed2173dd0f74
SHA1828c7cac51610613f3a49dbb01c905b18834a378
SHA256659805c3bbf93a8e7915e4097f85be6ff9eee18158fcc5fb953202500989f07d
SHA512e1117c887c75b1133d7380e0a75294cfa13a151d362285ddc884002e609bb6c01c2bef301cff7baea0284ac1251a841e8fe30563600a74c3f50a170f0df2b339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f02e8dda38f29fe61c5f8b12327139c0
SHA1da2a030ae0030681279ba8292a74a749b47b34d7
SHA2561d46a4213f4cf1a3d9bca62bc2050f9971dc1aef72bebd4882078084358c5c3f
SHA5126b8fe434003967356378d3bb20d7ee2b86c98edcb9f255b56cb2606f0ace97c5b230e4b9a6246b181fe6f218109a67e3dd89f9cdec5c5f5db20307f762381c1e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\beacon.min[1].js
Filesize19KB
MD5dd1d068fdb5fe90b6c05a5b3940e088c
SHA10d96f9df8772633a9df4c81cf323a4ef8998ba59
SHA2566153d13804862b0fc1c016cf1129f34cb7c6185f2cf4bf1a3a862eecdab50101
SHA5127aea051a8c2195a2ea5ec3d6438f2a4a4052085b370cf4728b056edc58d1f7a70c3f1f85afe82959184869f707c2ac02a964b8d9166122e74ebc423e0a47fa30
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LSNXCBKV\jquery.min[1].js
Filesize83KB
MD52f6b11a7e914718e0290410e85366fe9
SHA169bb69e25ca7d5ef0935317584e6153f3fd9a88c
SHA25605b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
SHA5120d40bccaa59fedecf7243d63b33c42592541d0330fefc78ec81a4c6b9689922d5b211011ca4be23ae22621cce4c658f52a1552c92d7ac3615241eb640f8514db
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M61DDFBK\jquery-3.1.1.min[1].js
Filesize84KB
MD5e071abda8fe61194711cfc2ab99fe104
SHA1f647a6d37dc4ca055ced3cf64bbc1f490070acba
SHA25685556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf
SHA51253a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65
-
Filesize
60KB
MD5c344ead2c52f3c288af5ed987aa15c6f
SHA1d7c558200d6186196c23bf18563031bae4c52e4e
SHA256e2230689ff9378427e23e129ca6361dd9fc6d5e22ac3c8edc451016f34050489
SHA512ece91631388f0893330b38104d04064408fde12132c9909f75c90db77130c736ac00db5228b1dfce02fa2530dad4a59d80f28fc6921f2f9a631dee51b60315c2
-
Filesize
1KB
MD5fa527dcd6b5eb05e72fc51570a2a6608
SHA13380c5ef74408265fba2f67e790636d0ad0a51cc
SHA2564dc7a4a6cb3be2c334a27a49df89f18f8f91749fe6aa1cf28d548e0e0c75ce3d
SHA51205c0e217c433949cab210102a26ca7f6a765515b228b217e25c7409408fc167b5a59a8494e1181284e9ec72849c90288f3a066faa284e29d871097ec76291a5a