Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 01:59
Static task
static1
Behavioral task
behavioral1
Sample
3b9a6a49c5b0e2ef5ba22f91e1f263dc.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3b9a6a49c5b0e2ef5ba22f91e1f263dc.html
Resource
win10v2004-20231222-en
General
-
Target
3b9a6a49c5b0e2ef5ba22f91e1f263dc.html
-
Size
53KB
-
MD5
3b9a6a49c5b0e2ef5ba22f91e1f263dc
-
SHA1
b9fe8e7c87bcc4670faffaa98608af365c2aad35
-
SHA256
e8324a867d23b822a832d5b49996aab6bf8520f8e25d847ce9cc7750e0694220
-
SHA512
82e387ae1283bff45e0b820a2e00423ecca5c959c5ac5d29ff06a2ddf126c06e87c999e0a1ad3eb8318aab72c16d998acbd53e40324c955db17ba5c8b0781d24
-
SSDEEP
1536:CkgUiIakTqGivi+PyUmrunlY063Nj+q5VyvR0w2AzTICbb9oh/t9M/dNwIUTDmDt:CkgUiIakTqGivi+PyUmrunlY063Nj+qS
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000002c841629293bd0a5a7b0806f4b01b3a0d152d11bf90ef6cfa00f92f6e9948476000000000e800000000200002000000028702b25d991d08324a2695cac88f23ed3cc6573cb064b9cb6423425252fed2190000000630d6f95251253e9d2fe62cc740bbf96222b33d395d4a50bd1de69e8cd1ef0b666aab5a39290961adccd16157749a7b6dc3e73e4fe6fadc762e431292ef17e6cd1a537f3890d79602bab5afc5fa5c7c3f7d37c40ea7860b5d90f4f48e3019452f1e45c70ccb48ca7f641a25cec32884f3c56cde59120624c9d651127683926cf8e288ca13dc9af61d2a3277066a19e954000000036d05bf5357bd41cac09ccdc7c56ac7e4e0372462e6734549d547f33aad576ad2d6dad2c6d512de4853621c10ce4b3544c93d3d8189eceea1b2a0d3548f6c496 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000c0144b151ea629c8c7fe273bc1ca1e293e3ed58283dac1f8db6461cbf5513d25000000000e80000000020000200000001063b5a6675bf2c57e85ea5054f8d977f38f56e8bf1bfe554250a22f5f7dbb45200000001acac7ee50ad12ad3e8068fbff9a420167a159db9cc55c859781a95a5356658e40000000fd2b90ac94f2e9f659a773f130dd80abc862e33ae444b5631c9a15acda1f3ee448149a3a075b5b17bd92926955924dd1ae49deaac97dc33d51e6d3184b6659e0 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411093911" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b071183c2344da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4AA991A1-B016-11EE-BB35-72D103486AAB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE 1948 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 1948 2932 iexplore.exe 15 PID 2932 wrote to memory of 1948 2932 iexplore.exe 15 PID 2932 wrote to memory of 1948 2932 iexplore.exe 15 PID 2932 wrote to memory of 1948 2932 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3b9a6a49c5b0e2ef5ba22f91e1f263dc.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5fdb5a5cb029c684171da8f629f64036f
SHA120af92f93b62fe6e950882b81456f587b3889a5a
SHA256c02cb82edd56ca7b4d6e94f98ac7b621fa39e46a948c19c5bef94f9a7958910e
SHA512b568330176ac60c183d793cf1a0ce3db0d8907c3be5c0e520e24908dbe10dd3c1090c848ee734214fc4fa3033a0beeb08dc5d1899c1b946df4cde9eb0a7f321c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505c13930de2de6bd9ae02c2d8138cc42
SHA1725f317c1e50b47e62170fa5f8e43f3ae0a2613c
SHA256f21384d76f503f911ad58beb570a0882baf6f0f6bf7ce83ead6cd0d7e4a60a87
SHA512e27cbaf28afec2de30e866eb731c05f8e2371ea30e15550e6ded530f79765d26eeed69403a7c13a6944c54924d115dac48c24ab47d23d923428458c7a8f65591
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db615b973cb7c054cfb7f16a41f5319a
SHA1c81edd9f370b4e014e2786dd2790f30e129e65e2
SHA2561febdcc52523363c6db7082537279334a1134d2188461a5bbacea5cfd510ebe4
SHA5127e604f8425ebc630147ec3242b9fa8d60d617caf345baf0517dff67bbf8d8ede43c08101bf38ff5f155a35c43abca4a87eabf35de9a18f21f70faa902dc48a1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5958727783d1d7888a2c0b99f4a7e1d78
SHA14b3266e5610ac06b853ac15486e4d92dddd29468
SHA256e8b333dfa4851e299dcf6eee19649cb01ac48f1293623dbc62a6dedd756b7960
SHA512c258bd2ec355401e0556235c5680eb2115b710faf35d59368720b2c060ffcd510915a8ce708a05b91acffbb25925bed2d7ebb3847bf2658b3703bedfb549a7fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50557b016821bda7dcf3bef0ad03c3292
SHA1ea88af905b0b8b96e7dbdf77745a17a032022243
SHA2562784727e149fce3e4c14885c2898a159cc1d3b254f0eada417eb2c5aaf22dd3a
SHA5120f61f5b1de270af1eef3d30c4869c903898947e99bad23a112a521bc70f3b429ab2477c2467f0ad30e5b4129dee0b389d80ed57bb4fb2c574cfcc7ee5fec2a0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD555963aebcaa0daa1ff4414f4857bb7c9
SHA167235b34e66581fc2ab30565cd8622621692d512
SHA25617ffa6d693abcf1bb386430ea766421beff59131273b7c1587c1dd270cd1c3a4
SHA512211ea753473fdc0e5eba0d5a817c20348c7487a946bf6201a7308235edf3e45e3e5e6a2095ba9dbf7f8f5cbf5c26218a6fa18564e3a21275030cc0a90d9ae5c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5410014eec8f513bcede2b9a98ff3d968
SHA119b06d9fe06a5554109a6a1cb447bcdd0a8f1373
SHA256329f4fe18a811e51277f979dc126e033eb48b1633a23e2d4fd5f2422a2da28fc
SHA512be51ba3301a6b2e8c0a9574b3119c39f43eb5f3c22ac368496c5c837205cf95762a5f4d37c1a0bec7d6ce4f8b36b471fd84a1aca50a49108b112b022e4dab94e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd979584e1e9590f63f6770bd0ce661f
SHA1fe7799da4fe5615d5fe9659c08ad74a6146047f2
SHA2569759710897740a114eb57b4c0b8203250556f25af7404a4bbc0ac3a406024571
SHA5129daceb64a6db2ac576586740a29a5d7d627cb13647c83ccd1eb62a24c2ef14046f4322d64c11f059ae70bb258f0c0cbc0f227cdd85d25596ae287ea2a7b70072
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52efda3043bee4aed0fbdc8d5a92e6200
SHA1ba3518722bb1b4f73985d33d1bfdb32884baf11b
SHA2563d9d98b41558ccb95476b8a102a809ac981c1ffc5a0d416083e8f269d20bc8ec
SHA5128a1234740724d51350a4f2d04fa81fc63384c2e2bd6162d1d20f9c67b82ccece3f547b3bd0a07e3699625c37ad5f568c00f7e01acb0c63a63154566762cf6080
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2d93f7b28d637c3e21af81719ff1987
SHA156899e2ecc2e5b8275e687ad40599a41464ac5ae
SHA256ba97651cb969fae2536ed90d6c16ff61a481a6bfb09049370baf78cd05eb5738
SHA512782e5863f47e1c040c4e94b8c28a56fe39dfc5338c641f5f71182631ccc6d91e8acc347209830281410f085ab4f0bdbc75bdf0c1d06e3d10777cbf9bd34da093
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD525565ecc41c4791c0fbc10895c1cddb8
SHA15710d8c482b54d7060f14bc063595a3a3b581b86
SHA256f9e0f170f8a57f1d55c01f048a1b17c182207681b768e485aa9a504eb57b8dae
SHA512a3440a46b2546fce73ceedc6cf03f253b9bd2cf941d4a65f71c1b66b9d64908dc1f8905d91d7390f39b4aa0a8015524376d681bcd60693922cf42856bc1180ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96XLYQUW\style[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06