Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/01/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
3d9ea6b1e72f9aecec98e137b003c327.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3d9ea6b1e72f9aecec98e137b003c327.html
Resource
win10v2004-20231215-en
General
-
Target
3d9ea6b1e72f9aecec98e137b003c327.html
-
Size
19KB
-
MD5
3d9ea6b1e72f9aecec98e137b003c327
-
SHA1
56be18c6d5e0a6489430aaf12398eb21e924f362
-
SHA256
61b783d38da25ace60d0b4b17157f4e3b4bca3762b8fe3923334d9536e45c0d0
-
SHA512
51cefab495c1f4bd7ac8599137b6e914db2d753442468169ed9b7b2da074fd51938a1f6dc9bed80d84229b5c0fcd2b168edf08004157f38fa17418810ac9afc8
-
SSDEEP
384:4+QfPFd9QZBC7mOdMUItKfpC5IgSnbmFe7AcDa6GLLAPd:Zcd9QZBC7mOdMUxpC5I9nC4vPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000757e2299999cdbe3e015ea89d329ca3cbc5e72f8b201de71d3997232c3c24f9e000000000e8000000002000020000000be9f238a5e868cf9ff431b1c1d8750bc6a0ff32906e9ea49dd498f6089d8bea420000000aed21a6efdc6da4569aca1d64c59fdfc30d5d4ac7dfe2fa8d814506ac389492440000000f1f7dba7d436687e813a70bd920e3d7b38d07f92cb6f3bfc9770c5a652091fd83e1702d724b3e15dbbaf49fb201faf1a485fb46dafafd8744b75d4e93a95e177 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802b0147e43cda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000006a54e9afebf97b632d15ed674bd9ca7b89f4dca8ab21f9eb9687def0bbfb62ab000000000e800000000200002000000077fb50adf9a4542eea50bc9529e3d4c4696bbab50fa31627b7219fb013b526e090000000c3ff55adc8b6480f2695a1037db9e53eb00e0d84cc8d49d23f79e47a49e41d0516511541933514a21b24877781abaf55b0eda5c350bc844f252fbbfb300f2f3ab1ee2a254d1bd1d08a48f4bef31130d6ac3fd0d8d2c07331dcfcb6e3089f30cac69cc176b09797651ddfb56d858f4a2092fa70448dc46551498984e81ab8a518e21f50321caac7a58feb0c7b14fbc52940000000440059cc4eb3f7a2855af3bc0ede1d3fb6b1b7b2cf9061e5c92af3d9b53092433003ad3dbbc4098913709c3917222b9b93bc9d4d77de95a36c0fd76634c9c872 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410297225" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{635B7061-A8D7-11EE-B2BF-5E688C03EF37} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE 2972 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 2972 2932 iexplore.exe 28 PID 2932 wrote to memory of 2972 2932 iexplore.exe 28 PID 2932 wrote to memory of 2972 2932 iexplore.exe 28 PID 2932 wrote to memory of 2972 2932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d9ea6b1e72f9aecec98e137b003c327.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD520781f496bba3088987d8c57c85fdf0e
SHA1e49fc4e745d38d3ef6588bac2728f85b88fb79d6
SHA2561c68a1fc58f6bb2fde295476343e9b2ee45fd6a6681b6bd98bbf1f0bd4e6cd14
SHA512dd35dbadfc4ca0e7acf0ca651426c081eae2a0b82c40f61bbb42c185ac65f8479d56c7d27f0fb7ea94cd4fbef0be9b8001d6e729179ad1cdcc28d95776b3d0c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6350dfd513937f60e8d4067a5461a43
SHA1eda51adbf7b7ff865273fe784e2300c2e4afe350
SHA256ce26126c260cf6a21c3019aec4aaedda040dd88bfbcd0ead999edb07b47bf65c
SHA512a9ab4b684bac36d0ec9d12b47ae5266ccab72b05be67ae4b1fc552e7e0c65749f4c34deb13bcece71949e096f5028b97bd4bf3bfcae7e61fbf1d47a0b96a37b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56624e99f3dd52728ff5fc5b60b8eddc0
SHA13cacace3b3176b4cbc4e4605ab7641c6bb7d9e83
SHA25670381c9f370e91a06e0d3b37ea4378f62f4b6b7cea2fb9df9b95a0bd563609c0
SHA512aec7c8a342801c814da0f8064fae7d2d4955770b0876db5de5ff6bf5d0f2d25f93d6dc54298b58ef7b3631bca201ca662322ea425e07b0724080cf889f24f544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578b1456792fa0245c55f37de8a913910
SHA182a7d412ceeb4dce396a47922ee66ec2655f5000
SHA25625cef468ef8c55a6ca0df84e2e8795361118b63571eeb9206e7b6bade4ee6a57
SHA512e9c7b9cda4ba31808b6633bc7266a1682d1e94126564c5f5f05c9950d7cf21a6e721f00f99c9976b0419829e77b59ee31e72f933b2ee8a60f196dbe9130f262d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af1e8655f23f0d86342da4416776a232
SHA185f0920affe3c301d3c0f4ba5e510073fca8f8dc
SHA256b8e3811acee0cb248652471de11a93ae3263d1b323a6104dccc8827556430c75
SHA512392f926b9c4e7364da01195a90e3846404fa0a71074a1081ee333ef36e3d55ba081d16089c17ebd7df41e1411f75b2b5826cac946943cb0d8caf5969ce098b40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f824265f28fd67afb84643042ba3721
SHA1194056332c3fd3a0aaae73f5a54dfb018888ebd7
SHA2563fa99a194af92bee39fb2a9a434f3295cc9eb473d872ee1085f49d181dc34cca
SHA5128ef9373b5625c46a03b2282d12e46b3861e8bed209bf9ba5d2da9129640cd7054532e1ab8ed1ac6e7a7ecc62f865f90712e247421a30f88f7b6fcfffeb1f1b21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a036200018aef79fcb8201edffc3b3c3
SHA1a1a44dbb91019f716442aa7ea84040e5bd7e3342
SHA2562b63a0afae51eaff4967ee6034061882c243a3fc58163eb1e9f894b7d7aebbd0
SHA5125a094efe69abfce21cac4003d0cdae321b60753c3be89919170f1c47bafb7b081aad60f94401939ca18c57bf22dadf2f67e2253a703c5286ccd115f191f3653b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2f36433c669d880f607326a4be0a743
SHA1170f6c3f2e66a51f0707dd6e44868503c0b58153
SHA25699c4d898390bed3de5bb7692d14ee027a0fd791cfd1e62bb25e5f49b2b2ed325
SHA512193b44f5dae09cac8f3b7bf943feac56b41ff3cbae0a0d48a4d2ff4d0f6e8372789e00417e768ce3c91d4ddeeaea00b524e60792e446f43aeb5d3a291711e38f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57566c2495b45e623be2d9f8c0b104e15
SHA1e7147188f284eb001e66449cd4c2cefd04fc2b1d
SHA256ccd6b5c224da320c413b3352f429a746d0b5613e81ae8f322709d298ea634158
SHA512ea4038db6eaaccdd771f8718db9d872f43af31800c4008bba9f1d74ac981fa84162ccf940352d0fc91a40b954fddd6264f3cba55c58fe29993225bba096ea698
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55834608cf1e8995401dcd11a6bfcf3f9
SHA1de111769dece3fa024e54a64250f77a3f84b01ab
SHA256747b2c153d1d9761e3edbcfc50ae5e743050c3507498747730e22abd9ab45090
SHA512336f84aab6939a5627b93bf4f8acf7d51f9d79be10f55534ecf7d02b920640a110770435e454e811909e4c81a349ca4ea86266db941ceb1eabca93986a2d293d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8ac027cfe5bc22ff858f8df58270cbb
SHA1e1f8a6dee406c43df5a38c65869663952875d3c6
SHA2567263d9143d9b3c577c4ac56ae0765fe5c4087f36c0476174edca204bd1d2d38f
SHA512a45f23d8b56b0b736cc04a2e2f4d26c188b1c82b810cf3a97522da899f4aa011b73967c3cbc5020a32f8731bceb69160577c9354dedd920f7014fb92b9036829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ddb16648ec1fd9fb5b2d32100cb284b
SHA197bfda83dca978be7312ee26c25e844bddec3fa7
SHA256afb344b36f1c0ef90e5c722281a51a3ec542c13f260fcd75545a5b07be334045
SHA512774cd722c1b63a1b681d39d249e64ca8c29750748b5437699214ba6253f1183c7f13f46c77669505e073ae90bf26a9de96888e9c97fd0cfd9b55407f9de35b06
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06