Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/01/2024, 21:57
Static task
static1
Behavioral task
behavioral1
Sample
4201cda14c608e60205b46dba00b4e08.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4201cda14c608e60205b46dba00b4e08.html
Resource
win10v2004-20231215-en
General
-
Target
4201cda14c608e60205b46dba00b4e08.html
-
Size
28KB
-
MD5
4201cda14c608e60205b46dba00b4e08
-
SHA1
f262e0435a89c098b5828e9ef898404e379b361d
-
SHA256
17d60d626be339d0548e9786e3e37690ce47902183db0f36e2ee108b62cecf35
-
SHA512
c6f3f3447292430600ce18abd02c97aeecc516abb074b42d221e9a864eb5a3b98cafbd3b0b0e029bdb8cf09ea677a0406b626e034739bcfb5fa669aa5aa57b50
-
SSDEEP
192:uw/Yb5ntqHAnQjxn5Q/dnQieQNncnQOkEntrLnQTbnBnQ9ey4m6MBiOrPQl7MBwK:5Q/IbggiOCS9
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410567322" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{41182E41-AB4C-11EE-B218-C2500A176F17} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3052 iexplore.exe 3052 iexplore.exe 320 IEXPLORE.EXE 320 IEXPLORE.EXE 320 IEXPLORE.EXE 320 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3052 wrote to memory of 320 3052 iexplore.exe 14 PID 3052 wrote to memory of 320 3052 iexplore.exe 14 PID 3052 wrote to memory of 320 3052 iexplore.exe 14 PID 3052 wrote to memory of 320 3052 iexplore.exe 14
Processes
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:320
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4201cda14c608e60205b46dba00b4e08.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58229cc5f6b414d2a862eb24348658521
SHA1d0f43a95a0ce0c48455652c25bc1cc3b6450c58f
SHA256d1c4e9c34c7417617997a70d09392d6157fe98cbc8465891071a7090e2aee85e
SHA5127c3e9f701e80102a1d0f7b14f5c8846b4fa319255b4f393a2d29fb33dcfc500ab887dd6da2fe2dd5ecba4bddcaaa96b9746ecd03fa732322db341e8c9b5f0bc1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b9c5b098e91cebbc6fa73e234fd33c7
SHA112b2b511495ce6306ee1f45223862c13727aa8b8
SHA2565e1320d5a67543fa9c900738bc778c7da6900903517fe52697c57ed33fee4c74
SHA512ed05a732fe2c7cb3b8b535fff9f184fcd9506997839373194bbebc1a1b24595404b60ee32a09b56b2c77013549724eb559ab745bc5cb73b34c9a8d0fd744f95b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bb9cb3a0b6a35cee236544a018fbc3a
SHA176fd2e3bac291b8c9d4078134e9dfeb0d4098e19
SHA2562c6ba2c58041c64f48432dcf5d0fad854e2dc42997df31358008aa57f1f05472
SHA5127ecc24d03ee6234c0d1bf1c9d36b9878c6aff609c8e88b7712a94590e97f7c0dd8f833e93f9845bfe94973ad82495467230f1d7ec789886a43bfeeaba21ad4ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e22e255934e773287bf91f6516213d94
SHA13f990939664dcdf8a90141f9cbacac77d37e7878
SHA256ec186b98bcecf93c8c3ac5e5decb40867b8aab0c38d83736aa71b53e2f73a404
SHA512f699d315d4fe85d93f6ed6dcc82e386fcaa0029e5b158ae97cc81c324e12495b716695d0d4b9f20583932a8dae5101ce14a9be5fa45527c7fd553155c0f1a328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53002f6528c07a00be158db844519c94e
SHA1c01fe829fd9245d3f679651df20436a6a29888bb
SHA25637d0575bb9301b147ec46a4d2baad522919473a7b094f94601179e5b668cd836
SHA5127a90f41170e2a4377e89fd71614cbf87066904d2924119552faf286ae859ef23c538187b54e8662367cd580ea4516980ced218cf893d13d7e06cef871951728a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9ae7d54155fd87741565b33d2986cbe
SHA149da2cdebb7ba8aa6916b994d5f148ccae8adf71
SHA256c9c352678e918e892a65ff4d074fc71c04be034ae482faeea08a744399f34751
SHA5121675458f7252dd41fcb5cd45f3f959900b3dd6a2828fc57dad43bfe79cccea7bfa84b6263d536cf91a56ce2f81ebac386e72d098caec458aee59d2d7d0b4d834
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06