Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 07:17
Static task
static1
Behavioral task
behavioral1
Sample
4316141b10535398244bdb69df7c8065.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4316141b10535398244bdb69df7c8065.html
Resource
win10v2004-20231222-en
General
-
Target
4316141b10535398244bdb69df7c8065.html
-
Size
104KB
-
MD5
4316141b10535398244bdb69df7c8065
-
SHA1
6e99702f2cf7592a04a57a14480baadb76252404
-
SHA256
a2f79f2b124613f07243d3898dbc33c4f4802729167cc268a957bdcf869d4c3c
-
SHA512
2c5d6f637b6ec26b957f63f4ad3381c9b04354e30952e4c197d78a6f27f6ba88dcf85af87783fafdcae535bcb3fc1056d139c74e80366b55f8d9bea397c162d7
-
SSDEEP
3072:SOxIi38IP9kSsgo/ZvxYrtPTKCNtHyUtCuM6D:SOx93jVkS8/5xyP2UtHyUtCuX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410601812" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000b570223ed09f05d3a4da7e9870e8ef9063ccc8123820eb18442123aa5a2940b1000000000e8000000002000020000000c9023396436d1a6885438dd08e98112c1edf955ab205d8eb5a3de95d833194d790000000ea1940813ba89be4417938b71424937a373c51df0cd9a8ae044893980f3a90c9562fc5ff580e4f9c475949d3cf1aa69d95fdd6d658338fd53bafc7a8c27a86724a6dee0ef350f73b7f7a66fb16a0274924a0d51a4defe00c923b3ccacba47670f9fcffacfe5f513525ded215c94a2566cdd30b4879a13d604839f852b9593935d51f8cdcf0a1e122b9b4ce2689e057c040000000c77be8dcae8bddc70a0158fa2ee133b401c6ed27aa2c557a2aab64c219de2e1ec2c984af70253d82ccfa0418424085fa13e7005f457e8427f3a3fe856f374a5f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000073ac7be756a83ba98b23882dc8dcc23a479b669fcbd9e0925f3d3691240b584000000000e8000000002000020000000dc44d34abd33ae7d1ef74bf05eb2a18504313c8a8f38e0718cc69864607f0f2f20000000b7e7b9f3681ab662dbc82b4a903574e8ea02130cbce38c72cbca243b3970ad6340000000344068384798062da2a761f4a482f4d0703dd76876150b9ce4040402a7dad43a3b1fa6a080830ebba341cf7e352cdc498b28f3693274056d1da6a8dc8a24ae58 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b54263a93fda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{864308A1-AB9C-11EE-96B2-5E688C03EF37} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1244 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1244 iexplore.exe 1244 iexplore.exe 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE 2732 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1244 wrote to memory of 2732 1244 iexplore.exe 28 PID 1244 wrote to memory of 2732 1244 iexplore.exe 28 PID 1244 wrote to memory of 2732 1244 iexplore.exe 28 PID 1244 wrote to memory of 2732 1244 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4316141b10535398244bdb69df7c8065.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2732
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ce93c593cc95dc60f24eba41ff7902b
SHA123da540c41e045af9f984876523bae0098dbab21
SHA25609bafc52f74140690c57042583f4baefe4032872a4b82d6458f1d85104660c53
SHA5122a4dfc5e4a585ed0def010fd8aaf4e171b763b6a1ae3458651c003a5995759eaa7e77a9f33289f1873eb7c7643778deeaf4e40370bc04c029d6ba17dbb118b64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d0cae2c4a4f578abd5229a41aa51fdd
SHA1bbbfc35b051d14388246a34e77d3c0160894f9e8
SHA256e7c4cee4fbf52150bf4eb83a10d23d9d33cd24c60873ecc8a6d80200fd5011e9
SHA5122267167756f85fc108956b1fd61c5d4415bafc65b3f1e3064032d012a1fa24afb6cc071c1beb52052eaf265699b1581559d4cffd091795c3c39936eca3d3c1f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD567d2282979de97ed85307256b8aa457a
SHA1794d1381060fa12bf0f9e117d6a72acbb37989a8
SHA256ca4e85a43867fbb87f3802d5c2416f689e555cd09c992989163ba0dbaff3b5af
SHA512274e391fed5fc9736f8effb4463f69a5d094f7d7b2fd6ea7e7d14fa0a04710b86163ce73263be6aa50dc2a55037221165f748e6ce5434fd3f81a29dda6eee4d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f08bc7fbf25891de9d0631c18200e99
SHA14970a4ad13bc63f99fb89b8765a272bd4dcbb46c
SHA2562d14f2336df0eebeb3a423680faa9ab40810d8641603e360c4ac2382dd26dbf7
SHA512b554b095a117d3db5e53505140ced38b0f61ac3df4e4cd67d413edac16398aaeec16bb715cc41d4d9613bc7e6122e25e8d25083cfd481584725f8006ce43b464
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c2e6da7bdf73907c269aa62e3edb44b
SHA1d9698e1eed244b647b49bff2a865f11e95b5fa9d
SHA2565ce2696396680f6c7d07cfa6f1609621ebafe79667c60ee61dc331fae2254815
SHA512324c4650f99e95da68b9a349e718c71b210dd546be14e58a51da4f8c795cfa5fd71133e5758abe8f93a1b71f938f524d2aebdd57c66c346798fd977c914deca0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbfe4b447ed2a40d16931bfd490b58af
SHA16cb4c19e10c92818b01784d648a5b450228030a9
SHA25654336bfc4622a66dfc0f5813880f3060bf203c5da23b9ef5cfdaa6d542d7da22
SHA512849d73ce04837cfc68bbb0e587eb9165d7ef8d5e320e9e05fa8e975dcf29e6f001ce699636ef2305c2984f995a0d89811686e7c7099772247569a3f3a5a113b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f13ede0a493a85095f9adb8c31df8a62
SHA18c40f0b95018a6b105eb9458976dc605f9c306e3
SHA2562c6417fc67935d9e45ae4343fa70f2ae765567378ce545ffdda41722e5dc4668
SHA512232d028bbe0e412f060201ffe2827309a746efe70cbb7c85b73cae97e8a3c262f4554f40a95f3179d34a106cf5e1ab671501e6f6027c5531c47a02bf0a3b18ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57839afaafa62c77dafdf0bde77872c28
SHA15f94feffd825d3aee2da9e76a889b4a3fd506c19
SHA256ac22d266af04c33452442b1749037424b724511c2cff9bf24972fed138d912cd
SHA512226d29afdd419ffe1c6f6056ba8ab45709d171ed3eef0dbde3fa9d65b2f6b60e1e887a774bbc5d842b24d876181c4f7da7d1fada06b4f0ccbbdf11515aacc266
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06