Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
43c5b2e57a42de9efd9c401a4c4569d7.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
43c5b2e57a42de9efd9c401a4c4569d7.html
Resource
win10v2004-20231215-en
General
-
Target
43c5b2e57a42de9efd9c401a4c4569d7.html
-
Size
77KB
-
MD5
43c5b2e57a42de9efd9c401a4c4569d7
-
SHA1
eca5fe56c62bcfd6c43682ad395be0b78066943e
-
SHA256
7cee337596c66aeddc27ca20ce2fe7d7fa5d8a8a89a408303d9a6d497d9edb1c
-
SHA512
403fa7f8456f53868686366026d1ed42d03f8081ae4717a3aad0d0ddf4bf6074f1d959d92fcb04dfd5b8ec9d6fd14f8dae71f05336f31f7571305357f1c8fd50
-
SSDEEP
1536:/PTupBkumudZL1qAuv0utvWd+odChAJVojugmPFh5gdDMll5intqKXyp:qpBkSd+odChAJ2Sgy8ntqFp
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5868C7A1-ABCC-11EE-A7E3-F2B23B8A8DD7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2272 iexplore.exe 2272 iexplore.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2272 wrote to memory of 2932 2272 iexplore.exe 16 PID 2272 wrote to memory of 2932 2272 iexplore.exe 16 PID 2272 wrote to memory of 2932 2272 iexplore.exe 16 PID 2272 wrote to memory of 2932 2272 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43c5b2e57a42de9efd9c401a4c4569d7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2272 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
Filesize
893B
MD5d4ae187b4574036c2d76b6df8a8c1a30
SHA1b06f409fa14bab33cbaf4a37811b8740b624d9e5
SHA256a2ce3a0fa7d2a833d1801e01ec48e35b70d84f3467cc9f8fab370386e13879c7
SHA5121f44a360e8bb8ada22bc5bfe001f1babb4e72005a46bc2a94c33c4bd149ff256cce6f35d65ca4f7fc2a5b9e15494155449830d2809c8cf218d0b9196ec646b0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD5f4cbb72d6d02b65a6f4fa4f14be4939e
SHA12696c68493df09ac3bc43e80cce9b52bffad77ea
SHA2568b8fe94ad4712613ba6ed6542aac8e701e8a8fbb343bf245ff3044ed9ff3eb5d
SHA51295a88900b333b2c336b6fd76b097bea3b2feb21a68574c055ae6c36e589817d61e26455f4509b2c36108f9625cefea52fa1f8bb329a3068dd02677a2c33c6843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed1f80e348c1eae0c896fe3b73606039
SHA1353aeb65faf13bfa98b4d57f8a0ac9da02dd0592
SHA256ab082fca1b474082db15311b5b47161098ce39721e91ebee25ed768153cfced8
SHA512fcd3e99ed0813352643a5e61ac6bb8250deb4d5373f2402bf49526bf763c4c7844b8bd17c21a4feb4bed582627d40ede6bbf5dbe3a34ee4521037760ca651a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5670051b1606cf1edbfaaef743206c809
SHA10a1431e89869b3172b6c44b9f3f910ae2b1769ad
SHA256eeb88db5a6c57db87e8c3211bf9bb1e10f023326bbb4b43c038a5bc41d34b86a
SHA512077153456bab907ac68ce6848254969c933503f67920bb8af6fa8fdaec9292845ea39ae541b17a23361f578bd6fc527bc7ec1388e85eacd0fc055e5ae2b414b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5197bc2b28e0c40cd143654c87c1e46e0
SHA1aaf92b9687319cc1a92e16b1d5688bba08481e48
SHA256d0aff7074e218f3a1c4f15ec2026cf011332c2629342a21ea36a1678b7aeed97
SHA512091aa67bc595890239e536e2cccc7d26ae45159ab73e8155edb1c34f39e925afb491437a398b2fb67406652fdb3a73d03acd2cf89af0a42d23e44ffd6cf8aafc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba9ce105e18bd7a56a1e46e588b9fbf8
SHA1db1c99b97770c3d982991b767d7299ca428f6822
SHA25646566a8d3af7d2c9f7d684f9a20d22e5bcb00b85a417fd643235a3cbe51faf4c
SHA512bfac25439cfa5df090b16b12c413fab4171c3eac77649f7c95a9e211003e19c66604f026a99b8fca75dfe391106eb869e3d618906120f4bfbbc7bce99575c853
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58eddf128430e6173ea927c54d206a313
SHA178d5822f374e973937b9f6dd17c522c7261eae34
SHA2562b66714a4481974fa560b46eaacae6f48741e100c5b1e754486da0bcb41d4831
SHA512efed3b29157278c14add176867c96e24310dad51e0c448850728827a79389cb9c46fc18395ada82d0f4efe59fbbdf19e803e83022604914f2ce959bc93f63af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5417ff2c52f3614ad342dba2f671db816
SHA11ae938d769993d6d35596d9f78c528fc9127ea18
SHA2566a44fc05ad5037650a4c85fb94128b3e9d1abe35cc2806de3f7f74ef154fef1e
SHA512fad24922cdbb34c89c7b5f4a806f8cdc4f8cfd3c927f4684d17b9a14d58efad1e414870486fcdaad308cd2c5c7ad2029d2f16a4c488168417dfea6556764fa51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f3f1f70e9b5f4c55fdcb2766fb7c77f
SHA1bfbf8ecc94273a77ea3c01c3227b19b47b59fc43
SHA256b6db4bfbf1edf980c2ac9a24b137f8590940aa7f3bfd7a4bd64e05ba8d4524c0
SHA5127b88ff64bbe006981c73ddbb11ebedcb94b9e48f19d2d38f8784f5232ce3caa6ad4bb8bbb477d9a751e533ea1f03925ab763a452cf80339104faa4e59022c0d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffed74cde653075e58507a4c9cef9f8e
SHA17654a8f2302f47e94b64cf480bf0ebb3ce1eb19f
SHA2567d102d36c263fc1eca264ddb046cb6cab2556b5c4ae121e7028dbbdfadb02321
SHA5125bea6815773df0d826436506f0690cb48f9574c399875e92122be44ade36abf267485ec1069e5e4ac7ce2089a8d2330271f460dd1bdf7339f91c41c1368f9909
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f6cc6bb2473548a87fc5bb9e3ff2701
SHA1ec8eda71d10d73bb80a4b6d362bfed70c1d5dd60
SHA25610ceb6a10157b9497f9b06922e014063287a11a6860dc22e70aed1aa8e23a155
SHA51239c0c8b173f47fc058f6ffe87c51cb15823fa102815ee0c72607735f1e83383bef3ef30e722c20891744ec160701e0c588e9618eda80fab82c55297e87181bcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc1282a459d55e66449f1b6e17668fd3
SHA1f7b360ec7578c354f2628c8107063ffb8c7f0640
SHA2569fe69b9b1fea07d5f5f9097a4172d761a3799fbb14bdb3cfddede6f5744856f7
SHA512cc328bbe6168f5d9c59c4073b0860460a30d011b3c9abe9b07e6fd227ed71003f394ff73c2442adcb6dd0215d8f9c55030d2c585f73558d37d2fd6d66bd06f55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD588763a8fdbefca4802e2bcafebe7311c
SHA17988ec97a93eaff864398f414a501ae383de3e19
SHA2566f879eb89500a9d4a7ddbd9829f0a39e5b434a9c7bd42cc785af8036258c3843
SHA5120b1e858a7fce6fb726bddf58c2a324331ac9bea548268160baebcae6c0ea0eeb2ef132d44623097ca44fed7ace147c3aa5b77dfba76b62138ae3d1d267236a05
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5689dce2a6e90274baf46c3345c7f964d
SHA103155d0f8e3a5845ad971635e70d8f35cb07fce6
SHA2568a613621caa6d2bd48aa4f62011f66e6a08af697b51735e12cc9691d561af6b6
SHA51221e7602796bf68a9e43abeb62ecec2b17759e689673db7563cff3333f65620499b0a32cfe07fec416014d862b4f7e9eb4a3f8f594b0f71f5b6ca1b2490c89510
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53cbbbd9aaea28527bb72331400a12f01
SHA1a4ae1af9c874711dbaffa64bf70144c51e6b2fc8
SHA2565c2823c42c97f91dd2da1a9d99d0a805f741e38b798071f01338819ca9a5415c
SHA5123e6da04c44cd5ebf32708d18ab27f48c993adb1d46e27d87a768c6caca9ffd3840e732ee992f5a264fc597ca6f2fbe11da2539eb3e533f4c1d7e43ad9a8fbdbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f562b5f718eba10cf30a1f958a9a957e
SHA1b2af1ceb8371a17aa7cd78a4f7a1447e6f4b8b45
SHA25642325be044eab9e266338969de81961017684448d09e7bc254252820f87a808d
SHA5120f421abec342d6d1dfe2d8b618da3fd02a49dfca526056cae8c53ea73bc8eb343504803d41abd9079e9d8f914a5f95f296d7941f15dc986b0597661a6c6f0fae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2b33977ab5c19897e8c5c382be06361
SHA1c06e5ea2779feb3e81ac9e5f00ab099772e562ad
SHA256a926fee019860ebd52f341b596b612d279f26428c0c3a0b2608b185ac0a8d4e0
SHA51239a1030b52402eba3b50ad61bfdb1c406103cbe7b96d78c531f9c6ab87fb6bb2979cc3cc02453f7b9675ee84cb8bb8922bd9d57e8c315f235c578f1f2693fa3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54a5b647f878f07712ea8a2757e005b16
SHA18572da421237681b0a3937139e4f2fd9e875645a
SHA256a242e923258cdaa41d8dcf4e84436ef88241a73c100e6330a42514dc3d6aff01
SHA512d4d518f010e0aeb7402be1ca2435efca6926a970c7c988635b4e9e21282ea6e9162425cc356c0eafdee1ddf1cdd5d3c18d6412f9c4794d6f14d1fc43b8c34352
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5040a30a1853801be23b28a30faa040a7
SHA12d05d0126300e08686055db42a345c09dd85543c
SHA256299606b4aa7d65dac3e1d61fc73b31c3a831786224e372f23eba72e519d1508a
SHA5125a210349b874b859fac7a201885a4998cb42e1a9b93af769457e34ca3db92918aafbf436e013ea45c288944aca14ad3331ac84b5421a1d10d9b434d6d2ceeadb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b05df2f4d05ed1acba106e1f24489ad
SHA1ad48aecfe0e5f855a966556f14e12efa338b87b6
SHA256ec27582060cbe73dfaf91e929bc5c3e2f597c16e80a178505cba7f32469a8f7e
SHA51223d5a9f89f6cf2c95414254ed9fee0fa8167a49082e8edd01d53f5b2bfefaa7e4a5ffeee21725c210fb598e2b0af29f4dff63e15282b9088608b187df9cbfa22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db638cfb3286f7279a1fea1d8abb0118
SHA17d4547ba01d47d809784387a961df9ef677f0011
SHA256ec932effcf17e8813b06e617fd78f1d2aa93a651ea44c925522b3f5c36df0c49
SHA51252e89909c2851af89ab9938d5cb8a6e18e7b55da4971aaa409a178a6f8263af085709ee7938d9e863fe85bb73fd597284c09f68f64b5c48f148f79ffe7108623
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c74fdd48fcc7da3f0135d0faafbe7f5
SHA11f536fcd3bdb5b639c7fc91c654366def510bea7
SHA2560f4ed0e37f4f281f07f45f54fcd75004430da08dc84c5fe9652e6ce3661f3b7c
SHA512c499e5885c21ac3f80929ac360c15d7499274feb99665868e6ab58cf8b48fd357a04047a446b82d9679b9fe2f8344b49b33f55b0c3306360f77320d6f8698d89
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\cb=gapi[1].js
Filesize54KB
MD5b25d50c313486dbf411a1736b438e641
SHA14fac57606e024831f5751ef1c3ac7e937ca635ca
SHA2560e033a519e10a6e8c407c5d1ae66f1dedb1780a0336ee08cdaf108ad64161bbe
SHA5122f506a772a0cdc20393c5a22ab553c73bd17027444a867026133bc997f379b01aae413ed52ef08511fda51acffad0d88fad65229fb4d9062cec36dd1f0ad59b0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6WEH2YLI\478691279-postmessagerelay[1].js
Filesize1KB
MD571f718c57c84eebb87f8aad29982f2b3
SHA12d3093e17e527d17037262dd4603f69ced713883
SHA2560a41a1bd011bb8269e2fcf33b84754f1b7f1b0272a7feb0230b6436002a1165d
SHA51227a3b576ac3da227b0acfbca88e1f57ca89e962d5a83f1299bbc98387bf03820eee8efb3195d4674124730dd8fa449b3f138b936ba1de9d155a342c14ae02021
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E25VF8N4\px[1].js
Filesize346B
MD5f84f931c0dd37448e03f0dabf4e4ca9f
SHA19c2c50edcf576453ccc07bf65668bd23c76e8663
SHA2565c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584
SHA512afc3089d932fb030e932bf6414ac05681771051dd51d164f09635ca09cbd8525a52879524b6aa24e972e7766ddf529484cc1ec416de8b61255435a89ba781f8c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YT4IJQ91\rpc_shindig_random[1].js
Filesize9KB
MD5bfc271c9a4a7ae63fc7fe24e493d15fa
SHA114b490fdc17ffeb8779af97ba449859696fad89f
SHA256c6558047466e88a46f300eb09a5f97f3c38e3a593eb38a383809a28c0c9a2e00
SHA512e5182d2b650609209156d195e82f7446fc17858c38504fe8ee6ef6d7a473a7ac684497b756cb9862b9a5e5b32a2f6c4c3165b7d08ea27ba1ec5fa2db94f1188b
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
125KB
MD5cc06e89e41b361d5e056ef22f2da6c76
SHA16ee21b374d94ea1be97610fc3b01468ec28846b9
SHA25623e22a5305c2af35cde688ebd77bcb57800ab433391b4d4d8b6299254a47c769
SHA512671552ddde33e5bcb41e56e281692db960a3897a0863a011f5b28473d0a0c3064981feb802d901a21859d9e9f830d16e76f28bdaad588ecd5490ab0bf2d31ae5