Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07/01/2024, 11:29
Static task
static1
Behavioral task
behavioral1
Sample
48d97d9f2b35d341f26eea0b8a492d0e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
48d97d9f2b35d341f26eea0b8a492d0e.html
Resource
win10v2004-20231215-en
General
-
Target
48d97d9f2b35d341f26eea0b8a492d0e.html
-
Size
82KB
-
MD5
48d97d9f2b35d341f26eea0b8a492d0e
-
SHA1
71813f02f53de11bd59b31f9e436f82671f0c575
-
SHA256
60b14194cd510a3a323e3b15e2914b6d668e9078aa52b9f2868c05632b7d53f9
-
SHA512
dd473c2cfc26c3b76714a8ae2990d9dfe4c7a79411c109ab34f684a7ca584eca7ff5b2337292530d214c1a06c2adcb22b7752b06b21698d1ad54e5136f46fc46
-
SSDEEP
1536:WXEi5DGcM/au5FHBdvyguqGm6knZ2tdKQlqRIG4hqag4hWMekB3ddm:WXEuyrXxuI6knZtIG4FWMekB3ddm
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000cd2d1c9f73d58b9b04e01b638b0cd994d657219db4889711518cfe84a25d7694000000000e80000000020000200000000e4f1b28ad01cfe0b615be13a58be0275e3ea00cb779c4951525c57f5c28128f90000000b4e598b34f4b5af115ff1a97f6477ab2f1cfb669bb8e1b52a92bf60cc987782f15cb4f1e29edf56d9efe9922a40f53fd6786bc12ef6559cbdde357c39ef789390ea342ff4b41770a077a3963ce7d25d641e396483df6d3e696f7d1a53c0978fb3516ccca0b2602a1e745f7b93a2846e267f0985f89ad92542c3026e21c2a88060080bd2f301612717750ed3eec2f94a140000000d23f61a43ba75478ee2e7bad875a8477a95c5043f42c0d5f423cd9ffbba3d1181a703e63099619d69f2741fa96781f2bd501691135c8cd782f7f447b0d52bf80 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12740B81-AD50-11EE-8646-6A1079A24C90} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000a7368f85749146c0930bfc7bb4203052302bf81f14a053932cc5a6cad3591cb7000000000e8000000002000020000000c3acd14df1d6fc74546424c74e2378e2a1e14b1365913fe3319d15177a7431212000000056e3cd35708af650f42d0432a67f13fd15d59103332ce095a762ac2a216e311840000000f4a2d6dad90d6845e3c7f4192665b64f2ca6b0e447886d11e3e4e3a0e68c2209f9517d4583c121c48547daf0c8386b25c9cc04c532abb02c744257a40b5b4873 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3058a2ec5c41da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410788866" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3056 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3056 iexplore.exe 3056 iexplore.exe 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE 2236 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3056 wrote to memory of 2236 3056 iexplore.exe 28 PID 3056 wrote to memory of 2236 3056 iexplore.exe 28 PID 3056 wrote to memory of 2236 3056 iexplore.exe 28 PID 3056 wrote to memory of 2236 3056 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\48d97d9f2b35d341f26eea0b8a492d0e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3056 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2236
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e895e0bc5f0693f6047816179d5566dc
SHA1347e5f2da1a32913a22a826923cc027a0770f20f
SHA256af21b203ef714f40cc45ec380dced998971384a59649459e4fe1ccba9aa61f3f
SHA512c5397030e138c90f9e898302f09e64478fcbeffd14033102667ef24f2396fb3af20c29b21e601d2ba9ea977f7161397df80332ffba10e3a5f1d18143463eb989
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e5093d6578ed3a77090b05f2299c405
SHA10cc0bfaa4055208517675aecdeb846ef78a5a567
SHA256ca3221ab0afb74c634122c729d22946f6483ab9d1321072b1b7feffea0291225
SHA512e0120f5350ac291169c3e4e18f1df1de01dca5409ecd90548da6b1ffe099d8af32a3ea81e57292955a198807b3fb8bf3e48654df7f0a870972c1bee77c0392c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daf32a2679d271ef98d372593a998661
SHA1249d817314d34384f6127370f856c7f9ab054db3
SHA256f0ec4257c386fb14bd110fe9be0fd61c3a777db78a0c6491cfd72c7be75e1e38
SHA512533b292d71eacf06ea557209e769c6f7b75d4a3ad3bc9b4a102b49d832efcfd7e7827d548421526b6f95220fd82c97f3e812a9295de0ed8b5a5c9627b8b9adaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ee25b35a7060d1faf609888a1e802b9
SHA1b070b4dcf41d4c8a8c2430cf91bcb522670f6b2c
SHA256318385062008d2dda3f20bec23706cc7f8a35117461e54de729ad5fd5c440538
SHA5120a3ec032b6504d2724a78c5439442505a4332b6bea941298d51d4344d5a53f193643b1052bd192265f29ba4a999440b10beac66dde50b9a0987c0fe56c0e85c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584c267ac23c4be088172480ba723e88c
SHA10513e1f9630cd903934ce986503400a72b225fe8
SHA25666a58292c753ddff5a3911423cbaa87d3f093ac59e4f2e8afe9e729ed74f83a7
SHA5129bd8ef63459c4698d44dd57fc301a0c03400faa56c55858775a3c1f63c7cb5c1e7e4aa80a15cd30ddd7ffaabbcd601cdb3342b55f7a360fd3f9c286d5886ae3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5307e470b3d112a9e8c5ed61ef316ed24
SHA1ef9b56fa7406eb6da7e15e3de175e9ffcc3f749d
SHA2569e63b4a882f1c344ac43da9b6540f3ebd7fe4c1face48b2a957b6d134b49511b
SHA5128eca260037f52c3a3087cf74b3fe82346e27f3c6b7af4956f01340210058bb22049145d4fba6c3e7bdd548f25c39614264e9219250a0a87c66cf3a862b59be7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c8644dd1aa4b6071dea2949f173d5cfe
SHA193c2a9e36a6ba9921b75dd62c627a82349cd4c1a
SHA256d74b8448cd10839326f6a6970396181e43f95acf80a92a1b35967526a4006908
SHA51205b558e04a5a8884c0c888ee0b9dbe3aa917a2add6c6be5b87a3761838d1931a8927d94e4b63b1c471ff22c6aba2a834a19847c26661a7bcb1967ecffefcc6bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f760574d1f7b0a29ffe51aa8ba71b9a
SHA1c2786c077a5c63bf12aaf83c9ffb2c9a0826a766
SHA256719bb8f58bb29badea4779945ff5e3dc5aaf330a8afdaaea1b5463418f1d5571
SHA512ad667d60209660684ab5294fe38e48cf6e542a060878d8a0582dd75421740a29f81891100f1779783b1323a8d944c6bce97befe0645452e1bc68d4ef72b24328
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8cb5c80c97420e4d1055a6ddd754af8
SHA157e9a39e78bde333cd5daa7c4e9f3de8cd79ffed
SHA2561f02fc0d6092e49ca97e578e53aad7f062c349a60c6fed55dad76b86aacbca81
SHA512988a3b1673bce1158c618a2a4e7a2c7b9315f640cf9bc9009b1ae4821c0cd73dd46967bd2ee1462cf3191291de4a8f8eb718b9aaff8374caadbcbe3d9ac309e2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5974426db507cc93784dfae7683c645bd
SHA195e13ea72c5047cda6a32f93e86369e2f53fed9a
SHA256056135f602f191812bdeb9d979de3fa448668f7df15fea86396715a0b3bb6bcf
SHA512427c12577ded86205ebd6d541da02a25e716193fbbe16ac1b4ee5858a03f2fdb6570adca89d94961139d9069e3221b5755b38ddd3846a10fd32db96940254151
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ef5b20a510049154d38e6406c7a3c4f
SHA1b4a7048f4c845f34195412cb735b8899d3aa5e00
SHA2561cf1fbb05f95bb0ea7ea1c2a9b271f8602d29e6bc722c05b1298c4d42fb3d848
SHA512e35bdf0b443312ea603c0c377c3d8dbb278511c40d01ec60553010f3929c8e4f3f97cd595cc9a561ac7f5a1295527f09fa2b349b0994476f7525fbdb78837d70
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576ae5c3f84b8e19dc97f3faa782491b7
SHA1904a29ad8363f91dc4a7e57636f527f6b452271f
SHA25634cdb3275474a0e34e17a5b5ba1afcb49547e5abc6b9299673f49ca2f335f25b
SHA512c65f135ad26dc3ba00857d4b5baf028ffb62f23f525872a5738be70f583a00644554839f6618772f45095b511c3209da437888900fa42a01b417bc71c8551ac9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55cf34522774eae83066ec0231100ac07
SHA15a194297e693f3ae7270c70761907f2d073551e0
SHA25629242a62b20a1845711f7d3fd86836a03ecf3e58caa31f24b1b8d163baeec737
SHA512c76e20935ba566091d2b8ed07ad97b976621c871c130d2b17dcbb5f28bf8344362364f29f266196f403c3889c57e1a4acd53019e75036e55744b5c0f752f40d9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd37ea73f37adb35dc087024dab79229
SHA134304e87a830ab40c8c9d083c0e81446bf0e8490
SHA256d66c6678bb212040bd7002ef6a45d3f180f26a03bab2cc9e7262d9a3b8593e33
SHA5127d6543226ef0ff67bd717c24dea26c41b5a868c13174558d8c7cc8f0764c5df7cc53b1b13b85f407547c1094a71defbf46f7aab75fa32a1fd99a53c5ccfd51a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ea921980266999e27984888bcc7c3240
SHA19c1df3515d244385ccc8c23028028a1c1e8170bf
SHA25668c5ca543a1fa6c042507297482585bf5ca628f6814d2fc2cb395eedca13621c
SHA5128a86494aa2db138bdeffe98ee02d6e2849afbafc19d1005294ef77f5c6cd36f7fcc72709f4d8d88a2cfaf5215c1dfad46c6583e494642e09a1a7c16c1b877bfe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f64a96e5c925db78f9a259f62c91e06e
SHA17a11a3a605b0e17609c82832a7c6acce5b3a76f6
SHA256455731dfdf680f0e6b85b51c32c182f912c81cc664b49257c01534de8d146a20
SHA512ce52320162c7ed4ae0ed973fac0da7fc1548659726186601db782c8b1e5b52340b99f20337f4b36ae108d236a0480cb0775fe5b9d0f610be2ea7a6cb127a6cb1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510662ff4cb0ba46806292d910ec5b68b
SHA112a15fa31f36c42d538583707243f157d93a214b
SHA256aad447e3483d6ad9635aeba7dbd848e03abede2d74627135dfaf6497031f26d1
SHA512e9effd4ba44f7ec7137534e32b8f2afd3f64753046f210bf666b775870450c086317121b3ed12433c93efc5a39364774b6bf5f871317a0d9a01c486cd8b3fb1e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06