Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
08/01/2024, 23:02
Static task
static1
Behavioral task
behavioral1
Sample
4caf6b562cf69340edbf1c76554b6b67.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4caf6b562cf69340edbf1c76554b6b67.html
Resource
win10v2004-20231215-en
General
-
Target
4caf6b562cf69340edbf1c76554b6b67.html
-
Size
182KB
-
MD5
4caf6b562cf69340edbf1c76554b6b67
-
SHA1
c1a25a49fadff8bef64ad0f0229d8c94c83755f1
-
SHA256
ee41a6e834d724256594c2d2560ad6d695d9b5ea1a69d053c6b0c76fb82052dd
-
SHA512
2b0de79ee0b5000ed8899e367cbf2497d5ae9240166a8841805972abcfb85a92707de56ba83a36caddb25185171d9c5f8033ae4ddfcc5a0fae379d724eca1aec
-
SSDEEP
3072:SLESaTVJyfkMY+BES09JXAnyrZalI+Y5N86QwUdedbFilfO5YFiM:StEVssMYod+X3oI+Yn86/U9jFiM
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6DC61D1-AE79-11EE-84F1-EE5B2FF970AA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000ca911bd156cd0eba1fc591ac35565067f3680701a46dc5ceb1a196b9230faa08000000000e8000000002000020000000b9241702abaaafe5523da2582ccf6163bd64f882ae9f3751d77793f2f9ce8c8320000000b74cad9b29d4290f3c84386b00ea1ac91dbbafe3df6db8e7b409a3483f343f734000000024f3668832caf1a2a6054c9a512c02f1e98396042433e02f534f7ac0c67aa2f856d3e50a50b2bb0136e2e7687ea7f8666a04a3e4dbe15f63379693238d9c6068 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c193cb8642da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000d2c0f62bff2f46f646e2b4f68d37ec8b0f0d78e60d88d8a4c25d906acade738c000000000e80000000020000200000004c21c7177d094577f45468303b104631c29f99ee10d12cc5f66c807014b0d936900000008a932e99cd5cadf6ecd9118e887b563e9658ba1caeea827329488bb8c11809633affe006fab3a6e06aa60c1b7184f0e4554d7c316c03ad804515c5452b518c70198a93efcbf0b4a468ba85bff6f51e866a062c90507f579ed553657fe39180431a96e163f97155f850ebecf58b0256dec2560daffcf05590a9893b8735e4d782c69a9955e5d325146e5a195ba01787fc400000005b8355a38699f66cbc00fec339ee4952b2f7bbed4a708f14c7ccc9c0032b5d0af583b3b798ceee782e5a201180a7d8fa9a12a9d4dc90be0fd726c1969297628e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410916808" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3032 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3032 iexplore.exe 3032 iexplore.exe 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE 2400 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2400 3032 iexplore.exe 1 PID 3032 wrote to memory of 2400 3032 iexplore.exe 1 PID 3032 wrote to memory of 2400 3032 iexplore.exe 1 PID 3032 wrote to memory of 2400 3032 iexplore.exe 1
Processes
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:21⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2400
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4caf6b562cf69340edbf1c76554b6b67.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58add9ddee3df1e0298f9d210dfdbcf9c
SHA16e61ab25e65dde10f927d80c812c6ae23301da63
SHA256ebc93553336522886c0a2122bfe73b806a134052f646127a08c466d5667d6405
SHA5121e24d1edf8240e3c794287e1a1f75d2983527bdcd01225c71140cda4c71003c8dcd30883adc34f1a24624022430e6766ae2ecda05258283f18ffb88600b73dff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5679fe4cc79e258a0d29fbcb95bd924a5
SHA1d1df6be6a0def83d87bc1e62ade2045a3cd5b86d
SHA2564672add8cac0ca0d7a76bd393438be81c1dce50ff86336f734b8ea170c50d440
SHA512daa2af307fb106a146f826d30fa16d80ead95ca54efb8f58817fb82547af1511c493d3ead364a261b1a7d15449f6d18baf781e4291f0b531f44f7fc1cc486c2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5acdd3496f5dad1ce1eb7482ada868d0b
SHA16cc27ad3c709f2135411db1657d22ec119709eac
SHA256c449422c01460f77e4b5bc338614f514685725146e97bd9bbc38ecdb6d13f16d
SHA512b05ede81f6bcfa804e30dbde324f72357b4e24d25236838a7e06ce1f4a3b15cbeaa1e82db68dbac3b4cf0e3d5dc225f239c84c4902a8fa814cc301e89991ed1b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb7fd41f0924281f868135af3fa14a46
SHA18e8d640175fc162bf459564b0d80e8a152a2a292
SHA256ddb6a97c2b0584eaf4fc3ebe3a805355e05ec044ea1ea412c20132cb35aef314
SHA512f883a03c7bfe28bed27c2b4ffcc42f00f5482310e532f444a5e1c03b4d4e81619e213439359d230236e3be631b679415fed27ebb065f931ed1ceeccb07bf5e30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53224acf8bfb89f876a8cf93fac66efa4
SHA1f43237264cda55ab9b7e022013e5a6058c924955
SHA256d46c5adb85087e5683222c93f1f5aaa8fd08dc14ca89fd05880766097b596d09
SHA51212c9426daacb9a41aecd1ea2597aa271d17b934aaa24b07eb63ea8970eff0c0cba68aaab31917d8d781ef995e8436cf9c54970d45ec81d93de075b5c26877f40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d19989a24a8d84813b38c33e5b5b3769
SHA1cbd1872d768be084e5bdcd6f43a3d4e1dd4dd6d4
SHA2565348d8b28636f1fdd9313a894783c9e0c0f9b6b6eb8f727a39726b0c8985bf51
SHA51238ccad10e017734b120ecdc9197b8232c97ceef085e0e0c92c0d5dde3593af88c2f8c0899a59ceaa25bcabdb26a5b97bcc06b88206c790851be81c9c3d812099
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dbaf6c93df9e4339316465588f55ceca
SHA135b65a728cf786f5f5e2331d68383b9b9ed17d8c
SHA2563dfed924d34c469999510612f7ca990546adb50bd1ad40269e465dced52f42e5
SHA512313bc73f040ae1b4b58126eb746f4f32332ea3d94f9c712fc436b3a9d5eeac09a8cd05859d841a491534af3944d824ab6d4d22185047184a34fafcf4e0d91d17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c85734b24e0f653fbcca92c7714088a5
SHA1ea86528e4d3c94d5a18ce4a1882e85c8e838cb5b
SHA256f6e227aa14ef6981f941dde040054269d0d4a59f5554b5a168a2dbf5b67da2df
SHA512c8af19e1bf67e203e40bdfedefcc9aa8d56f0a7bee130558c0348112e56b42c2e0712850db8273e75b1fc5c7b357b1df1688b23971ffcf40e6e8ffe43d1278f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7bad5732d520767949261444e05ae83
SHA10dee24896ab24172421f1013ce505fbc257fc388
SHA2565fc2253789b434ed045064e54c90508d581aa25bf29437c5b9a9ae5b4592a5bb
SHA512da800bb23f6078b6b6980d90ae8da36b370c9dc910ef115de70dc04a0d13b3e8e91332d7684f0d13fc1a69ea18cd0913d2e76779adc40fe268f4be4846ded2df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578034d73bffacdd43bcc91f8b4ace58a
SHA1cb21b6c5ded7e5809dec270822cdf8dc8c88c022
SHA256201ba6387a491e37ac4959f67d9f4da647c024dd3e43e58a3de78e0ac250ec63
SHA512bf3adae761fe962ae27635748a72b4833192207259e967bb771706ab185665a2b854f7270067b521f712fe651daf373a48f818d68919f7da1a6a208c70038205
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c52d17fc0e2e0d3b89df74e93d64bd7
SHA1fa697802fc595eda499e26734624c1f78e7c20ab
SHA256dac8ca0656543ac65ae9e1fd9ada37421650f342a55160ae8f37907cac7be77a
SHA51222d5455187c5b85494ec5e2244d244f72f25b2668f5a468bfe5f5d963ff0295d99f4f6c03fca46b77792bb75be46c5e5974e0127584ea3a31da5cb7b411e3fbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b3a7eb723526e2b87bde379019ad8778
SHA10575deb088e85dcb4967ab9866d27d5c2d76e3fe
SHA25603455c9c49ef899bc5399b503fc83272338ec295c8d594b404f8566ad01a901c
SHA512a0e1d48084e56dcee361a0588d9d273b8dbdfd65473d1e3c740489ca217518d355dfad6cfaca109f9696df81f096f32e81089f9cce784a31503e3af11731eda5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06