Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
10/01/2024, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
50fec7c1f757880ff96dbc3a0dda8491.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
50fec7c1f757880ff96dbc3a0dda8491.html
Resource
win10v2004-20231215-en
General
-
Target
50fec7c1f757880ff96dbc3a0dda8491.html
-
Size
432B
-
MD5
50fec7c1f757880ff96dbc3a0dda8491
-
SHA1
887f4a8838f51ec140679eb5b515eb422dd3a852
-
SHA256
e833f6d180ab89527ae432b3388faebab8d02c6326f7263aa68d5aa720da4be2
-
SHA512
2c91e05d6d00b8b3c3e1f3fc0ab0520487960c7509877b0e8c52172c100ad6ae592c2efe19b12822798239264ed2e700d314a6fbb148029481df816244658b07
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000dbc4d43e207240bab13ea30aa8afc3731abaaec221f87ced4f8771716201efba000000000e8000000002000020000000b0a907071cbcad8b75a57346cfac72de536796e277b5ee6f7382f7af0d679ca0200000003c86e72f7abc5f59d355f2898fe36947929b7137820c003bbfda26f4328fefce40000000e4ae85043fa3eb3af831e5fa89e12fcac8eb1de5db4e00d71df67f14fc535eb3c6bd9e0ad10e8054f7d85514e19ce3eabfbded39d48dd5e0e1dde5da1bebe9fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ebba19fbb6d79d01721a10772edbd14b1d900ee41f4603e020a6f04465910a29000000000e8000000002000020000000156cbbb14fa61553530910d920a705aa2edc12977f5e62a896277cd3a58927589000000055629f8cbc049303cf8f53fdae116ee525e46592bef9fa9c979dffffb15ad8555488d1af181b4bbebb7885a46be6c2bb94a1fc3e9a8b626cba8e3c595e115374d509550746f661b674600cbd5493d2c6a4cd219ddb6c747bd1564b69d19006f071a935d8d9360c57b2feaadcc68a21f1ed4b763d6062bcc4e8f3dcbb2e565e5ed07d48008f89d4d8f88c86ad11addab640000000938a2f8ffe9cb088f2295c23fbc4e8735886d180bce03f7b4665985b62ec1b23c6201b7162a2ffd8bb7b8c89327385d6279bfecda683ba98e1ab3cd16219832f iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d063fc08de43da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B4DC451-AFD1-11EE-9E53-EE87AAC3DDB6} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411064246" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2208 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2208 iexplore.exe 2208 iexplore.exe 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE 1748 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2208 wrote to memory of 1748 2208 iexplore.exe 17 PID 2208 wrote to memory of 1748 2208 iexplore.exe 17 PID 2208 wrote to memory of 1748 2208 iexplore.exe 17 PID 2208 wrote to memory of 1748 2208 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\50fec7c1f757880ff96dbc3a0dda8491.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517bdf8f3ad79d4201642bb36d36818eb
SHA14c235ef0b4da66e1e3ad67a4f2bf1740ee5b47fd
SHA2563bb742fde6f4539f1d24b69be84c2c7a8932821adbf9d5e8333147fdfca20dba
SHA5122cd08783af8b83a719f2e2b7a345f1c84542f951d9cd1a4c0467c3cd8ee1dfe601d99d41f7de79c358ffe178384802f416f26f7e337a0372ebd3efc841e0262b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ae7e775e9144f3bc33e0f9fcee5fa93
SHA180e40fadb5e86e914c97ef62a9a987d43af76616
SHA2564e9acfa43b1750882ebf4a69c07959f559dca10c2b4e2d745547ee84550d6611
SHA512ca1a03c799fffb5b361e1ece65dde946aac3c15f52c4e2c566c7437d0e92a88d1d2aaa092106e87cb8c533e06a1aa02ac289d99b2f025f73d277f89c1df188f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590de57068b5c7dee23669af4882b8617
SHA10d997f67d748308b63f436c879f7d4d0cf0f2e3d
SHA256e905fe6dc11fce580e2caef79dc648d665ed2d944f89f245e9d73f76cb22167f
SHA512ca6fb1325b9da76f1d7d5c3aa42ed4ab0a5d2d8e64b8a07519f8a4f73015d97964719cbcadf3b52dedcfee47a5173e8744ae3c298f5d8850c0e6c3c017f003cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50fb8a84db053a2d20ce36005f86ca8e4
SHA18db95e937350227c6b8580d01d7d0bad5e53a01c
SHA256cf1e7eaaad39570ff31c9303d83be3d034e3075907dfa5c725c436184ae2e0a4
SHA51263917f58b004a895115bdb0489b72d67cb360ae07277e2336f89d7e46a49bcb0a428ba29f8e5ce4270bc1d774ee76c1cea8a33142239b0746f29978111c7fa8b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fe91466aaebb7238da3cd02a24bfaa8
SHA16318b9edcd227d9102153494737a6daf2605bb78
SHA256abf5ecf622e66c11eb6e10d715ade5921672a072046f4e58206c5dc073372b84
SHA5129f1d888d65ece3f82fb8f3b2f18c8d4ce393247e300093d9ce807a3530a3c99171c912f95445ad10392b2759e52db3d36702d8ad265a14286717f03ad98620b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537e239b5223b414ee6f6ec792a60e179
SHA1e6bf7fb0747ce31c0cf871be70fc6bd4624c8102
SHA2567ef4cd82c714f0f06df38eee9843a0f8138a409a93402cbce8896227745fef07
SHA512d578147634ba3f50f85a2b1586afeca7d0dd545ccab3d07a913594f0449a1ede2b4535f2db33d17da508bab002fcabedc44aab9b0eb93e49fe96a34935587ad6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e