Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 23:23
Static task
static1
Behavioral task
behavioral1
Sample
secure-email.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
secure-email.html
Resource
win10v2004-20231215-en
General
-
Target
secure-email.html
-
Size
572KB
-
MD5
98fab066fc2ffc4c2befae37ede9cd8e
-
SHA1
a48b73f24984c154f1ebd5601f4997390e8e8373
-
SHA256
4705b829b643238548777d81c8d68a5766f8e9a2bc97df514b8b474812fa2100
-
SHA512
bd8b1110a48a7c9ec7b4acddfff7ddb91d666c6a8383fc061a04cdf4172ee2d524b13a6c1dfbac93a17b52300fe3509fe02eb7d92d8c94ed6dffdb9034b6e996
-
SSDEEP
12288:1LHh4tGUfSeTtWkhPqPGS0ZcofmvlNt3KdDOt94BDUk5vX9:ph4tGiTtWkxlFZD8lf6gw9
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411177270" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67036BB1-B0D8-11EE-96AC-DED0D00124D2} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b2617461a71e6418e43118b8befc5af786a6fc79dedf87c2158962b907142083000000000e80000000020000200000000fb8ef45b67f5f2baf1a09cd43011803bdedc5b6df306258ea1445dd0fbd06a690000000b779891b7a6dd0ae914637fbbef8ef7d932b1b365446cb7bc94f2c4c12dcfae4d4333e29ec820fcd0fa0d582b5b843f9d569b402d440f6ab42c81137da9b26ed0ef0b84250b2f4daf01257b6c6e396935a1896065a863f0535bfa18b1ac99492ee41b7d356767a2b96147a6ebe593b5e14ec118175e36a4bab29896a6e5cb1877d48771f1aef544895e4db54511f2a854000000061dfeb039757c46ea87cd926c0045938730a86d1f1cdee051145e649bd591ce9a0b386d1269487553d6d63d9ee2c54e5ad3a41c4a66b5a24ff54e7a52b62d2ad iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a23e3fe544da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d6000000000200000000001066000000010000200000009b70ac04aab665090a92f276f19d4d44f96b353954dbd63294f10cfcb0e98737000000000e8000000002000020000000e9c82a6a7c3d59f241081c4ad32eef8921e1e84e20c7314485ac706bc56b73ce2000000019e089b5df732064c7928956625ef8c7c714392270af8abb4a2049ecea47bc3c400000008f9b10f9f134c694a8778a2d35aed0a5f35401aaac91be63d2cf24caed1c2f39138d6a3bc11f3c0f4b0f0613c0c6dff43d0a14dbdaf2c2ba659f352ca2b79077 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2844 iexplore.exe 2844 iexplore.exe 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE 2796 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2844 wrote to memory of 2796 2844 iexplore.exe 22 PID 2844 wrote to memory of 2796 2844 iexplore.exe 22 PID 2844 wrote to memory of 2796 2844 iexplore.exe 22 PID 2844 wrote to memory of 2796 2844 iexplore.exe 22
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\secure-email.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2844 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2796
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd6995ed68abd786becfc4da80d782c3
SHA1f60d6b0c65f353f49846af8f48e97eec62cf9508
SHA256bad6bad160452297b725e8a33f0ed11a1126fbe241e9166d25a0e2d1cd392849
SHA512ce6e4b854104ff857e4733b1f6f37318932ab7c41d48efb3fa91ff98ebb0d24e8f867b09dec046e71751ec7111afdc95e9151aa60a1d2522c49582405e3dc870
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565da8de3e8389efab877b0ce3de185c6
SHA1048112deb841dec3c047a2e2a6db5c8805933c72
SHA256c33a5207aa8de6dd84da969a8e4815710a3d7db94bd057fc793fcdc0f2a31c7f
SHA512666336fe709186d12b005e8f10ee7bc4c30044614e678bfd7328e1767f1138e0001642a23d4515356db0089d1cbceab003db18bf113a02734a64393785460596
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3808dbe873b672c77adf862f8ec2183
SHA1c0361511f468334eba72856390cdbbd17da7e179
SHA256a2567f26b3e66bc9c20852688dca6892b14de72658e7dfdbeef544b92bf9fd8a
SHA51223733118129554e1fe56fcf10fc0a604e79c228ca6a3bf18ff26e168a20971308546e88e5ea19b18f455fd46b26779b0724cf1b203bf7ef642395fb2ef6d51be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524b059749d4dd2a97125bac4920af02f
SHA1c38614586d117d3dceaa92964321b7af6c7e5085
SHA256d355cc6fde90d7fda377d89b8f46a7e6998d470ede3afe10d2b5c2c917db1729
SHA5122715ce06ccad93ba39e8b653cdfc74cc39d7d8d2e75a70a77f9a2b14bedb7a9f8ba2d27f48cfdd5a9fa51efbb18d40418898897714f39b9932b689014d651c1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5804588b7b9bf30e6ae0f2ab7ea9755f4
SHA107597b5dcf1e0c2f629d8c960d4a4331db2623cf
SHA256896558754d6158cd543d37502dfb290a09c13f1c1fb41071af724517c142015b
SHA5128c2a61861332ea17527507fe3440d189eea827a21144f6a15aed72dbfec56b717c7bb8944495d6319de1ef94cdf398269e3c664892ec98264e37003a43b55ac7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b62d87b910349adaf8e32372355ec585
SHA17391f5be5143dd5b3e862b2ff071a261390f1d05
SHA25633858b782cf03f2c1f5913d6ddb1e975a922eaf01e6175d1db2ca2e2ea369684
SHA512b56a80e8b8fbab536744fdaa7d77fd7aa5aeb386b9e6ac271f4409f390d7ff6231dd2031f57027e6611d25d6761256c71a33ef31f3110a53666a8748f1e7c1b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f52f44bda6dcdf16c9f5795718eba694
SHA184933dcf4cdbd2c898ea0132bbeafa62422c907c
SHA256e8cfccc8a51d7a810b1e49408a63f52523e7c9e4c976772c2d19e13fa51e3395
SHA5123bb1fa4bb4789beaff14626824dfba48b669d88ea189b6d67e8b2596c19dc2d015c415f467b8a3a5576e8732e6277fa85eb50e24f43610996a3e5fa74dbde09d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD516365a33a1c1eaa88fc7001402f1df4d
SHA194c9348d1f90512cd062781ec08f03de291d26a7
SHA256a12b327436415059778f5997e9b340b810db4796eefdbd5af68ca673cd30a327
SHA512e59c38243c5a0de80181dd30c6787397c9376a173c72366984966970d588e24b81381fb503d591e9b5de018078ac4e8794e260af508dea0d4400721b4d021949
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5708c9170e30529ae7a0aa54d390b7dbf
SHA1e964e41764bc12f04a43852ee67459a08fff9456
SHA25632323ecdc1346ee71964792c412f525201ba59fc04bd7a402c2ff201f5cb740f
SHA512c47547e0000b73251cfc09d746c4e68e2170e1fa531442b5fbf744925be9ea48075e7b00c6499635bee412177964023919a2389b3bd9660162f798a650819867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da8ec5e648ea41696e940abb9f7baab2
SHA1569a8c15a72bcd4ace765ec212818d37dacfe122
SHA2561280968eaefaf5f1761a47baa01d338883240d18c9e3350c6a7741324c6bac4b
SHA5129914acd4fff5d4205cf81b93a2069fc748d1a4752b016862c15a0e3a08c3efcdbc66c30a33fc6309e9ebd6b5ba48f24346c2f8ac2a3b39df678693e3fc4dbd5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545058c25f0d8c9d2731e0f17e6c631ee
SHA162c95e259555078eb432b968c843718e373629fa
SHA256902ab9e6a3087fa460a82c82456d9c9f38b4ab65a696f7c27fcda33f6d1e8dc6
SHA5121e4ef0346265b4dd7765176538c96c09336b40c2e9c64c66715b25430ce529ad12ebc391437a1d7e15566c320f8498a55dc193540cb29468861d4c78f90134b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7c6e92cf1105403c3aa7a6f00c9453a
SHA1e644637af940a0a3cd9223f0de40edec23b0ad64
SHA256d89afe78c44c0dfaba8ac061f9ca937c9cd908009d78366e91d84909abe3c140
SHA512945055ed89232c1b600e9637af57d728bd89abf8d83f92a2e5379647f85719fc5b2ab2be4266c873a8d8b669a54875990aa57d0a6329675f8df87d0a4620e4af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5814d493d0c3376d3fac70559a44d0b97
SHA1f1b7bd3a3537fb0d434de19362e75f6949f9e8fe
SHA256b5d00dcaa4dc5553117d7fee2ab7a93bf20da25524b07d39f0aac531216ab8f3
SHA51273ad60291ca1b3979389477b67ada9cf4842066e2d59812bcd5678c0d3e7ff9c64dce32cc322d99631d55f415b9b8759523083241d0f2b942a9974dac185b1b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f6e4dde476919ba4475c224bcc5ff4e
SHA1e8daca92445717cc780eb1f4e4b4dd6a596225b1
SHA256efb0e5fd745a00539de316aec01619cceda30c2651b31076ac8ad3056e664651
SHA512ed4e2ae502201fff79c481b0d6bf62dc02e5f4d7ec857705c86b1b18cbf00257c5a5749bb54d67473f370f8c618983fb2ab039f9e74ad9013ddb892c60870e89
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
93KB
MD5ac61eaa48255890d137c13baaf731c5f
SHA1f9ae28f6c21358660ec40239618f6ef9f6b333d7
SHA256a1535f48249efcf97d37e825a27275a4e0d7e4ac51bceb4ff1262956c6e48c2a
SHA512e36257b46ed34c2ee03231464ec70d889d35ea9f7f9255ea8bdb062838df8a4331fb6e8808bcf52323e4c26d6c6e9be8af4babdada794495237fd51f75b79449