Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 10:31
Static task
static1
Behavioral task
behavioral1
Sample
5346ee2271fd1b6be156388af09f183e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5346ee2271fd1b6be156388af09f183e.html
Resource
win10v2004-20231215-en
General
-
Target
5346ee2271fd1b6be156388af09f183e.html
-
Size
17KB
-
MD5
5346ee2271fd1b6be156388af09f183e
-
SHA1
3053ce9526d82007e7861f4543dc5f1acfe141f1
-
SHA256
d8945cdc44a0d98edbbb6a78442b6e659f82a3e07424189ed2a39b0e39e8891b
-
SHA512
273b52f611d6ff58255de4392fa66d4ad591b09b04321fc96ea01827e48335d915408fe3e8862102edb6c68d34d2edf8a0c412f79ec6866f936eda324fa8d4f9
-
SSDEEP
384:NfRIjUDGO2G9kLL9jhgvH651AkCRhtkPziMKxvyY1dCjepJZWrFV:NfRIjUDGO2G9kLL9jhgvH6zuELKxTdCJ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8F6324E1-B06C-11EE-8CED-6A1079A24C90} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0993e6a7944da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411130952" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000feadb8ccbd8b3bc188fbb3a244790e946939cc84e36c20d4379d1acee6c15a26000000000e8000000002000020000000095909b11894eb19d3a18c6812b3d831bc99f1cf6aebecbfd9d540541ae654ed200000008869ed8c30f848dfe0b4fcadabe48b19ffdea0a17ed481a5a23011407fc632a140000000024d013a1cb0fb51a73a0702249f56da5b6efb0663273216d507012525a99ce36bdcb3e7fe895d7f608c794fa532bc4aac5c989664b2c14ee4912d365faaef73 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000238ae14bc7447fd778ebd88e274927139901fdb786508c16c267dae7df243139000000000e80000000020000200000001cf94c24289dc8b2e261826d64ed398d14854ce85b5cbf029903930d775be403900000004799be6bf3211ce34ad07ab4d650bf0dd5a622d07f56ea73aa3134d1be2376b01d8308a4c77db01185fea9f44f07f2ed0c456c19007176aba6be08e4e8177232045e8d1e3ffd83d4510841533c94eb2df53de108887cce87933e13289607b5b9f7822c232315ac048767471938e92f2a8340783b5a1af0c292e705083f7ab2113ed6252fb271aac6d170a56dac89348e400000001585571b7b3926b286ce4b854de8d1c3265af1d9df499b7cb47fbae25e6e491edb0793ea30489b2e08e01e96d461642242502f57e696eac2a7521ef8d9f47eeb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1848 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1848 iexplore.exe 1848 iexplore.exe 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE 2776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2776 1848 iexplore.exe 28 PID 1848 wrote to memory of 2776 1848 iexplore.exe 28 PID 1848 wrote to memory of 2776 1848 iexplore.exe 28 PID 1848 wrote to memory of 2776 1848 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5346ee2271fd1b6be156388af09f183e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1848 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590b285531365ba029eb2d0d3591a3ca7
SHA1f3f30fdd35e5ea4ccea9e69c79809d5e8eade7af
SHA256bca6de160f87a1a5eb276bc395e7838929aa2836dd3443e5680a5c0c514002a0
SHA512b34c4e990be4c6b349245662007c7b803c6752804041e371d7d731fe055c42e71b4a7aed4ea4c0c0fd003b663d448e75efee43c75230486b4ccd167492a9aa65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55377e1c4e5d1184bbeeeb7e6f7c2c4f7
SHA19cce03dd4ff70b076a5d45645b90221846d323f4
SHA25612b2fe075ae87e9f0b713dd6ce5a893f502d6090731ab7a0cf0b3d3feb01c28c
SHA512ce8bf84d1a1993bb9c5676fcd5b6fa3727d9ec6809403748582f243649347fc76e2824ab0f1303ee112e28f64c10912b5c47177224b0fc38320187545498b5c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b891f5974a3927aaf266481ae4df05a0
SHA1eb9a84cac88ea8ee54cb6d202234b6f5a46724e3
SHA256fc6923c2aec50a962f0f2239a15ee79e35b5468cca05823f45935ccfa21baeca
SHA51279ab5cc0872f1b64e867522446ec9733039ede27daac707a585896d1cbd07bcb0c7f5b66ef305f4376590da167672c692159bd26be0f2c41c8ba4597dfe24a0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e7d0aaf68077625ab2e39d5ad1e17ec
SHA134227096455e18f0237ca00c84977d9befeed4fb
SHA256a496cb053ec031a8a5c2f9a3642a19ece781f1b4200ab865067be5b7dfcc169b
SHA5129f2e2df7ba3858575c853de02ddd956f1b3e15b402deeb06a3f4a30aa59c0c09319a860f8d158161eb1aa0f7a1503a64c42288b4946e2f729de05bac687866a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5663ddd0564063ceee1a338d449c9bf29
SHA1cc472f76bf05beae124f2f0f25b1bf629f0b700e
SHA256708b557f4909e6e97b20fce45e5f0e7ee2d0075099b59e4c4cd66666c40eda79
SHA512f536a5412cff38c82bc4e25c3fdbc10159745fb1baa51ff747eea1c60c824cf299e79342788083d01261422d5f3f3b79667746bd3f982f9a6eb716615fd5bc89
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59716ffef55c88b82ab4a86f78bd70bc5
SHA16bd1512946a306a33d62b134db3d80f807240be4
SHA256b4b5ccfe65ff85a220f061deb59062a4a16f41fabc175d39dc88d0532131231d
SHA51295bac96e7ceaa62ec3a8ee58d9854ab556b42940c3f53693b14d6447d468eea7c8c998b78fb94989faac5f7f659acf9f68fb3935bda8d805e428de496e834109
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de00617a6a2725ed2d04b5b50fd10486
SHA1b7e7ba4d8e33feeb3d069deb54dd3c9d9b7a191f
SHA2561bbe4616fc0136206dd741521f2e5ec97b4ed58ae7fb04c8cbe6bf521c8588ea
SHA512192467a11173c762f602ab82286422732bb399a83092b4871c8cba4b4111fa1a39f4cad78146a84da576e15642481cd34c1d5fa1fb4c45b1cc8b49312cd7877d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fbfd4367fe20c49f023408c01283329e
SHA1fd16cf7e8bb1a4950a1a0eabb5f12c5197c3fd8e
SHA256c0310bdbdcfa91d72a3c71f3a3adf2559c0a3da9a9085c9e57e480fa5b669c99
SHA5124686275e1956e5c1dd15ef6d711a5af4d16531d7ab79954df7bcfdb6d019c41c9675c9fdd32fb65b916e46b2596c186ce87c21cde355ec00ba20f553a6aea8d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56d3c8acd9053f230239893e2f4373825
SHA15c8537530d55de187ffcd63c82f082665d991b2b
SHA25657dcafa2bd54a7ab8b64bc9bc8db82fb8a69fcef34e3d9b20ade35ddaeda3ce3
SHA51246f8c41c9eacbbcd1cec13956a3a7ce6bcfbfaf84dc80b58ee004d3d2e2bc6f258bc6f3381cf1f5fadb7f13cefc114b826a995251eda52673a6973828333df78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57dd0a97e88360244f7422bd2bfe12aad
SHA147ff626b532b53c4879ce9e130405ab0e41f38f5
SHA2564cc772294fd559d1a339c7bc676e8666e5c8251f35fe3484ee0c016cb2055153
SHA512219171efe79d99c8ecf32f241b4eca73c5051c1145f3aac7f7f4488f5214a35173701c6b851c1c2e0808b9347b1e8807e6ccacd6162605c606f7abf2445b26af
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06