Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 20:02
Static task
static1
Behavioral task
behavioral1
Sample
5474055cf1d0cba3cd8b4024b9bd2c02.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5474055cf1d0cba3cd8b4024b9bd2c02.html
Resource
win10v2004-20231215-en
General
-
Target
5474055cf1d0cba3cd8b4024b9bd2c02.html
-
Size
13KB
-
MD5
5474055cf1d0cba3cd8b4024b9bd2c02
-
SHA1
a68537b085d6b2fe667103f5f70d15c8f15ca122
-
SHA256
507c810b4abeb09d5350320b80087ef19693108ab89ff02ff756316c98c81a04
-
SHA512
fd992a943e11c787ac5b433768d9868a15d29c1ab5c0fc507fcf737b0e89d06a1fbb82ea8d7fec9d9178f6295a2bc56cfc4ca518dfa82aefa33401d56f3f2bce
-
SSDEEP
384:FuzsHVNNwvHi27iqY4s/AVTsziRJ6CBJHq5+5Ja/vNnzZ:xCCmuC091
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000008b3a6ac0174f7a01f4f5436bf34868db525532a6f5efef505d4a4d486a05212b000000000e8000000002000020000000d9d10248c0feb987a44318cbdf7ffc10ff9ca3ecd71515ed33af94e999ea8f61200000002b8f5922e7a0440a9b7f7d170defd2627a694955e2769bddb07d6035eb62199c40000000f4b74c50593f58d3d25f724dc8acf1e6550be1f9535b9690376230795fbe8668d3541c6126cf3d9eff4ca85e87949dcf8a081db892134f5d328af50db94cb8ba iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000b44e81d442259fe609a867084ebf6c20ea40d5daadf798d66a8473a4f29683a8000000000e8000000002000020000000ec50ec674e84221c8e5218e431cb8f37f56d70269f1333b583a40b204ed7c300900000007d65f0f41f13c32cc04ae63f4222c031fadef3093ad29b3773c8d94eed33cb6ffb80d3d240020ed770fa1cdc846e533fdaea59480d951e91f1461f87e95287b8495a308d4881114614c52a249acb82bfaa9548020925442576105a8ec050e91402f05fd0acdaf945f61578242e93bab148403a6fd0331010204084c3512c0c2975dca46b49d63b2315dde7d285f5000f4000000001cdac8dc8643000ddfaebdac88e6f5652555e771cedf09b3ebc6806d756d46df6de3c5ac2ee97efd26619d07e6a7039486eba6a868d68cf2c20bf0d07eda42f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a03cf138c944da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411165242" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{60607351-B0BC-11EE-9E63-EE9A2FAC8CC3} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3048 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3048 iexplore.exe 3048 iexplore.exe 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3048 wrote to memory of 1608 3048 iexplore.exe 28 PID 3048 wrote to memory of 1608 3048 iexplore.exe 28 PID 3048 wrote to memory of 1608 3048 iexplore.exe 28 PID 3048 wrote to memory of 1608 3048 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5474055cf1d0cba3cd8b4024b9bd2c02.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3048 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d42a3c95c26a71c4217ee4fdaac67977
SHA1655d0bf622b5100e2de43d0fd27595326b57014b
SHA256fddb23603dff82f77d57378943072db7c0361bf78b5782c6a894d2db64f40734
SHA51298693cd879ebdb077e2fb1083a532c190d1e2caad096c3b9c3ee5d3350918ad3957321c2a67121cde676711ad11711a7979c373235f8e74b3aa7d4fc04648574
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c7035cd9530ee1ac7a6ea9d241b9036
SHA1484dcabf5e74a4a8a218f409406763fc90df5b2f
SHA2562bb79df9953672e7eb9fd6d67d1aa7af4cbe5b9380d5bc192f6f2b4c051f52de
SHA512fd6b1591464018e6be9c3fbc1c4307e383b23615e3d0320592b35fb93abc9b9d2c9850e91f36401d0115fe32540773ca1473b41f1c8ff603f8efd586b68d822e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b855a9f3fea1d8461d4a30a9b8dd289
SHA10965afd0329c5df5e2ee308a9a0b3ee9b52364b1
SHA256e3d9e02230693df028c7d6e8ee810ae2cf714668fc711f618ebee728f70c99ad
SHA5124ce6b10aa3cc2a656f94b7a1dae258270977cffdabc17dd27266d53c6266638f89f40f65df0367af783d29393934f9d0bf7ed82cebe5c510b59e318030ae41da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510dd37914e7fc187dc5cb20ba671e9d5
SHA1b17f14fa314c0518a592c8afd21f2d5fc8f3e254
SHA25648323a42c464d2bb62853160aa9218b75fca40ebff304f72031a00451ed5c704
SHA512b8e123a9113b033736d3accd69e43181f1e27def2c7922b5c5e44fedc8b942c34859ef30dfd47c5d612151c15d1d175a97a8413e13c24966f0c5b7d11412d736
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553ca8f43b61f8e9a237ae74d0128bcfb
SHA177447aa117bad8306ccf3bc93e02a3e4a84f99ee
SHA25696536d5afcd7a5ad4faafb1b91511f6b0b82050a0c46b5b26a93a21a0fe7a7f7
SHA5126a3e3abf325cbccfab8792a34cfdc4c1abd5636e3d37fb6235025cb06b9fb75cb77af81f03b5b7da39720343e8b99fd5a930e840715313418516b4cd168b5937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ff012cf4fbb55afdc9bcf42e8981a259
SHA16550145599daf21f64d02a972c53e4c0fa1058ad
SHA256d1c1b50864e6076edc7d1f21d014d69e414635e1065944f851707b091ca00936
SHA512da4b068ec8afcc4af32cdac27740d0ec3c571bfd3f6f33622c60ce103af4c3c894e7208917356f70e4dcb2948cc4f0b929aacc8433204b960c2ef521a17b9b43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6dde160be15de903dea3a9020bf9856
SHA1226e1a76809330bdcf7c64b240a79c52171dd61c
SHA25664bcadd6218a88e7cccbd3cba6afc97024493d66451adf60ec514daf6802bfb5
SHA5126decbc0c2bcc345d1ab0fce774348f6da9b1cd1a129de08924b888d92c5cc6c72cdeeda14b314614a2c60ec78073d81e54616b413185b1ab6e4c8941338e28b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e17b586ddfd46c6cc72ab62aeba998eb
SHA18c75b4b5a606ab50c3c8666e0b43ca7a12c7bdf6
SHA256e7e36e4203579c522738ca2488c357f881f63da67fe2e0d0359a86d5a3140d30
SHA512616f603054765261ad451432aaf377d8c94f4dfe2fe96acf694e414034a54e90c6b232c57b2bfd87afd8b839859fd814b1f6ad8652e9ca51e9fb4668b9caabf9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a98d69627be21b89f88a4f26112844b
SHA187b3f54a2d85fe8018d6f9fddef76c8c1710f60d
SHA2560f6d6558d0710cd2e5b8db82d43f58530216af860ddd691bc0aeb16f16d45233
SHA512af6569d26ec0b9545e9e009c8806d7ba4606e5a39a3fe47102096d710aaf0d8089eada12645a092f3c597e9cfd6861058ea753359f15af11a432946354f56ef8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f2fc2d4f4dec018c0f6bba1cdf40bb0
SHA1e06cdd3ecae5b12e39149194baa18edf13296713
SHA2569e5195b166cf37f8ae8d430d2008912dc1a64d7c28488b0a81b410e814097d6c
SHA51219972deb203930bbe78467357ade19e5be2ac3b39137004628828931135f1e550f378e48eb861e3430d8fdf24ed001144621f396747ebe97ba0fa7df4d4318a1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06