Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 06:24
Static task
static1
Behavioral task
behavioral1
Sample
55b8226c5a5a6c49033aa42b064977ec.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
55b8226c5a5a6c49033aa42b064977ec.html
Resource
win10v2004-20231215-en
General
-
Target
55b8226c5a5a6c49033aa42b064977ec.html
-
Size
55KB
-
MD5
55b8226c5a5a6c49033aa42b064977ec
-
SHA1
d2a9ee99cb8b064b1fc025a467e85faf1eaacb22
-
SHA256
e110c48e7f67af2e9d95742f638c04b081d769e6d97b4b2bdb16fd7cf39a383c
-
SHA512
26541805b1e948d8aa35312aac6b9cb7184ec24c547e0dec4e8f0f41c600b80cd2d081579b64f7e1edae76ba550ed6c1c6a8b2940673cad62376bcf2fdf98b4f
-
SSDEEP
1536:gQZBCCOdY0IxCbBGjzvYQ9e3Qtl+YyCcCSFslytbkIF4mDS3hFmysCX5jN8UCj2a:gk2C0IxLjzvYQ9e3Qtl+YyCcCSFslytD
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b5c2092645da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c0000000002000000000010660000000100002000000043ad1b19dad8dac1202931dccc03b45fd92f2857466f4725a9bbf1efab08cba5000000000e80000000020000200000004e8da25671b53aa0788335887197b57bb6eea341558d03e998c693feefe9bb6090000000e6ce560eaffd3397f9f978657f0c619e9270aa34ee477487c885e81cbb78c7dd4e79de1d58206b221b6a947db5af199d3fbca1cc5366f628c992f98f67b150997f44926d8d4e465c107507545dea3fc764324553e72b1492d95f6bc36a29557bf80c15c3ff511a9b1e30ddd30f3ab1b054dd3dc5af3a752988eaaca9a29dcc47db98428043e6a8a4a5da9501de00fbea40000000aca62a3fad976c510d4d325cd58e77b0e06638ab903946052fb6cac2148a74995f059960d725fe1a4ee37655002775c6a478f5019c80ee80ffc11c449960cd1b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1BF3C7A1-B119-11EE-B928-4AE60EE50717} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000625b827d4cd9b8d9c119eb8558b36f686322518e7e042c3615f5129621c30ef2000000000e80000000020000200000002908cbd78b4a7cd5794f2109a13c8247029df7ea9b3202d34dfab16418bc759020000000987ab217dd354dc17a6f8003af6878cf8494d59261d88d270fe0a2599320be8b40000000a6be585b2a87a8f2b702b3cb5d39be40335f01779268937b9e8feff7b4d591ab59181b6fd815d71385d02b533b540e8f50be397d430585862b29536cd3c8f533 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411205082" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2156 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2156 iexplore.exe 2156 iexplore.exe 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE 2764 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2156 wrote to memory of 2764 2156 iexplore.exe 28 PID 2156 wrote to memory of 2764 2156 iexplore.exe 28 PID 2156 wrote to memory of 2764 2156 iexplore.exe 28 PID 2156 wrote to memory of 2764 2156 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\55b8226c5a5a6c49033aa42b064977ec.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2764
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5656197c6e09062bdb07abf77f413a6da
SHA1ee3fe3b1d02da6c5a0e760af5ac3313ffd582fd1
SHA2568db7e71e4a3728fe2b65b62faa9dfc5f4c10db8dec415fd2e7a0a29ca6970bfb
SHA512cd344b295ffc62bd4761f2e8f5556b372a0efbcf7f3bdcb8e62c2122850556c698b5494a163cbaab258bd9cf77ff39f342dc5cd501413d90426658339a781db1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7ffe9d7ccb911ad865fccd33c5425fd
SHA11269e4d83606e52bab18d56c1066cc682b6897f2
SHA2566ae0114b232cdc2e52eae7b278e685d169ac7a224d2f0305a709f9c739e9beba
SHA5124ebd67a5cac70690e1c6068fef931edd4b0104cbcbd0320db9b11a2ccdd908d816ed3c50e248cc3bbf4891a9c357a4d8a08716d9a75c5f99dacbb06d906a9e22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad1bb8a1942b7528e1384bbf45b1fa73
SHA1738f6685ad0e880cfb590cf95df60cffdb20feeb
SHA2565b2c10505c2ac9f550ed33609eff9201bd54d4369406a4eaf1bacbf2a0149953
SHA51274811e6998ff58fa3eb72918938fdee9f9a7fc073d2a6f013b726276836f19ded99aa928adfd8394f2d70bdbb899be14177cb7fbb3c1f88abdc6616aa543092f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e9c4353979821135c863f41acea0001
SHA11bcc07367b880398fd075c9043a4fa7989d19495
SHA2561f76f3c5127d0a44ef0213eed053e7bd99b5f3df8e71215e253fed64604679a1
SHA5124fec67e6fff68493ee2d3b6e9e71dc60d317d81d95e6c6784b916e4b4e070e8cddc5bacf1f917f6d96af454dcd1bb04b779c20c5ec3d84b7d5a345e74898e8f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5119781a7b693cc93392fa4838fbd866b
SHA1eed2a2d036ca909d7f1bf5698a27b0dd1e2f98f1
SHA256b9fbea5caa89330e52fc1e1a04dc296694f9119e74921612e410d1abe67a0401
SHA512248c2711a465355e9e03d70da9d9c9a295a6bee0381496af267f7f63f1c1c2c64b26704ccfd5c6a262d7cd2514ec641b858deaf8313b6647f51850c62d0f17ce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59423cedc7d95eb0a041fd4cfe4896688
SHA11112d94e22b62a136e99a32326ed545adb7a2fc4
SHA2563091f7481d9316fe7e6b6f82a2e75cd178927398801153dd56eca869ba9b5996
SHA512ca6ba4c22ff52ee3dc62e92f4492c0d280e54c728d94ef81bdc0c50658ead9ef8e7cd5e9df8d2b8cdd1672ddea434d6c2efb38fa7ba9f5039fd90266da266b69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594eb55e81c7ff63ed7de4c1952248655
SHA199b38613155b2576e295ac71161bf9dd2a54a12e
SHA256f01c2e02175b6b5470e357e8310e4ce87492073b1a66c8c5b89e75bca862aae7
SHA51299afed5920dfda6a2bff7564405c3ce5751b303cb0b8addd8a550efe68b04f50915ddafe148d8293c6cd09626cbed4fd17e85789ef994681a3cb5cb6e26baf7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5286aae298d1b2d02ed3685cbce6aa117
SHA16deb19080d7c8b3a1b3ecf7178bbcf3c5db775f3
SHA256fa58a6e9e93d6a171ae2ea3e95a6a8eb5e6b9ff7b005dcee5db047f06beab872
SHA512f705a0f0365835a3a42db3d0cce536ba9135ce3631dfc4798556aaad5d201cbbb4554e8cfc6397a9983a0d4fa8cb0c03b6face09578f081edffbd3f256f1fc57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a14dd3931782b824700ef50bc9aedb7c
SHA14cba06f987c1391112f7a11af2d2d866b699293a
SHA25661c066d009f71cbd5b0c2e767c60960497fda499c1947dedcc07dd54e38bd98e
SHA5129d7ba589613090a5f390be5dae4c0ec375ae77195d7062a1b499b0191ace8aa40114f15b62ed26c2b9d430a191af644bae187e8dbf7ff129393c9f7de55bc94f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517c80289d5ec9f02da389e300c56abc9
SHA1e94a162ca3275211bf175eda15fe3ca81b290e70
SHA256590dac3928c60bb7da051698434f2b305da00aaf698d1d880aa8198698d80bec
SHA512560c642c86667c5aeba662e1532754c9a8ddd8ac0afef6392648f6ce4c14ecda0252f9892b65052e2cc2def2617704acbe206ee1f5c093db5f505b6b2c3cf837
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d455a71130427435fbcd59298b766f55
SHA103ed9f965dd46689a1a89e4a76b85fd52e54ebd9
SHA25690e58168363c84fdca40828606b3c68d826380ef6ca19ddba3a2124c3288560f
SHA5126629b7cdc1060cb24586d7c5b15efb5a576caddbc1844c1541d17859875df5fae070af6863a192a90c4c4c01968a72aba2dc41a2a93054a7362099ec4f0ca840
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e22574bb1b5fc9358fc5bf7ce959e8b
SHA16faf5ccd594863b02c7a021e2c0312ecfdfa33b4
SHA2560332a26f5e4d9018ae2dc0fa9f06c4eda7e47fcdde0362fde57cbf2542060b69
SHA51262beac62f05224931e8ba29fc1c6104afb55e7ff60cba95d5349e6e6df1bfd8e59aebd27b845b704db040fb138b6c4832b5e1fbfa2b4fcce9ed33ce76ff79233
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5092829b721ff03be78c8ec1d57e7314d
SHA14eba30ef53b78fcf626bbd8f593fc19d3284eb9c
SHA256de4a73bb6bfe8363d08851aee6891c6f29640d3e405cf6d48fe62e52093ded07
SHA5125fcd9f1e8434b9846dd466625782d23ca6dc50061752791ea1ad14514d16051687137e2707e46cca1eb155e65e31d1c8746a92dfe9790ea927e549e977aa2ef4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f2cec28e3578c81ae794cb3e4bb8c2a
SHA1181c25638fc5779e9df193e1181541cc436c003d
SHA256108abc86bde27dfa2ec4fcb9623357f0c6c99dbd58b77b4911dbe21ba4bdceb9
SHA5127d04703eb8a6e225cfd03e17372308800f88d34b47f581df3215c10050c530ec66643af34ea32bb729f090311c52a6073d55cb6075c0c3e72e6f0af6355a1109
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b7b428312e0791c504c47bc391b4942e
SHA1a94e67d82adfb735d675d3f7b3ee7ee8a5fa8681
SHA25699cb12ef61b352d689abd8f8ef09277a6e2dde6c760e14436d58eea2ba7c2ed3
SHA512514077766fb952345ce3d79b7e1c59980b68fe3f09bffefe08170cce2350a508b1768021d9ac171b6540db3d82f132f689902abbb87de90280d1ad4a0c8a3d28
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0563e0fd9bf2bf060a3754477b86b43
SHA12f29e27ac9785b1a9f1995b021e748beff4cb2e2
SHA256ef1a56bc8e7c10b629e321ac8dcd83df35f2d624d47a7f7fe101c314fb2c12d1
SHA512c7a3233e8a236cb134ccf29b055d2c4f846d0e98be3604e204cd115a34c1ff99e81138e02247fd937cd8a0a71fc7ae2c24206a127b8bad6e13efe35f56a504c4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06