Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
13/01/2024, 16:56
Static task
static1
Behavioral task
behavioral1
Sample
593c40102cbc81031e01cb673c45798c.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
593c40102cbc81031e01cb673c45798c.html
Resource
win10v2004-20231215-en
General
-
Target
593c40102cbc81031e01cb673c45798c.html
-
Size
116KB
-
MD5
593c40102cbc81031e01cb673c45798c
-
SHA1
9d5275975f289b64aae81aff404f1500181df671
-
SHA256
e74eb8a9f4daa7318f85320307d1c329d2fab4c829259ea521eb9f53bd1f77ec
-
SHA512
3fb7b9691e14e0e2b4656044209242f365c2a02e6ec6d2df6b092ebdcaf98d4111532a75be8e097ef6265a7b5e4efdfdfa650e2cf9ee8aaa8ae70fcd79d6afd9
-
SSDEEP
3072:JQkNE/oZLJofDHqA+rz+NQ83zkDmo7U+i:Jt+3h
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C67D1611-B234-11EE-A497-46361BFF2467} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411326895" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2936 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2936 iexplore.exe 2936 iexplore.exe 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE 3068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2936 wrote to memory of 3068 2936 iexplore.exe 28 PID 2936 wrote to memory of 3068 2936 iexplore.exe 28 PID 2936 wrote to memory of 3068 2936 iexplore.exe 28 PID 2936 wrote to memory of 3068 2936 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\593c40102cbc81031e01cb673c45798c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2936 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
891B
MD56c397da40e5559b23fd641b11250de43
SHA15f3b8cf2f810b37d78b4ceec1919c37334b9c774
SHA256513b2cecb810d4cde5dd85391adfc6c2dd60d87bb736d2b521484aa47a0ebef6
SHA5120f0369b90ef4930f59bd5c0091067200828bde84ea703c1029ec5603cf4bd1084f0e7e15f370dd5554a9e310d60bd01ba54492e2e6d6301e44609033ea9edbc3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5cd54ed5aeed4cf3c3be89d2203b3aa9f
SHA129b1476a0dd423fc29f49c2cfe9dd5f82c8377cd
SHA2566c6c6a6d34c190948258afd5faf354fd15fb52f8f4eb0c2ae3961aa6f8e40891
SHA512773018261d87c500ea316621804b7818dc5d4d41ce166897f875f5099c273b429582ff769288746c53d3752697a1967ec0140610e4e7a8eb2f8452304318f08d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9096A354A7A3E42F3F619F51DB75C6B9
Filesize282B
MD589e78d87055aac22e3066e0dc13d1f6a
SHA101f5295c4c96f4eed1c9702cd02aadc7c441fbf2
SHA25646708b1a00008a178922fe95a924cb9d8fe2283ecdcd832e862032ba979f0a53
SHA51277caaf31d7a7e980ecb87f081877c1a744f39365cc62d580832190e749f522fae39b94569147ba9b75dcaa9ecb00117c300de0ab1f5b0ccc46d13aa466f871b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b81bedbc0cda92d6a6d75142fbcdaf01
SHA1970fc7181b4929579955d347e5b7fc1e9ebbe612
SHA25626620f8ce9320deabf063366faa2dc21484b8b8c8cd50fea771cbf8999674b3f
SHA5128c4ab74fcc3e33e8ac6d7525f6e9ee5f8371e31120f7d2a01e1f74ec48c8d012a24f7c604d9cefd39938dd164a895bb7170dcc19e8f8b1f3354f40cdbe65faa5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c274566ab755e86b34ca5bb018d531a
SHA1e7ce91eb4eb7a8be26a65b5ba86db97a3c278d1a
SHA25621e99880c55dbb8fe52cf5afb59d20a79beb4fb50478c0ff9cf613b2cca340d4
SHA512025ec0422d439b1edb60ed4a08d775042dc6b41c2ccebe039df7a9cf4d4d1c1a0ddcf64eff08a4af394bdd6e5b36a79c886315b098d9b2af72a2aedfdd493705
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538ab10caea128d366471a1cf81c66ff7
SHA11be26a4d0ffbe717956d63ccdb55f1dbfadba146
SHA256a521e79dbede1b3edd23d5fd7af73382fff31f8fca4b9456c65ec14864c89fdf
SHA512faecf79b73ad1844cca3cd5d38f01f3ece2bbbab3ab039bec0c760b4f937f2f8fa716459ac12dd97ed93d70506da35ce99d7b713c5a24edd6030b0f0885b0544
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f76a29f0435d94ff17ea08580313a6b6
SHA13c54d117744b8824821bbaba140c25402b7bd6c2
SHA256826734d3d3968d26c3ba6e3216ec152d81b5086347c63c197731946feb8898ad
SHA512b66f12f3618d84658fbb2c66de6ac41da318fb69f874ef9b8ccc35736242f0e707908bf40b10c1d12a3c6b5c7e5a1465a8ff7032026a37ce50e8f1c4858992da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e2d2885b2f81a328fa0bfc242d1e00c
SHA17e0f136bafdb7a500a2c259ca2f6b4a27cf8f432
SHA256e44d24dd89565c9c709ef1683d7aabe78b9130206e5d07062b42bd2542f998b0
SHA512b443b02e67812d8f25ad9e8d482446d3be8ec2d5e0130a27efbe324912979c79e98592c8af67efa6dd5b80450adcee321b017d3c0a81295337640d4efed682fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD524e40c4f147f5c62156bbe81d9619b56
SHA1b1132353a9cb367b7e9e5207226b28adf4af6119
SHA25619003f283910c0cbd0e830ad71c2b8305ba1b522975225f37d77982fe7df9818
SHA5126c346311c74c0f6bcf2275c7a7695d65bc0c53e1197c50ce76e39a59d22a6f5b0ee834700b1ac1ad52e148cfb2da84cbe137e8778603832459da84f99862778e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57fab92395ba0fc2f42ca018626227aea
SHA1f8d32ec20a122de526bd1886855febb337b278c2
SHA256160ef2a06b219a3f75d7c609a299e67ad5d80eec0d68b53d144c54ecf7408af3
SHA51226219690fe83c309b5d575009480a3a592c99d100b83ac059ddc84c28dabc8194139f7f0ae6940ca7a7d57863035738a23a917d7bd8ba4ef94632fafed0d6f6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a204fb1cfed9c52f8b3c398e6fb997aa
SHA13002ed29a80da693b4a95f21287c866ff6b58cb6
SHA256a181b4c6e2045ad4e7bae0a47163a194093f744cf46f17eb01beee2c74d67ac6
SHA51292362010cea67284c96a20ed7a9b8f6690e4b2aa34884e241e6e60a0fba95716f3e0bd7642f87f96658d63abe29fa06a2850e25d0b11cc33085b84f2afa2b171
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c6b0d7fa51143eed9ad5d5d8eb96c8f
SHA156a25b6eb68bcd1261a3d1f4f4b1a3e3f8d016e1
SHA2569c97ec0a5469d6ae80bb0e4b43c3aa46ed322630196f341439d57527e310c7d5
SHA51238060f58546991426c8ed0a42726ec6e37c08e2afa305bb7ea0ddfe4cda699a209a7b5374ae8ac99d0bc80e37ec466d23495325d9330153fe588c2fbe111327d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e839bc286e982d21edb310b8be92a4d3
SHA17fd58e8831052c4d9112d056afe59a1f8c591d69
SHA25655b0106fe36d3bbbe788143e23e6ac55bc07c3558578a0d312f9bf82997e4992
SHA512db3c0b860025f386b9c7137e5ac7214dc4b504a1b394c9608343d78c88666beeaec1ce136f89b26049c3cd14af4a640b4bdaede139400d1e8f0e98ac27aca22c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf0bcbc41acca19d46e3f23a739beecd
SHA10e543d0de3ff267672bc61e994db386d0feeaa49
SHA25606ae5dc65c98bd8456cc8b90f263d200e467b5a54e48c9d98b4e54702db0e5cd
SHA5121edc89bb7383ed14ff8bff7d3576eabeba777c79d2dbc2479716fc1cc10ce8eeb95681848119fe658001423e8d202da5d42162dd17282c7c8dc96c63044feafa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53469185add5f3f55491e5a3ddbfd3686
SHA1495208a060e79c0992c2e2409ab3e904c7ccd69c
SHA25646479c07c681d97817d1225b9a414d67fc65a21fb7bc06ca4bbeffc0620c72c8
SHA512fb47dd144e019145ba3955e0d741dafbde987d8b22e7a3788fc3f038d23fab533e1d539a17596bf19fd22813318d71485ca1b516fc0f8ff0c2a3a01d77f1ca0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58081f75e630bf3f716f367b9672d169e
SHA1adb41206008fcee3638c71c9191a230255473577
SHA256a428a7cd4b58525a7ee24144b5fb2e9ad40356e5436603f4497cd926c467a1ee
SHA51238b19967caf747256517e23baca1103d3dcd694c3cf372463c194a4020557888f4b5d7c0edfdcfdd8697f113676093347528c68f301660915f152d99f1d62bb9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58f1d71771b428eca767ac3cc517c2a7e
SHA1094b5e0cd2cf7c9bf642dcd8ced7122a040c155a
SHA256cf6f3a4778509bd06f11ad9936306ccf0316d2472014611b3a8834af83e3828f
SHA512303bfce69cce0e7242636e5ba5f018888c2e9d55809cca169a353e622239bee503897381f0c98d962dfcf6e890791b72d03a23a61fe1499001143b2b59cebaec
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56723951eec03821842d1002ffe1aef62
SHA1d9631b099f76d78b337b8502b53ce05a7992f1e3
SHA25670df71ce49444b976ba905bba3e664c1d3ac0d63e2868e487fbb731ffa153628
SHA512f68e73488f26dfea3b916d6b4d3e36c9c2056470311db49412d944481ac179445eb8c6bbaa2723ef19b7192f077c9d0124e6298e4ab0cef1e7e08c9d00b4c117
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a90ef0e06db16749f4453691deb1eebc
SHA1cc56a86bc5dabb9383dca94484ce8f3a82b8f1e4
SHA2568c916289ceadfc72e5c39536c34067b01ec1e63894145772138664244a978f1e
SHA51205d38b79956c5b77303b1a39b3d44e9524214745e6bd2cf1813b9198f0dd688ee5bcd086842b379f1408a8c40fe48e9e710bc6c37dffb2b2f7285dd1766f118c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545d5a18999adab37dc5ffa05e1508fd1
SHA19d8b9a7ead90ec9f95ed90b5a23b2bf443788275
SHA2565914ef90b59c484396f291ab59e31561bf54a9ffbb73f2764719d97b998d7bb7
SHA5127f9eee335608fa84bb1ce862c3f292e7ed4083c3bea6b69d2f41b9b84b325660eac1d100bfd38d9e9ae130e2785598cd291a0b104b4262756c0da4a3b74edeaa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eac143e22cdcc8ca7034257e52857466
SHA16e4adc1a9af5210373686b5fc687008c26afc4cf
SHA256bdfbee5b5441e2c8de66628c5d37c4f408fb7437c26e5f1005f0574666b3dd90
SHA51233457b008d1280ec851942381333b77facb89987704e9974e958f15090613e838402962f12154287ec7a8eb63579f7cc9607503daccf200c5b42aba2ab207173
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e29ec11963452c415accd3a7113f7cc2
SHA1ac0d477bac16bc50ce0ebb14d612eb6705054aa3
SHA256b09cc98ef17322e093e799257b0732a0d7e9f36fe2d428bb7d5ae365901ad99d
SHA5127690023d93896c5b91c31b315b0abc9e1223cd861f3979526a1272794840bd2752bdd250494c8c3a25d351bbb2f29565d0afd4d40e0bb316a9fde583ba9c3cac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5f47fd9d7640cb91b1ae9b9cb665a2ad7
SHA147fc551665e8db041427ff99280258322028d28e
SHA2561e52d7141925e21289f3adf9c4d444194a3b1ce12d82600dd758fc6703b0e573
SHA512293cc786c7d580b434cbf610ddceaaf8d4dfa80ed9093c2270def3ccf035e69a6ae31b5ebc540fa6d067363725fc4198435b9cce87facb73d19ab2210694956c
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06