Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/01/2024, 04:53
Static task
static1
Behavioral task
behavioral1
Sample
5a5600a78c80e580a719b9533313bc42.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
5a5600a78c80e580a719b9533313bc42.html
Resource
win10v2004-20231215-en
General
-
Target
5a5600a78c80e580a719b9533313bc42.html
-
Size
53KB
-
MD5
5a5600a78c80e580a719b9533313bc42
-
SHA1
30ae20a2560d66390eb6c3b13de8350631d39142
-
SHA256
e47b6bae41febded5ecfd9ffc9903ca0022b574f05c82dbbf68064abd7037562
-
SHA512
2a255f112dc5c8a3db0c890c05af3eb40a18fb3b6087a4eaaab95aa02a7e5daecb80725cffbd007cefcab0ea922e4d53993e74977d8b04eee728d5292009dffb
-
SSDEEP
1536:CkgUiIakTqGivi+PyUArunlYQ63Nj+q5Vy0R0w2AzTICbblo1/t9M/dNwIUTDmDN:CkgUiIakTqGivi+PyUArunlYQ63Nj+qb
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411369883" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 303246b7a546da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000219584c92cb3c5277805db03a78ba7815951813f32c8299eaa201fad9e693aff000000000e8000000002000020000000b16b0d1526c12aaa103843c5d532e59b9cedddd400c307334e89b61b23e21c72200000006bc77f545fbe6b101cdd33d1824fd52e7af73b3d28ef07bb530618c38ccd973a400000002a1b15a96d400da4aa91c3b34d39f166d0ff04c53aea0db83a6d5a32bc6e72da90e79fd1af68ef2eab05b9c4d4fa8536d2470001080c8461dffd86701c8e077f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000015915f4af61345974bac5da76e3362333677396b368fc73731de64506726a912000000000e8000000002000020000000a07b8eb3cd8fde13b0c99d1918444089008a8399eb33769d299cb311132ff545900000002996b60d2f7925985bccd3e855d0146a761473f65b7dd9f7f6c1c5514136f6e1cf3ea54ded89711f1997b5f06749fb477b15bd95088762fc226b8ac5f31a9bff23c7d80c870583e16af6da43b79f92d929f956f288943aec984a12de8202fe6748aa67608d089885c3ac42848afb62c3ca45fb39c92951ed41200e9f8d309752a21b93f678a556398a7465fc10f27ee34000000070fbd7a9f17aa97f0670b237f533657f58f980b89c3efc0b1568899696ee7f13128fbde8bbcbb03bbac1102278b31424d91080cc0497abf71621c6a67c87b7f1 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF1DDF11-B298-11EE-BB35-72D103486AAB} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1868 iexplore.exe 1868 iexplore.exe 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE 2952 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2952 1868 iexplore.exe 28 PID 1868 wrote to memory of 2952 1868 iexplore.exe 28 PID 1868 wrote to memory of 2952 1868 iexplore.exe 28 PID 1868 wrote to memory of 2952 1868 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5a5600a78c80e580a719b9533313bc42.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1868 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2952
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD51120e8ca093d305b2fe5fdf5f11f8470
SHA19928f8de25738cfe1f556c613fc40356cb37fac4
SHA25603d39e9c1838b73865f511f3bab672b31e134cab2cea4e9c1517728061dd11d4
SHA512ccee03f4d9240a05bb83bd5fafe585738ed8e7600b6740659fa5ad5d9defeda65695c4b23fabdec281d03a122e7a6dae077745fb1271c934e8d89537a5392f0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8ff5933f66e422436f911bf518dc459
SHA17fe9d6465d85922e7f28224c2b04958db1afddb5
SHA256f7556402ad092400c0dd5ab39b89c96517cca620733f3277aabb6b05c2eae935
SHA51233c28fade99f051583f1a3d1be02e0fc949fcc800bf2f44993aa473ac6e5d5fbbeb0b7a76d0f93beed439490ec33b701e5f16ec78ddeba7d47c094b6b81e619b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f523a61c88c3ef05a5b5ec8e77129831
SHA15c6679265c7dc7becff202a1f3dbaa10c482824a
SHA25621c6b0707e61b2d7148636ae37e0b24d0a866100e61ddd0fad93c01bc8001011
SHA512ca7b9f820e8e44500ff7eeee3eabb198b0a164fd688e1c80a906016fa999f5ab28f9a248d18c7dd51e6dc9784af38fb6195ce3010494cac4fc6dabc565f04b26
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52762c3946245bc0ca949d1de7cdfcda3
SHA1f9280f55238596e931661195e0fa232ac473abc0
SHA256c249cbfc446b0e7864d193e93ca1efa9ec87160beee7e753a1f0785559c27bb6
SHA512440edb5c615a7fd97ce8f5aaab7ee790b14bf7cd582b1a96f6c96b1b941187094177f9133c159e58c9bd0f5df0443337d31debaf53360e9226faf5585fb22f57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538a51992744df56ffd57766dd7f75b20
SHA1ac5a9606849b8c816e43e56d8aaea81ec242249e
SHA256cb49533380b0edad39718f07c94043dab0dafec60e380c5d203d61626b964818
SHA5128d0c76b6ab14e84e8f34a81aba8182a66ab8124ae3e0847c79330874312fb4dc8bb2a29d3c96615c43a561e527ad6bbe404635a26c7fe0bbabcdd9f3a7e06470
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b82beb9ab8b9ae6541c2a8ec61163a9
SHA153b49178fe48f30dac5396c286929f350621da31
SHA256a258efb9bdd03c03302b5e31e527616340eaee69f0e91e322c376ed03bda9309
SHA512bcd8c1f1627f9382372cb56f0b6912e4d662c4b6d6ab1ee8b6b3de87ff4d06fd6b8d12d7c40645badc1d098df334b8e107b9e2df3459e7dee79ec7f4e5029157
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2d1043367b90463329c5974ecce5d43
SHA15031523be130fdf47dfa90c8eb13a5d39e12d538
SHA256ea2c1ee10145c1c971f273007aebd54de8ddf31881222f72f895298b02432c7e
SHA512d32e00865d1f0a6b0c28df26636f0f91ff347eea5fd918c5531b5d5c8e4255517971d3c96829ae29b1cf3ae5da893301d4c9c079983de4a4a1eaef6ea6a4223d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f498e90d11566f1d3a7e37f2ad4f8114
SHA17b1658be912c6e3a73c0db62be8fdfb004d87713
SHA256e36a4848577f4842e5c08bb2ccfe078fc7efbfd9dc8f54ae65c9d2571dac4848
SHA5124823273e347d25d5b80c6a81fc43fd82b577b55e6defa8c8bfbd281bb59b3443ed64b13009b4c644a38100ea52cbfed81f7ccb87664c40c155df2a2f668694c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e87edd1df7aa494fc11f746bcbb1d17
SHA193138487b8939b44e8b73b4f18b9184b883597c2
SHA256469974f40b8a069038eb048ce7861cb14b9a25e036993cd0be65177b9173dd5c
SHA5124f7c09d143887aa4107b8d342eca4371b5462c2d10870c0d955a431b45df0c2b21be3f7e92106e786502492be33886badd7e39a83f18ae79f56b7f6fa6c66e86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb699d4d0560146807483949339b6e6e
SHA14b80249bb12a0041a7753d680c262bf7c47ce460
SHA2564324fc3c0acc16c5ea6af8b29dd96a2d441569fbaff06313c014d15c80f87df2
SHA512b31a33ade3d95c97fa66500a16aca431689d8db09cd223d274409862af28f2322118ee71ca1e5928ba88ca3befd8aed4e000315025baa4dbcb36fd58352e8f2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb5b4a2f779e4ef781311cab9e420876
SHA1dddbd0a9d60beee98cf76a93328021e1cb684f3c
SHA2564654c970ada4ee610c763c95b80fa83ec61f1237320c78f78a51ec3248bdbdf6
SHA512d359eff1c95c0b566bc3b55f0fa2b69318367b38076edae62a95d965f6367e23100d8bbdc80e58710443703cf3abda61e1a250cc6b1c55ac4c1613d7fac44f5a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD595160fe367b25d2c564712d8d4e4eaf5
SHA1876c4d59258361c07fb914c7bc34221934401d1d
SHA256cabab0e4161609447d0d053d720f5510c02760c64fc584d6f16cb7c3f30c116f
SHA512a7543357dc1f690f70ed431fb81490142834ed78bde353aaaa39202ccaa4d9eabf643ed24da2720eab711ebce8bfb8fc115ca632612955c3b11f3a34360c0842
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5KL03Y0R\wt-logo[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06