Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
15/01/2024, 04:44
Static task
static1
Behavioral task
behavioral1
Sample
5c2b37d3726cf13fc3051ac81593ca71.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5c2b37d3726cf13fc3051ac81593ca71.html
Resource
win10v2004-20231215-en
General
-
Target
5c2b37d3726cf13fc3051ac81593ca71.html
-
Size
2KB
-
MD5
5c2b37d3726cf13fc3051ac81593ca71
-
SHA1
b32e995c796d30e9b7b5d9f9d3ca945adccf03b6
-
SHA256
ba00bcd33d458bf62b5d8a2f7ce97810018dd6de354a7d8ca854c876f60e2ea1
-
SHA512
c39b0059769eeb2c6d984815f0dbc9ccacc039ed6384d6b542dfa9a43815ab7021a7dba6cefa28777ce9f4369b822a2178da6accf1c820b2cd862ed30287fab4
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000063ba729ad3571a480d30ce6f73c2d4f8d8ae64f623203a263d201c0e4d0f7535000000000e80000000020000200000005a49bb9f17584d70f91f74684945bd694837f6b3260f9e711e75933950f805fb90000000a21fedf4061a3f8b7ecf0567afca9036296130406a1cc40748564fd0deb71555956853481a99667af4d460c48e7ff5cfb05d539487be3a7000531b122a96da609020a62d13c715a19fa385b98ad2fe114cd7fb5a98c2f80025db5d98342afebcfe774cc268e22ad5fa558dcabb1eba6802acc63ba2a7a35f050169d8096fec661b6023e3d7c61d36c88781fc4a41ca5940000000e4956fbcf60f2802848b5aa5e2277a1e6099db98c62064d90d3602b178f0e74ab4cdf11b9368d7c4103903874357e7666790d14a72c0c77cfe1f407ed301d497 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d39cab6d47da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000fa3dcdbcd69ffa420d91811b79c8c233116830097a5e0edfc9a2765e6833a641000000000e80000000020000200000002b6a05a228c513ad4d5978c4a7ffdbe79cc0e1e08afffcfe12f8001d9b02b17420000000e271fecd0040e5e8998eb3878fc2ccded6e541691668201ee28078fdaad1d97440000000363ec2ac8747eabfb37d4079238d7109761016cc56f46e4f4a040860e750107046230bb4fc5d3801128283bf160c73badc308ad8eb051b545ded716536a24314 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411455767" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D721F801-B360-11EE-86E5-EED0D7A1BF98} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2912 iexplore.exe 2912 iexplore.exe 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE 1728 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2912 wrote to memory of 1728 2912 iexplore.exe 20 PID 2912 wrote to memory of 1728 2912 iexplore.exe 20 PID 2912 wrote to memory of 1728 2912 iexplore.exe 20 PID 2912 wrote to memory of 1728 2912 iexplore.exe 20
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\5c2b37d3726cf13fc3051ac81593ca71.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1728
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531396c3f01ee802b3c3928579587e653
SHA1a2211ba27d41a1d9c2d48d6cf1f05c7114ff0942
SHA2563eccf5ffa227b2dcea0e8ed8581cec4dcfad464f25802a9958afdbc2f722ffa4
SHA512a1148ec8ed9707d63a08a142224575da7469d858bef1927e12cf2d9da3c9bbac309d7ece12a7c2b4cccaafaac13e4a19ec0aa590149088ef1e52b8be523df90d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a297bca39e3165dd0583506a95ec62f
SHA1f61b211e8bf94944f6d202eb597a79f254f1efac
SHA25605c78e6df61d1e870109ef9c03c8eaa7ee992a2aa8d2fa3b9cb495aca51b89a4
SHA512d12fee2e1ddb110d73f4cb07d62edf321549e6d4a9a80717b6c6c54a4014a0046c3b057ca3826d609e03d4991ccefeb9146dcdeca9f196392ded8f402247fe52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d09aa4b15e317d39cda6ad96a117de4
SHA1f839d7f6059ce8bfd2c7098103ffb85362d023fb
SHA256032c5e15089223fefcb00cf7cc2faee110abe310a709be9e1a1546380f620881
SHA512c009de3e5d7def6fdc35d74dc8f1ccd75eb8f3ab0dedd949b9954837e29e08db46bcc3bddb4e1744e12395b547e806809fb41ab8664377868faf30b6fe3146c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4206639b93d3ddaae77676da8b7215e
SHA1c6e16bb3c199f9ec62de7b585c97569a1e45c2b7
SHA25634930c5ed91466ab52d956473e46422a3a2b423ceafa307a30e30f91881c7fef
SHA5128971c194b71961f494e4a98699bc07c84aa3fae759bfeda58a6c509d57309cfd5ccb1ac7fa58f5a6bef34215f0e2575620231762b315655590b2f15fe983dd43
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57332f36e3719dc883c5bdfabf471399f
SHA1e25b56be4e6684149f588bb801932c4f370c6d8c
SHA2565d48e2ae96d84f0cb7aa581a199f07beab1484e403ffc98ded294bc5fda0e965
SHA5127d4a92979e26daf9acede631ab1319366756c04e7e760845747603b403a762f5cf374e79ba01e2c0b52dd91f014cc72e586314f9a4c37dc63ef396cba81a17a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD545dcc0d1e83bcf484a8c52a17b002633
SHA178018e92dcb700fefb298c62bc91ea3404dc01b7
SHA256e210d7a9a687ccf572e40c952ae285a4a7c83d83aa4d74a75e53d0a43fa1bafc
SHA512cfa2db337947884fa6e62f35be03d4b7f9a2e2ea943b54af687c06cc3e5bbf2f96c6f1818eeee2953af4663103a7912ecd0441950eddb69dea9e9062e4da5344
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5685fdcab97ac4618cdeb15f29a413d2a
SHA14144d871b07bd7fe606b640ca5f2acc216f0b9a1
SHA2563e12f7c4a0eeb67f00963b7f42a87be929622ea497584cf19f059d48bea8488e
SHA5123f9cef649a3d006cd8184e15befcf6fc81f19e0b3f8e56ceb6b058f648e3d78a3bd4fb6b97db02a5f68040052dea435b35a9b04dee725ecb2bdcec87eea722c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54fa208ebf78afa4ba16d9fa11d230496
SHA1f77c863f99e001a5952252da9cfb31bb80bddb43
SHA256b3d421fb171192a9bb7487369928e5f0130a501c9c3be290af0c5f072274dd3a
SHA5122c911f0895e5f8eb666197efb51f9e7669c09cd2a019d29a0874e26ca316f58d30f16443bb37829e040c13b348c9cadf66fef8a66badd5ff4f26d8964b513940
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e0f8f3ce5336a28821ec178fdcf28bb2
SHA1b4dab383c5234438d413a76d4ec5498bda4e56c0
SHA25660c72017c4e6131d3ea4af1d614effe6d9c052602120e1e2b5797d06455a3b19
SHA5122e8a8aa86f09fac05978cd38aac85819d7c065e4cd5092cdfecf9cc959b850275a75b6e31050e1defff5af598fe90b8b15300bdacede7e64a3ebf0ce403aae40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3a7c97362162e7c259ced6f1ec4df7e
SHA1fe35ce22f994b78f2a1febf5c2063f1e6ad5428c
SHA256c8dab1d30a852afe0c9f95fc2ca902fe681c3161b699fdbed5ed5edd4afa4b06
SHA51235cc19bfafe5dde1d5964bf042ce03d810915c2faec284cd439747d0e1e9c3e54796132cb368e716a2c72b6dc613a489ac46a97f5631db619c290d0b90fc3294
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55e21a87977670768898916c4452001e5
SHA17ff3f688d61b41acbb719740e0f310ed07f5c625
SHA2567ea28735b81e3b4999a0baca5d22efdff7222628c8388840a556d0d4bd51a9d7
SHA5120b4daf5ea1145eba96d8f01d2b5978d8000526eb53e5fd0982f248e7d647e9c2d74c72bffb8364321096c8de101f6cc756fc2ef28746a27e5cdec61a79e2bc25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD594a93688611a03f031172f3dce36015d
SHA168221ac1ff33c9721515bd3aa2a376058a21ef1d
SHA25628c24fe414b3382915bd02d650345a0cea0f3df7a47238cd52f983f38a043bfc
SHA51264af0b385bb09cadc4a0fc59c725e398b11a9e679a94b66b4784a116a5a201fe40a3905d7b22f316df93dc763467125970c56dd7f1f7d3093885d7c12517ce56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5159ca4fdafbcde539439e74e13328365
SHA1e40d8dc8fe585174a6809bcdaca6abc87fb76658
SHA2562fec7e2c3c76b366b94384a2fff296f7c6dfbc44ad85937644c24fdaf70a59d3
SHA512f70913016fba4dca9299b47098c70b030ec87915009130928c4feab34888145481ee7e248000ee7916516b66fbe30f58c02f1b8d2e4179a80b2ae9a9f227b148
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5353996cee376fa696c29835436ca3545
SHA1cd0172bbcc6c76fe2b3a797c3afd3449073edea2
SHA25679238ed07ccc926b8a9702a08c57ab40e13a15393b846dc4a0d799548bc7e51d
SHA512bdf2368f38cbd34b8ba7ecce057cc2c8f45c21054922c0597bd4aca946b3fb80d118e16443d8484929cc3305cf6febd0f24e486d396de653f618a360ed9bc1ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f6ca1e054f1d2414369dbd8bf3bd2f3
SHA14a6208382019870c68a5ab348258ce3563a68ff7
SHA256deef2eb021dd80a08201110929a8882e2960acd0bbaba5f96962716eb7ab0e06
SHA512d2aee9ab8aa8ecbbd1f1a821495382b01386d41983a8ac266ac8c5c4da9fd207ef140954eb4b1f069bf9e1393f63c0504616d9aadfcbf7e8ff3acfcc0e9724c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8b37756430c0001b8883f1520461055
SHA1222633d5e7e3b63d9d29b9b6bf99984395088fb2
SHA256da190515d946aee2a70f8f0e3fa259987426616c8b8db08bbe57e1ca4daa2b1b
SHA5122f0ce68e827f2c07f4073bba092713a22cd7e997295a9fadd4f57c25f5b830e6be66a45c65ac248e684fced4cf16ef7c8066b27b574d9fa7da2a87d69f4e9d56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2c63e7753062b597accc7b62177b56b
SHA16def33b9ccc903a0f0f618ae89939e2fdfa26e4d
SHA256bbe0468abffd062e708c17693b0d015265aba94d1b823df9ee10d2ad7912be73
SHA51207081ba6832987256ddb5d17ff6dc09bdedf380b9701804c102e02912aedc2a23ef6e3d7d745cd87e7905dec8293b033248d581169bc585f8da6cc899e737461
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54f636b2b4d1c7c2b37dfbfe229d7d356
SHA1cac712816800dab88f6663819d2fbf8a52d706b7
SHA256ee88d5e1987d155592e4daa3e00c86fbc8eb1662e01d5cb5b3e855c6c7cb48f0
SHA512cf9c142faedd88b9edf6e1f91f5d08e3c8e41b5c186687d33f7b6f1096c38d1317f69f43fc5897abb18b5044640c8d36d5c623b28d78b471f64b4f6e5d817486
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537616b6fd5c886a6c662361cc4643325
SHA139ac0bad1580d24f129e6ce23f6b7b0f48304097
SHA256eedd944bc8106847627c33a361b9a76cb6f3d852b9db8182bed65f53bcf51711
SHA512e96429702da43fce14e740640ff221f0114ef406cdd33d1e0a2678f92b5ef1bdfe921cdc3719d9c639d0b50c0079e31d524227a6e5bc8dd8d739689d6e0c5b94
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
144KB
MD51b1834d0e562a69f76abdac1ef3d1567
SHA1d339b0bc585e7b941f1fc0566a9849dd45ad82e9
SHA25698ddb8bae1982c8e60653c8acd6b611f682e9fa560764249b1c139610b03beca
SHA5120a328f5c1c0a331e1c3170350577960171ae37073f83cc14f9538cabfc69f1b4e49c5b07d91b3d6b28f2fd245a0821315567af653de7c38a4c1222779ea2a084