Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18/01/2024, 22:06
Static task
static1
Behavioral task
behavioral1
Sample
6626f53512cca5d61c9c736c87f31732.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
6626f53512cca5d61c9c736c87f31732.html
Resource
win10v2004-20231215-en
General
-
Target
6626f53512cca5d61c9c736c87f31732.html
-
Size
6KB
-
MD5
6626f53512cca5d61c9c736c87f31732
-
SHA1
f246d7914ff182d6d04708ab3c11a6990563c03b
-
SHA256
0e034a3989e95cf08aa92815a5bc1c78b3814fe185974461cd781824e2db4ee2
-
SHA512
453d73a45c31c211401f8d97e0948be6fa1e786b07372b95483baf9ee8981258ef7dde5389f70f7e5d277fed8a6d9eebd7c13ae838106858ea7bb70299c687bb
-
SSDEEP
192:vyPxjEEuPQVgUX+O1tBuDq/gxgcwAJvOom7gxgcwq:vytEEqQVgC+O1tB0q4GAJGomsGq
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E01399B1-B64D-11EE-8AC5-6E556AB52A45} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90507cc25a4ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411777477" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000d65f54cb61e1aa9f51531592e8b28f9b030868a8edbb82868e1cb61187a07771000000000e800000000200002000000094a4f54f97567494aee245980eaacc579c0fd62336d0ea116f2aa29fb220e86390000000506b25e2b470fbb90c3db10b7acda5434d39f779438efd148db9cbda5ebd2640e7361d9bf925d66a813848e350b53f0affaddc4faba30a679e490cac284b70ba602f7ca991cc3fd6d160ca00a1e6dd540f32ecc6d72fe668b7b45566b37254bc2da6a4f1a4ead08b156f6ee34b2f85c8f43abd2abea825d2af3520f3da4c546879a87af519e9b6830846b152646c8b8f40000000445fe87f377cf7c573556d03ac77808a8b79c10374d351951531a31c97da9dac3b057e3cbb51134cf2e78e0a6aa1bdee74017c07cae9a34c4db39e9d724d5c70 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000cc0c15a09eb8876fc1a7d950ed9c52b020989130a7ebac0a50ea88d39d3be4f5000000000e80000000020000200000001646294f0e1219931048945aea7eec60f97c5dc79023ede5c9f7d44fe2867d822000000023b3389dd3491eab7899e09a485dbe65ffee813c114116e67377651fae5c8ef940000000f29710364b03c912fe42e9ae3868cd071902d111ce5ecdae92d7602cd1ccaeaedeb8ce740739c71c5f85833ebd2033f36c8fff2e218af03aeb3c7c11bf5ac01a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2944 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2944 iexplore.exe 2944 iexplore.exe 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE 2052 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2944 wrote to memory of 2052 2944 iexplore.exe 28 PID 2944 wrote to memory of 2052 2944 iexplore.exe 28 PID 2944 wrote to memory of 2052 2944 iexplore.exe 28 PID 2944 wrote to memory of 2052 2944 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6626f53512cca5d61c9c736c87f31732.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2944 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5af8c58a96e66c8fa5d9b0bdb814abcde
SHA1f135d978a01a0c60c0a18e18223c935bb392abc1
SHA25673693be78f3b8e251a897e5c557acdb9907e215cb10777777042893afdac725a
SHA512e41813490e2b6442dc83274c63a3266d22d8e4833c492cc7785faee91e9824be10059acc661c45bb521e960f74242d140218a6b078eb22d4ef5d874b60c01f03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad020a6ab8ce2053b9640200e8a31966
SHA139801032df0de4decf18ad9acf425cbb9a610c71
SHA256576dceab642390c20d4fbd4736c5eaa39d72110caeb6d0666f501f501f71c48b
SHA512a0a69d889a94dd57c8667d546a0538c76c1a6e03e73d473ca3d88c527a0a2fbf6bee63f50a984c464581212cbb0e8e560a01b0419e0c94b5cb57bb1f0332526e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53758ea42869272565c7ff3e58c021222
SHA1746c100ec151e1bcabe0a91a97afba333e55fbcb
SHA25646e005a4b662b41ba2714d36cac156e66915231d3fd7556631396b2a130354b5
SHA5127b25fb57cdc5d8d8332ba017483246b3689f0e644f829a034ef8a8980d534e5722ee3f0d1dc53b499c2845746685918ab84b192cc38565882863be2a17f7a95b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556d31839d7230a34c711b32581e76dca
SHA1c750a1fd074a44a8e9506ee303e6055dddfb064d
SHA256de3ec60ece7cb81755ca5989615bea498649e1dc21ef63ee2cc4a06606ba7cd6
SHA51282b9905e5cd59a29766f9c49ec53c0c0f6252001748aaafb642bcede147c3cd8d9a666d7593597fc0fa21df6d8f4d9b825a7b1bac14ad60165d313321e6ab4f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bd3641ff3b0272e23435b6a2e5f466c
SHA1242953deb79f7d0725310a0b692c25e2abc38d04
SHA25631f10acb7985f7d36b50f169baf2d68eb878a903f1c66d6d612fcf758d7fae97
SHA512d2563007c21b319d69a766ed3fca9b495d1e79149b4a647e0b77969c1f908c770a8f8f512a8125a67047234904ded0a7628f56666fb0a8b09ce1b8b8655437ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58aefdf3dfd88ca1db61ee49fe7dede36
SHA1212dbaa1809de16702521356c132cae5f80e4e73
SHA25611cd22f5b37f25e083971995f2ab63af21325ed8bace100db8e0344d9e38d38b
SHA512bf2fc9c6fc91e21fa22cd41c4863b6689cf46c667158ffbc716591bf795b0f03d37cf7c42a61f99bf7929d6a157888a89d702c1b916371e1398b586814a24ba5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ed7548e049b31bec435a728ed6f1d30
SHA103bba0c30edc15c7dde3f988ba3c082ec863abae
SHA25653972c8bc9539860a8f79873892bdb63ad875b655e2add993d4f8853ece23ad1
SHA512a31af67c9c80f816c93823f1127b2ec7da738cc7a282c8b24b380e280194ec5282725b7155e2c1e5fcea2233f1ce9cc7c351d8dffd31523e02adb643c88eb7bc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7a20502b285e6765601aef4a68c6708
SHA18a894217e2d7bb5fbce14a0a05c5526f314486e9
SHA256ae6ec0d38a0e23a3dfbddba6acd4d64aefff1c223b1fe77aa1533f9193a00ab3
SHA512761a08a80fcf1a7a0e55967c07e41f594e3a81e836ea97723751d4cbcbe85da80ee385ef7d8e8bcdb5cca58112a3923a4b4777403d3dca14fe56fa2e3f60cf06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be92daf49b1a07f4bd0dbb4c4c4bc430
SHA105e1cfbe94c1c4c26c0890c4852fdfaafda43f8c
SHA2563d17e2a3d95499048e328f426c2030e20fca50300d837f6e89e6ade01cece9e7
SHA51271fa3188eb49f9d2731ff45fdb7154acdd4d247530006840ebfcb4d845c2d9d5fbe1f3acdf778cb15d7de5641fb8c6ff8c7621e4bd233799ecd3487549fbfdeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bebfc01f6cf2f676d6e34c2429e0501b
SHA128b783fcc3c7fea38ac91863223f1dbab27a2983
SHA2566ef186c9d0a9763786651bb86c1cf20dae8605a0fc4fbc8656736da38653b18e
SHA5129ee96ee593f97d9d3d63aaaadddf53286a09056df36e773975679f68c45c03d39ba8d008d8b55b348ad0f9ddb08d4d05e315cf4d09508754f1effdf1c02a1e25
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d76f861905c598ef9e006071f2f3f530
SHA10e3464ac2488470973a90cd063ce2ee1c9660a26
SHA256c37a897e6d1f8c855715914e486ff8eb98f08f57b99e6946402e389613592878
SHA512f3c30951c8d86908ea2af5dde4ab05d5ca8acdd9db3938d28d479d15e02610655ddde07d18b7e6c1cce75694656d63aba15da98f4b0a2d32c30853a6d3699493
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569d472b623be8fda45f88a1680a95f7d
SHA1b0c00db2fcb93417a2556beadcc22e74a2617da6
SHA256b4fa4ed1f7c0b69a0ff5305bd0a9c5489c67979c2ce11db949c94b1159c857bb
SHA512f9cd925ea4715a8b9de00f2ecdefa4ed43bf7ab9599a7380307fb7b4c32c1148fcca2fe97b766a3a143a4d456d6dc62699e6a25297430bbbc99282ea49127f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5011e423c8ed7932e807a84eb8733f275
SHA1e7ea4f2ac73d5e76537d2d7d0545ff8d44ef5886
SHA25655f157d6b06d268b3138fa308064ce6682e9ca7a4e3b54524bb9d31c1307edc5
SHA512f70247e10faaddb199c4923baca43c102e836c2b1d31c7322c922faa9c83f06d3fda3b39af03de24adb74c7fe8b538811929f4a391fc4b8d64a9050b1b8f6102
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d18f0f14be8847a1450c11663c3f8314
SHA1de6de4681b53ce2dae8f4eec5b2cc3cdbd7f0c48
SHA256baa588cbadb6af70b8ac211a7979173716dbe9198c4dae166fc642c3cdd099b5
SHA512564abebb523b589ed3e478c16f7d2474f88dcf287c808670a56fedfa72face152f731e7b56e832a8ff38e04834b902a293c726ac869ea8f7195934186adbe2ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510889f6833e1346588cf1bcb29a4357f
SHA17cb09bebc5d2b555772d90dda948930213b02dff
SHA2568f51860308a40d4550f22ac4b27f6700e5adf09dac7fbdc5f955b3d11e677504
SHA51216e62c596db7f49107b7eb5628d8cac41bb516f0240881ec99b05a012c22b74e7dc581668bcfcf238b87e533b1a70fe11e0c3323b99ea4c5d530d851a7b6b268
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ce8b25b90c7b8bad1943c667696c60c
SHA15ba0c2856e7781184e0152c5a442d4287c5470b6
SHA256bf18030fe2bf8bbf9eb17ec727e8422994782a6efec01d4c633d67d1b9b186e4
SHA512a4fdccfa335f10e7d7875a01d6c9e7dc3a2c2d3997971ef0f2b54c4576083fec98ccb20af67e3b882bfe53efd3b22648695abc0e9359b51c39fcf4a72e2a2de2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ed5fddd0a205715627ea93bf81161d1b
SHA108c6971a3b34efaf9917a11f34cb0b435ca6a4e7
SHA2565ce24bfdcb7be450a05c89f10a496611cda8aa09d3b4e353bd7910ec4d0cc634
SHA51289c031c1a257d66a03a17e6ade4afb3b03e849e522cc0bcef3404bfb56abbf18a78e0337972528655c4b32f5d35890b4cdaa1bbfc46d624ec69c1276fd37bd4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549712ebd9a5db8268389f6e7a3a3e3e1
SHA18fc25577a610f3fe286fcebd35e16b5d3225c6ea
SHA256dc2ff26b0e325df0416f2ccb5ca0f6db6d962efec67c34e915dc2d89a5200bc7
SHA512bd7441731b5d7d1da91c3cdab4fe2b7f0dc7c5400c5bb8be86ac56ea1ca5c7d0934eece3c890fd4b9f1a46b3d9c7f7618c4b31d7c79663b0d2a9814cd1e82b3e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06