Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 21:27
Static task
static1
Behavioral task
behavioral1
Sample
709a00fbb37f6de6a075951eb9114609.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
709a00fbb37f6de6a075951eb9114609.html
Resource
win10v2004-20231222-en
General
-
Target
709a00fbb37f6de6a075951eb9114609.html
-
Size
2KB
-
MD5
709a00fbb37f6de6a075951eb9114609
-
SHA1
c74b4a2ba2ef31f92fb76f6e8fdbddab0aca76c1
-
SHA256
554f0efa1dfb3f3b5784301f818bb989dea9d62c688b167a6d5ddf8d04d273db
-
SHA512
247a861a7c5ebe3a615d1961ce6efd5ae340e4615474f9e70dee21a7d61ec5e481faff5cda6dc6a3ae78c527c2cefab441a4cee3cb6e8c4c3b680ddf86087459
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412209578" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80c8b0c5484eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000352b6ded1f3d1acb3a92bc22e2b8315c56a477a95a0cd6f73ebf159ee66f101d000000000e800000000200002000000040a9b433bad80c2850dc17244396e59f2c5c6123efa14bce33803f0b35bff9dc9000000000f3bb3b845cadf62b0f358c031df1f3568edafd11d35fda8e8595a8e369e05ed4651d2693d9214093b39d67d1c9127c2a91aeab9e0f9f2ca2805aef741355b745cce4db2556798c9f7fa3fc2b911d351376d49537bb4def9eadf23edf8022403eb02e208d4164df6349c96f0268d0e9b73d669af37f298ebba0c6fb19802e88058863c6e174f7e53abb639ebab42d7f40000000687f0d42d3e67528d34a463c8c80ba9a5dec29ed70417c5fc10055f79244e2d40d577c6e83ac0ab7bfbc1d787027f8ef53e46fdbb8fc2b3ab8b67d8723111181 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a0000000002000000000010660000000100002000000002ee8ae992aa66c4c452a2c0ab6013219171d213b033a036eb9709828ad20eca000000000e8000000002000020000000a543e9f335b43bedd18a6fd3b9d4ffd091f4d3054cbd021ad377e16e6ffd66da200000009b6498ae5e98787d57d66473525b643a93be11ec71190f384641bd9d6265b87940000000b3de79cbc10d1fa81f8ad729b87b214fc6c4db4706c2e7484c5c04006baea5fbc7c60c75b6275af8bc8f972824016a1ecb268db3203451db5558b6d7e85618a3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0EE06C1-BA3B-11EE-BE93-CEEF1DCBEAFA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2664 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2664 iexplore.exe 2664 iexplore.exe 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE 2992 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2992 2664 iexplore.exe 28 PID 2664 wrote to memory of 2992 2664 iexplore.exe 28 PID 2664 wrote to memory of 2992 2664 iexplore.exe 28 PID 2664 wrote to memory of 2992 2664 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\709a00fbb37f6de6a075951eb9114609.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2664 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2992
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD54d4f8f2d4fd3a8e40050f6e81eeff3d1
SHA15448f161355de8a76e3109fb0f99a68d8f286d2e
SHA25651e2d4f9949ea7f6de4d7db7971f7c9c975e30a070fa7529506576dc8cf3072e
SHA512e2f9b704be2cd25944f16b3adc4a6200f061294bbdd10522fdd91464b62736918240575105901fcff49195e1d57b1445d4695b4982c5abc342c9920cebf35dc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5855d6fe5adb205b78ec5358c81b33187
SHA18479e5a2424f2e6a5e378d698677447a30d544cb
SHA256b942401a7614a8400fdfde527d40ed83ab007f84b51bb025c85874654e2ef068
SHA512ffb39bfa3e68e7c8070a31d970704d630c82a06fc56f3280c4e9ce5be583e6969f531f77889462948cd2ac909e6ab3edfb6ce9d46b72f960dd25f07dc1c7c7b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f78741ded082ca03ac1c208cd03451d2
SHA1415530400bd9b502b333245cdf2eb7d8dd2ab8e4
SHA256c7858a49d0350e6268e0f423629c70e5a20ba0ec06b1ce6a02b078379dddca1d
SHA5124923a7fd16f23c7e7ff607c3a9234364cd04d040142001a0df1c7abaa8e1b6c092ed62d8b129c9c22e1d93e9598e05c29500856d4584cf3d06c0013d71e633ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558a05063ebf16c4b0344e1cbcadcde2f
SHA1729373b2fb73e4d0ffe121b4939736499f2f6e63
SHA256e32d1c3813f5200349e08a025705f1b9ad3e9e446b7d4bb8970d1067a5ef9633
SHA51244e74d412e6efc07bd1a76b00b404356c42510ab28f188d0f6934ff6d4f735bc87a6cfc5db8e9c17131cafb47c0195baaed5357bcfa0b1e7c5f9e32610937567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5befc32c070bb22326fe45435db27ef92
SHA1979d7bbb362d6fada3a216db27d348beb99b08b1
SHA256029fbe63e749d231faf8dccc6a0ffc22d796c2a961f550e7ffa9cc8acfdd3ab2
SHA5124b0ab313f65e92726b414298c5945ae0a329bcac3eb692331dc8fcf750864bbb48d7449c816cdb73cb38702e80c5dd3296b69dfd58cfcd473036b857375448f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD517a1e35224eee8914c3ae54b6ef60a7d
SHA19919d84e8ca66550d4437b7ba22c8cfa619c9e99
SHA256b4caccebd39934a77bedb9bc2b77be1c7ead94142045ae273e6a4e718fefccf8
SHA5126063002ca89b70faf221d66a4047c3bf6e994bd25427702e0a53e12268ad0cd2039cb750fdc3f27eacb17717940f62b5f153f55054f8789fbca5db79305911d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b5839f4d340e2f59393ff9dddc7a588c
SHA11bb2297516ee7ef092f44bd4fa6bf385386ce72e
SHA256d41eb2710e8c13fc65b2b7075b4465b20fe95ffd48347048b686795193c20e47
SHA512440d056b215c23289915707b06d5e1214ef02a124d56f69cdd32bbf4a24ad14dc9305c332e21614d05caafb8e4d56c57e2e950ef2ba603593c8bce4e2168082b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d00d7ed26242e95a9ceabd80cf32bf9f
SHA1fcf47c4e1e6fe09d409776ad11394da00fafbb11
SHA256ae666be9f54f0ea9185007b13c1528f4df514b005d5d753759ee83f2dec75897
SHA512d7b5a5f2383cfa531a7e47251d5004fcf6cfc02a0432f8c3cf6170013302916ff0eedc89554bde3048b3d6849f625e67875417a8c15fb65c9dde22e91947d21f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54d3f825d4c85fd4cd3633bf31940761b
SHA1303d041e5ef3829dda185223b654241a89d6f0da
SHA2562780c96321513ffbafa11382cd20ce303b9c4c8f0129f216ee0f9228d9fe9e21
SHA512c239a1676d9d8d5d69c7f72d00e620e588765578bd119a5521d2fb1a4bb5cb4ec6be965b614ba8b0bb3336ed1970db6e7112d637a308eacf8cb9404b83833522
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f7f39f515aea7afaa46ab9ce5971797
SHA18b743b543217ca440db30ca544c995d0b8d1f5bc
SHA25670ae1cb7e3e482802ca988b83e84448834a5c1cadce4503d0dd41aa30b27f40d
SHA51265ee4210a9eb9a690dd32ebd66979eeec2f5511a5c523798f7aed22e1c27d71889652b33040a6e1ca719b6966a0c74d0114494c53b841377cbc1b04a6aa2a939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a854adf12becff97a80a2243e54686e6
SHA1dd97aceb95dd860181aea1b48a9a4d3bb8eb3c43
SHA256f94af8326ddb4b67c69af9c0505da9f1fa8bcd5615a9f8df8d548102c35fbc5a
SHA512eae0728d6d605c06b12b77ff3c49e50118e9f7be0d4f1923f3d12c0010bd61c5310088bca139b03b5219d84d7c3cb1c798d230f760d6d166e2911e21e5d072f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53f905b5ede01ef4f58ebebe5e0c5ed93
SHA1e5bac2aedef21c4fcdacd2614894f2857d18dfb9
SHA25669378c74b15eaa627fb34dab075e8fb9a5ed4ff20eb9bccb0443a2be0d20132d
SHA5129a22494e1d8ca2f536ba588269f1502a33404f00b4a83f83e0757e572c48ce34a2787596e18a629570545737d32f1d554fc16ef7cf49e2a44b1befdf06c22a18
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f05821dc20e2d49e091a2a2d212c0edd
SHA1fb93cfbc8cbba9c22b52200908515b44b8c96a6c
SHA256132795241c7bf13a838fbefceec92ef4ec9bbef25f13abd21c75b6683fc20163
SHA51270d5ac175dd2d381a75a06e68b06f21ddc21024617150ec984f2a71a0dbfa75fe5596f3c99dba923072ba0f4e43646ef87d4662e31fa115053f68f92c8afa867
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5fe6e1cde50ee750e886ec3c30bf99afb
SHA1f5c2f95f9d7855ece098ed4fb073aaff614736ff
SHA2568aa01f773e58ab43e5ad5b1b702c38a64f40629bd5b5193e453b54ce9a92510d
SHA5122980b8f5f0fc48cc1cca215c3ad7eaa84873904cb06e668ba8041c86482e19eda22ca129331f99c0bbc3f47431e44b1ea8f9623f0111a9118ac258e810e7aea7
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06