Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
23/01/2024, 18:32
Static task
static1
Behavioral task
behavioral1
Sample
70437a407b23b0168d37b810524cfe85.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
70437a407b23b0168d37b810524cfe85.html
Resource
win10v2004-20231222-en
General
-
Target
70437a407b23b0168d37b810524cfe85.html
-
Size
6KB
-
MD5
70437a407b23b0168d37b810524cfe85
-
SHA1
26b49afbbd2f9a251f295d9a2f1a810d98cd1fa0
-
SHA256
e9b0eeba68c8274bb7c65b30d03a618003631e5f5d819220b2f9d8ecb0ca4d32
-
SHA512
10cbb6fcb63f60acc2f2306b32f79759c9b0e8f709493c5a6030b08a999354c4345481e73c68953d146452155d3a9657205959ec3a783677cf13e03fb2fc8a11
-
SSDEEP
96:uzVs+ux7kELLY1k9o84d12ef7CSTUJccEZ7ru7f:csz7kEAYS/fb76f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a611409797eb9d3f4d2caaa897a0e0935128cf488c502d458dd5ed5fed26dcb3000000000e8000000002000020000000f3583d3171a50527ceb45c2fe91483c56363bfba309db402c7160fb3f7793beb200000009d801d0c9b6326ae564f3910ae8d039b1006c3f2f507f32a8f1698e1710621c54000000027b59d9a97467c20a23c0a10a0a3d4370401bc3c26732d94996968c392bee1930fc03fa3cd7f38c1c1c640ce0c8381d18eeac22820aecd8824ed0955ef428f5f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412196637" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CE8DE641-BA1D-11EE-A371-5E688C03EF37} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000006b9472af34669c144b053c92ca9b30aeffc26f385d46aedf4bc2afb56cd816e5000000000e8000000002000020000000d6a4f42640e8c1249fa261c404ed497decb55bf2a12f2bddf43f07405e8e5853900000009a39c38fabd583934971e844157c0610d55b51e71f1d967a102c9428e32699b862f8a259ae61cc0c6a51cff85921170610ede20100071edc0f26b14f25fffb66d2cdaa69f7be7ba3705878473c16ca8482a7a7343e4aef1c077b7cae335544431932e239f06733782aac53df8a8d8e968e7c00596046142be856c7839e8f32000fac4aa41d7f2fec220576d95ef58cf640000000c73c6e12d6239317615f77340040e7cbd97ce836afec5905eac2963465e678c19eea953f633cc97147fe6589252e94572db58366668088190b93cd382d28f9a4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30491aa42a4eda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2028 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2028 iexplore.exe 2028 iexplore.exe 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE 2664 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2664 2028 iexplore.exe 28 PID 2028 wrote to memory of 2664 2028 iexplore.exe 28 PID 2028 wrote to memory of 2664 2028 iexplore.exe 28 PID 2028 wrote to memory of 2664 2028 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\70437a407b23b0168d37b810524cfe85.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5828776daea6694758aca7368a3ff376b
SHA1756eab42459b36f7aefb2c30e86fa458d5a4dbc1
SHA256bfcc2ef585116a1b25606fefdcbde81a1a7020eefbe8714a0c0619ff5275404b
SHA5120b1d51c9d119065aa8f764f3734ce14f456b27d50544f0cdcfab5681a05e2f7b213e963bafbdd10d94d5034f2275d7c2088bb004c3d57dabf0f0a4aa3451a9b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59857a51a034dd7eb33bd6f4315c8b697
SHA1808e156bedb897d6760bab2a871ba5c056eab473
SHA25671b849681caaf7c7f6773c91d03382d58ca52e04443bd68822a7fe36ed5a5ed7
SHA5129e4762fae94485d34f6f74c4472c054a0cca7e0ecc67176bdfffcc9eb012d50f45dc0fb5c81daafb3d7fa9249a435b5c5e7904359bf22b74af109ddeb2bf265d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a1f611ea9dca9fcdd073d39cc64e06d6
SHA14f936daf789aebd78667cf3d2738b6bb4ec42b40
SHA256221fd0d88366945996020bb985e6fdba1072bec10083b6d2a1b592e8a01e281b
SHA512a6d46897a64c065c064b15ec2b8562c4eed66eb0acbedb958a748e516d8f5f9749f51c289e3315fdee60b714b39f80a5889c065d1a57363ccebb44b1d1ab5874
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ef17467b0bf7ac690e994c02464146e3
SHA13bc178e18cb5f48cb83d5c49db8bf62620973abc
SHA256e349ae77cc6e9b45e4544407c8be8494cac8680f0f0ed82af7dd6e4835cffec6
SHA5125246fdf62888213863909c13388913c5a4600e69405544f27b8a2cf21c578eb83c3d7d130f7b1bac93bbfddc8cc038e7eec91d3091e086f267ed5808b7e07a3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5049d773923df2f70bc0d88e71cf9f317
SHA1f173ddbadf6d8398ad4749c97f044adc4fc6f448
SHA256eb6fa7264ea56c5ae299b0501ff2212b9b2455b7c32411380eedce302e58103d
SHA512f433ed6bbb3b12eee8fc770d2a41c68cb2e10009d26e2adb89d694e381c38ad7352c325893cf5b0ba737e19c1f8cfd6f64e83db723b96870abe4a704b9f179e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56a4e1c96da49b4f05bf19dcf9913e5f8
SHA1add05ec244da6b40a2c9ef2c002ec17f09500fbf
SHA2560812c38f6236c1b5fad9a238e01cd1fbc76c93d663267f68e713572d15fc7c42
SHA51238dd03a5f2bb20b07a7154b3a735230b8a87ccbd0b22fd52355ca25cbe5736457ce1b3567910a5eb9b86411d787308588d4a39cd86785c992c1c9e70b66ef776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56f6155351fa7d3dc664e96da86990cce
SHA1d03b52fe66038a027ca414283635fb2257bb396a
SHA256510abac099fdb1d1d9d83e3e277ab62cae699aae198549a21eddb4da86ef7df4
SHA51277ac32bbba2939ca0c7cfd0ec37a27244ddd7837601db66bbc1d94be09c9bce4159d99a1509b2d2265e311f4344b7418570841c7ac23b1038a746f6fd87b787e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b56ca006d7462244aa67eace095c3843
SHA1e0804fcc4903f4565a3fd84332e323b197644905
SHA256914c1c12580e05afa43b798fc027a58d2a3e146ec85005840ad7fd2ca4a497b4
SHA512322e5002fa9428a71ead51bac5f261a9a65759b9f99db6eac7c09bf19ebc9d18210e0ad92db9370690248f74c7b401a15a5c991e8a69b32ecd19f1d0d09472bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5158f9b150ebe43f629b758bf59fe5c38
SHA1ec9a2679063a2d9099af068ff30cdd305a63f0fa
SHA2563f46b7fd381a8a4a036372900a655fa04dafb5341279ce801c6bf7781b57990e
SHA5121e564e55b501b1b55ee3639bd288586a8a5dfcbcf66b196323e34bffbac16e14afb0ad3aae313769e0f6e5d797a406b5514f7d2ee677ddcee3a41ac804e459cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5342b795d3d3f1db8f8462dd05577bd64
SHA15f5c36dc12833097ac1e12bef46ab56e93b1897c
SHA256af51df02a0d0494b7372d550e32b18dcb5adcb670358edda5fd6caef3f61a2bb
SHA5128c847f682f5ff992a4d089c8946f36e2bc7ab428feab152f18d6843f69c027240b5d196449107c13d1de2afaf04b1a8be04e1838911c4cc330de4753e65bea7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558e7cfacb1faee38c4dcecec04de8d2e
SHA1699db31c951857bbfa02b0863ae71e57948bdc34
SHA256d2b4b793df58f9a4a856c9bd26b22b05c5174681e1a5a03b82c3ad8ea8e23370
SHA5127ec8714c67b5666cf2472bdd7843e7bba39568b9414f821e6f314e9fa3aa301fd7204b3c3eec30776878a90bed31e6780ec2c0c6e499d61d7b40d34e8cf0080a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5661020ef408c9797a99092334abb17a6
SHA1352854b11d72f71809b70ee0ba3d786979df9fe7
SHA256887f6da28f233b6c8243220883e9a0ca6c53434310d2337dc75c78d4c039715c
SHA512f267ba247ea151e26f50f61f1fe7315aab418a8337916b069d57719c525cfafe2289dc8c311fdfce532c4a9afe6e4e01a54a326ee39a423ea7d4924a0a970f76
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53449a05b54b89a9fcda1b0f2677a17f7
SHA1d6dcb219e884d5c654cb58e3d445f7bf6f72ddcc
SHA2565382a016d7aa797ecb9ea1561c61a5be2f11a7ef7ef614411481522258af543c
SHA512cb6b5a6b31dae4db3a3da0c20d511c10e11374de4feb7b0c99d8458d3926dfffa799f1ee25ad74629f1cb5247b300528b64e92ea49e73f79e8a8ad8fe84e93f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7ff44a3d92d98057c78a6ef30a437b0
SHA1d7af6cefe6761c490dc2f8ebb6f47866961380cd
SHA256faa0ba88c07ad5241f4501790da37aedf4d3c8079683288479912a7179e8fb8f
SHA51229197793039d81eeb0896fb9b80939b2931555edab06bbb9ca44fae6d6e42117400cd529fe0b1b69410a463a07c1eea69daacda8c8bf4b922405ef9d2a659bb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586b2a76e2a4b52542a6a235abc355e2f
SHA19c418bf798fa3471e2bd6e5b30628cb697810e19
SHA2568d4f82dce1e8acf469ff9fffe82173d983e31f33b30331733c50213bb630273d
SHA51267f7d605dc03acab83ff94b3ebd32d3115d1c4f07d8f723850d45fb30b5f687c4f003549b5258384e86e95541db0bb5895cf611af35c91fe3511bd41c260dcd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59d4823bc4d95d9ee086ec4f06d959c78
SHA17fa1098d8a5a69a00a2f258cffe1567b04fc62d3
SHA2568059113bba06c0d25381356929739100e39c311792dac509dfafea4ce47e230f
SHA5125147a89fdf7480d5198030501dfcaf70f344925f997b9da48bd496ae7edb61fdd7b37a2d4a274711815a773d4b25e8edc77cb9af210e1046d98df1c958e41cc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9244bbb75869d00db4df006e0afd7c8
SHA10f405c93fd4c2c0f805d177866be6491952d03d6
SHA256a01d60c33f3909fdd172de07a58e2c3d42437df82daf34de2ab015a4ba4cc5a8
SHA512c6c5f3890625fc0786b7b0bbb3e1833fde0498a073f4326165e4c7ee58ac5434a54c03f46d77d50a45fc8d1bea84a0021441bd8f64a45c666a1f410e6bedeeeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58cb540a6116f55a37957cb3a6274929a
SHA13d99c06e3d484087a23c317bc8aa64645be38b82
SHA2567f7b31b5499863f4777c3504a658d71304df8d07c109d4bb6236a88b90b6c8b2
SHA5126c224623584d1497cbddf6d3d74a00b01e2d874f688c49152ad8ba2b4d14079e8ebd36e20e5e8f2b7d673351a22667a95fbf4ca9ef6d4b583b387a379fdf0fac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dd974a0a3d382c6229083bf625588d16
SHA11df615c57471515809eba26ef40e984fdee20deb
SHA25632a0ba6a6c07e2eed683abf8b0a9d46378917fbf801785691b6945af739f9e24
SHA51249283be597fab476ff70f697e8c98e1853c80cc8931d7318a231d08c5b378e048a6ebb28dd86817567a05234cb2c5fc0e9efb0ffeb8dc35134e621ba4c06abe4
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06