Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
7150454afb6a609e9e475ea6c50e5833.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7150454afb6a609e9e475ea6c50e5833.html
Resource
win10v2004-20231215-en
General
-
Target
7150454afb6a609e9e475ea6c50e5833.html
-
Size
432B
-
MD5
7150454afb6a609e9e475ea6c50e5833
-
SHA1
2a16d5df530a01c1c17c2fc810677bea1a7758eb
-
SHA256
255872ae2735c034755ac20527ae9e1ccb24490b700ed040b8336cfe59030be9
-
SHA512
9e1ab96ec4d077331ea4485931b98426aa39bdc83aacebe2ff560d1d6167f594b25d1ce4c6edfaa8ac6778ef5849b4d4d6f0280c3a4bb6328b20f371ac929073
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "79" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2434458334" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "39" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2428521183" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00c5e84744eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad00000000020000000000106600000001000020000000630de13e21c29dd372a58bcc7627f1d53b7bdb3bd180179f1a9319c0ba4c5fc6000000000e8000000002000020000000f0356002761aa588349e244df042b314865feef7c665c438a3f3d840e5b0cdbb200000007d65e8d3ab11a58b5ffc39549c42476eea59fcf768701f4f743fd4a7cdca6a23400000008da99c08621e5c3031291d2352e672375ab4013401f2ae21fe684c93552d7685bd214d782150940c5de45ec4441148fb9e4a061e434e246e03f7fa1cb30ec683 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2428521183" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31084148" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.opera.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad0000000002000000000010660000000100002000000070237eb2eb632542bfc70aa2deda15326f28eb56aa7072447e9e132150401a55000000000e80000000020000200000007fdeca976ea60591969807f2afa73210b942ad38d06850dbb4b24ceaeda4c94a200000004f7a138b142bb0cccbba3fc1f04a253697b5e3533e674c366778a5aed9a0f0f340000000f30dc19d7a3113858395ad87f00148ef38cbf3a1973fc7bdd6ab34ffc3be995dc0ef3033d861ef0589cb5b2865a42da5901e4cc44e10d5e2357e431b852de743 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "39" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "79" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "158" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084148" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "118" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d31a82744eda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BC2D54AA-BA67-11EE-B7F4-5A16FF4F52D9} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad000000000200000000001066000000010000200000000c9fc71677b6903e60d665c814c496f602441ab1baab0882d884a9e4e5658ba7000000000e80000000020000200000006fa64fedca1e8bc0213232a96f2b47922a81c4896f16d6eadafa7911bbbc008b20000000235a534acada4e6c4e27187588de644712741aaa20559e0789ae6d9e39f689464000000092924409d70ed4bd63b7b3f04a5eb94a721bcbc2bbcaa280eb78b8c7050d54e15fe47b0cbc44eedb2331a9c0d575b94bd7fc200b2fa64fcf708aa60856f8f82e iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "118" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31084148" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "158" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\Total = "158" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7002d681744eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DOMStorage\opera.com IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\opera.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412831494" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20096780744eda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad00000000020000000000106600000001000020000000693a0e9e9b4fd24745038a4d1c297a056e250955e455f9fe58e7d6ea28598287000000000e8000000002000020000000d5414594413c1f4ff87667ee5825709f0f64beaae60bd018097eaa0156dc199120000000c2dc61d2ef150fc83d07f9e0f36ec9a053a46c71967ea234edcb9613d2a165f140000000791df54b862f60ddee3d55f06e94245963057205566482530799b6921872a501bebd26af4ed4c96c588d178efc06c2e870c2718bdfa757b6c5ce2540c25abb36 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "79" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.opera.com\ = "118" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2640 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2640 iexplore.exe 2640 iexplore.exe 4108 IEXPLORE.EXE 4108 IEXPLORE.EXE 4108 IEXPLORE.EXE 4108 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2640 wrote to memory of 4108 2640 iexplore.exe 85 PID 2640 wrote to memory of 4108 2640 iexplore.exe 85 PID 2640 wrote to memory of 4108 2640 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7150454afb6a609e9e475ea6c50e5833.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4108
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5f3990afbcdf64f1f806d1b926cf35b3d
SHA1da1297f9ac1e9e9e7e78b567006e9248bfc212f7
SHA25648c214dd545cc2718f7e844d699efae28f80d683340959e000bb41ad75dd6386
SHA5129b5bc750b2e1038c82a93d51efe0d7dcf951ca594a62a90bac0ca1019d232afd07f9630e1ba1b609e128a9ba9c23c1ea8f1badd9e6b25f3eb591a936c89ee939
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize471B
MD5b42600703b095b392b1eedeb2efefc2d
SHA185b0a95af2f5ff42d8467bbeb07d609eba87b293
SHA256266677da0f65e838490f3bab3d9626bfa07adced8d2e9ae5e45838cede4ce7a9
SHA5126bab74b84ebff31b751ad2455da5b54a361415bf86c256f2ef03301ce1711c2f3fb8d29e1b222caf857e97cedd17d2050c504c9e8626b527805a715018ccd09c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5daad95cd7261d562e8e41229fae62931
SHA126b26909c4859359f0869c3d1a11a4d80b9bb5d8
SHA25694c6602a66fa9d553c3da750c977fd82e22ada0e3f7e0cd89320dcbe166d2e90
SHA512489cc959ae5b6e0b679dd33a539779014982d8ad8ad22f876206b6121a40f6e6a831a0baa89cda60bd326063252584c890694031dd6f0fc149491534de97dc33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize412B
MD53d7760fb92bd934aa969009ca16ecabe
SHA1709277ef2ceaa0cc2f0b274771d5ade85f5c7c02
SHA2561b184dea4d7457e1a23865746c8c02d2de9111c0264e6e11e8a58428e4b4c534
SHA512152ed53dcda78fb610a3a6ea807981ef0776ce6a4e66d515c0e7effeba7910760362ca67ede28b43b99873a78aa1b0947291f39d4c0622ec0802970b7c4c0401
-
Filesize
6KB
MD5f64e66b211c10c5f9140c710fc1dba86
SHA1cb07c7caeea89f31b5c4163c09eebf2c330a9994
SHA25623ef3f74e9c90ec55b880c9a3b0799d3daff30f2aa26f07d0166c2ffbdb2c866
SHA51287dde8822857c5382b29f99b26abe15678811d59fa22e571cb00c82f1a021e59bed5205b847738d4e0c5a66b2f4eaea292a0f14c41f1fe2ce6968db499ccc411
-
Filesize
1KB
MD51731b5717c1ce4a36eec327b819e6e71
SHA1af3339cc4b4ef5d44a70bd26b8c8ed30fb5992f6
SHA2562caacc3edeb777fcec9310be9a1b04bc682562c68bb9c646198a96142c3fedbf
SHA5126c070ac5fa1f7a9cc8f2110dfdd940e076d28d08065ec4a5722a281d0cfc3b8bb4c475630e656de1117430f174d933c824c2e22c4553aea8d6e1d082314f1eac
-
Filesize
5KB
MD594e3b24366e3faaceae2583c84668c09
SHA1ea70800d14a0d3c15fc98ac0c4b1568226d637d8
SHA25607e8d69985547e670f5752809928fb887516ddd67e56d24c1323b4abc88723b3
SHA5125bb08351d4e875d929aaf216af2a9a39277fdb455d7ecef7f3a68bdcd4de977ce782e59ca85a4f5406fc68b30b4c879bc949bc44ab271b61ea75c70ccf6838d6
-
Filesize
1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee