Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/01/2024, 12:14
Static task
static1
Behavioral task
behavioral1
Sample
7236b223af52e209b0f0884bbda32680.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7236b223af52e209b0f0884bbda32680.html
Resource
win10v2004-20231215-en
General
-
Target
7236b223af52e209b0f0884bbda32680.html
-
Size
4KB
-
MD5
7236b223af52e209b0f0884bbda32680
-
SHA1
667284a357541271ab7fcc192582cfb55b36077c
-
SHA256
6fdc0fd4b3bdda99be638774b218a0cbf2017ed557df77f85fe14fa87c093c9a
-
SHA512
2307e3a079df79a294e6b3847b282b5c1940aba1c1f79ea0e3534491901ad1b2ab3105be6691798b4c076d67207ee4ccfbff3fcfc62da12329d1766e41a4c3b1
-
SSDEEP
96:rf9seakGiwLsvfpFFOxUEYvBUqsOeN0Eg9jag0MwU:rf9FaL7LQFIaDvBRlVEg9+g0MwU
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000edd78094d60afc8ff5abd407e512d1775d595ae208e7c563882f5ae9e544bb15000000000e8000000002000020000000ba50d35cd3bc10e1088425477aa7f401d994d16f4045d21594e5c515a7ead98a9000000073c0c7efa4ed27ad38eb86465dfecc14806c1db6004715333465ed1d665e6c86cc700940e032d27c26379ee5cb4480c6096f3f4a1cbac02dd0ef2c4de815695a582cc75f453ec174cfde466bfbf3574e609f97ffa0c157214bd66994bf6dcd6c80dbab77698593c5a3e84264647c1f5a72dfec23d1dc967643c13cfa487c0e9f7ced0daeea742a93dd6e27acae9741e4400000004cae9cc4ea5a07f0d58761046e394200aafe194fcfd542065e0571f5d3064bfdf8c98d132b6ac790cb2432ad3a6639fa75520cd49592eb19348b9c457d7f86e2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000020db709e0e277c71c8c73d17fb2a27c846011e266f66b6057a8e58d938232d45000000000e800000000200002000000055afbc264f95f18097fff58468a622ffc162a3d8f44c5388237ecaa0e7c2875b20000000cef3e18e5545c92c2febaaa2c083b5c160443fdfe098b2f9eb11cf23a80f67cf400000001f0832e2e5487a2b61cb373076e8eb5cb726a7c8d9688a572a27feb8ce18954f5bff3b060e5ce686c2e9c06550dc7892f808a47cd39241628fe0388c1adf1fc5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412260338" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{206FF811-BAB2-11EE-9295-C2500A176F17} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a04e5af5be4eda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2484 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2484 iexplore.exe 2484 iexplore.exe 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE 2660 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2484 wrote to memory of 2660 2484 iexplore.exe 28 PID 2484 wrote to memory of 2660 2484 iexplore.exe 28 PID 2484 wrote to memory of 2660 2484 iexplore.exe 28 PID 2484 wrote to memory of 2660 2484 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7236b223af52e209b0f0884bbda32680.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2660
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df0d50b1499037307d9049af02345a35
SHA1ac4e82cd79212c0729b98a04f808a1cc78124d73
SHA256c38e74199ae2474a31e666dd79c77d375fbc0c0c272573910014a84a571d112c
SHA5126618b040426fa54553d0dcb36ca43351e835859a2f5f0e6391e629daeb196f369d0e78a460a9d678ad145699d2a524dcf11f0bacbf261b3079a5ecd1fcb95cfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc29172827895a7ee24777b3378efbf4
SHA141ec70ac746682ab892fab971b31a4eded5a9b39
SHA256ad7a10a96cad0ed3e40d3b21fed6064b4230eb036afc2289c4b1418d0542222e
SHA5122acb86e3b7ac227017af1f1036259cbf8232ffd7d846d7d1648ecefcc380d1a7ef241045b811ffe56507bba6bdfa8f974bbd17ec762b838276a8206839894450
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590d4c0f068e976d25d6c95aab169b3f2
SHA107922f24ba3aa3224d5fdee22bffd33d9d1818db
SHA25600d4a02f93a140776cdfbbae2e021e4404bb6b6d0b4e8ef11fc4d233f660553a
SHA51287099c20a2fa0ceab051569388083de67fb073e90bf084613f8f60cc20be1836c142c7a79ab275b8a0fd07858e7a223f25e89211b91179fc3982ff69f15cccf0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cccf31f6de74c35c60578a899d57e333
SHA165212dc5ccea95b829f878b06339bcc8299a6731
SHA256c1f8f17101e40460025b95c661256464867c5b533f765409597c35aa64f117c8
SHA5120fb02270547e729b06e9677f696cfb24d1a2219ee1c3e9bb81a22b67b400233c7d26131377f943a0134157a1b672ab54c0615da2d2bbd254abd82e320df2e937
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550e8cc3bf916fe58cffd956bcc628036
SHA1d6d825676d70d306acc302977f4654e7d9bee411
SHA2565a698abf14cfbd974f7f4dc848c4437eab7083439a1955f44ba3fe132c363e92
SHA5123eb3fd59a31a13ad45f41cbccf0363e97473e73635fc116dc50595b67ca54fa31bcfa454b6a4832c1e290776a1a00d3306548c305b1d6ed4bc700bda4abf30eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ac67113d924e47f04374b3784b6dea7
SHA1970b10b2ece5642cb998126ef95c950ab398452e
SHA2568c746d261ae492efd6ad0fe76578cb8750d56f4f98dc591b3bce68a43b162a75
SHA51260622f330b577c44205b949a9f04754d970eec7088dd49658137e0398d0989e9cf5d8dfa5c2f9e3ffbc074a32a1b5a46d73a6bb6fd8c8030e51b5fd20d160fc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5187b2b973cfabe723ef2ea9aa65b2ac3
SHA13630a2e9d9cfde7860bc06a4a967af25c7febbe9
SHA256e33a1a6069b8b0047e74a95683d09dfd6c8977f1e590daeb192ebbea11952bca
SHA512dd84201914e90fa5792bf04efe6cdc3588bf68d3f1c8f81b7574046b259ae9fe72f7141eb1c2a945b88ee042348a3578c947b4dde7e44733423f34a7be63f55d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5168a49082005f8df57050a161599dace
SHA14d60b0ebcc946d62a39ba9e6b4e11f6f143135f2
SHA2562506ad1bc966792975bf22c9c472fb3b07477f6f8152ea2d195f34f09dc06c9c
SHA5128e70b354fe34080d03d12e44e9756e2969473fdaf39a81b3d0c6fdaf1c59c4f910582fd08d2de8a006cb776840d6d71947fce3513a353bec4f5353f5a33613b0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e7a8b8a03b1d21534c7235dd4bcd21e
SHA1a0ee8043c52d1ce722028ca61433f6304fc2a3b8
SHA256a348e2afcfc22d0cb396d15df7d3aed1279ecb257516d801820945f0f76515b6
SHA512dc9c4130554a6dd875563c0095bd978f0c9af24a9af9da5994a06f33ababce4ac91874afb89df994f28bb9c63c5931850808460b2fd4558773b361d99739b010
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD535bccd15906e1b59f7f207a7f0f7895a
SHA1b2ee03a45398fe7ef717836a3f54f02487a95186
SHA256b66342165f1ba24a5767a0334b4af5e13c90e9bd409c5346fbbb8bf9747fe386
SHA51254a170f5b8dfcf57ec5791b2554039252a6d653a8c4bba0b38838ffe907fb2de7114b93ddc5bf7f4a5082de50e57e482eaaf044d0ac4da3d44a00e75ac28fa79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e8eb5d06f5339ae71d155dafe43fb63
SHA182ef11fd4e7a6eb3bf443a6db599a4ee4f96f186
SHA256fdce679b071bc74d6ab4edbc31995d7b3853a360bdd108e5e693acb892537184
SHA5124c28865335cedf4cb5ad37785340f559d6f1b8e5e6941baaa7dbf52ddba5ebf2af6fa022e98f01fac26228e0c3907158bec109edfce83b73ef745e8540b4dbf6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ecc3f1e5a63bb56365dafebb934a53a1
SHA14786a86482594c68c0f5f8529b422228f9196ac1
SHA256e042081bd0e5c60f8fe03e02cc0438686e140a67c8a057cea07d408afa3528a4
SHA512f1e93a4a4fd8906addaaa43463f3e1077f80a96d587868e4a34e45d57eb28a3d3ab687e827bf89e021cdb74e7c0f8296e0ab5c7cddbafafec31f9f8fee7f1b56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d6a214bc64c2d704bffde0f6162e444
SHA1365c01985823caee2b72b4433a50932127cc608e
SHA256349537b1df2fb550c46f0f151d4f60e5ca466fafe2604e107b4c293bcb69688d
SHA512f841fa5b9161185a594b8799c2fc1ab00879d4cadcd2ab8b2b9f447c47882ec03bf02f5f71481abce6291400cb5987ddaedb5ecdaf58467e560a554397e27ce9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511987f7c09047c0f7ec90d080822ba17
SHA1f1807a9c4d2413badf1a79ac6b09c5d07f691da0
SHA256c3b1cb958221e338abf9b25b494719f2c85928ecb7b1257fd1b34aef9d20186f
SHA512d2a85201368a1c54b2c7dea988db164c21e03e2a2b2da46bc544f1e0b345b117dde4809fbd71d17baf36c6cb1a720eedb4097bb39100ee5beda2917e36c3e592
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5015b544c1210b18121a3cd094ad16273
SHA11ec8a4a7725fe914f595f3a8f3c1cac53cb34ce1
SHA2568cd29ebb365d9a7430962205ae385b3ad0eda3fafdff4caadd276823c698b2cf
SHA512085a5b07967f6399edddd8453866e617e67bf195a41f3c191d33c3e0a0d75cb8cdace5c3530deef333c800d8725af1e0ad41b1720bba9eac751306e2e540b303
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aac98294750ab1ad4bbf072f522cea26
SHA13001bf9691b5f0e070a463f92269ceb256fc28d3
SHA25664574b1dd40051ad737c9d64f6631b5aa5cbd4f394d7c718d70e6c10b3cc0e5d
SHA512790c3007b54fb22c3d9489caca3469771b8d4b44f74e3ff943f93637502da5b60bc460084ea2f19ef31faf3c5f7b39415d8256fa9c6cb92a2d745bcfe30d8f64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5196e561c41b46eb234d76fa72b1ba5b6
SHA11e8608f5ea6dbfeb01b04963fa7eaa3a29cdcbf1
SHA2565950040dd271b464a3fad8962cff0f3997886bdfecbe201166f17d26fcb983be
SHA512e92d853de4bf462ffb09fafc3b7c7014ae15336e14a4c2e8c017dadf95f282b3eb6856cdc62c1b304cca5f4bce2ae1ab9468011523c9b81464b798b6b50a7e82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b0b4725789c30388c7e7f40a8d47b92b
SHA126fa844d7200acd73296483374fa4aafad4dbc62
SHA2569759a92027d7182538de49ee66f697f0f31dace29f72149a6535628e18370718
SHA51250eb31e8cd75ae3d53dfdad0932b03c1379f853da30613125e68b93552c7ba75eb1b1d3c3a8f9bb9b80942ce39f8f92b68b771962a74b0d92baa018bef63256f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56be52debf72e07671ecc37d6446494bd
SHA16afd4a6a245f2d885982e589d3361b03f5be6638
SHA25615d17e8a2c368e817ca8b706ef534e9624ffa3e808185f46e558e72fd9977aa7
SHA512fdba189d3a22bbf3a528c15b0104ba7610604cb26731492807e5e9c7a6cae4dea83ab32de6821a60434a1f3955f3ae8e17cb88a1a1eabfc291706403faa1a421
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06