Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/01/2024, 21:18
Static task
static1
Behavioral task
behavioral1
Sample
758ad25d3c707d59d5aaac4cdab0672d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
758ad25d3c707d59d5aaac4cdab0672d.html
Resource
win10v2004-20231222-en
General
-
Target
758ad25d3c707d59d5aaac4cdab0672d.html
-
Size
110KB
-
MD5
758ad25d3c707d59d5aaac4cdab0672d
-
SHA1
23a28585312419781fad18c1be5c68af4cec67b4
-
SHA256
fcc722bed87a51acbf11a36664c50f478e6319412f2b4e77c609f8aa06d870e4
-
SHA512
06fe15e630217c9d81e9323a831c8bd936c77677409b653bad1b2d602134a807bec458625f19688d7a1308409f496e90de2825d595f84a392a28369e2b83a730
-
SSDEEP
1536:ei8ACwcGE2gliOJ1cUTRYfCZw7oE/f7oBNVcNaKQ4u0Lvf/E/2:oACwDOQD7o07oLei0LvHE/2
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412379407" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5AE1AF51-BBC7-11EE-8DA8-6E3D54FB2439} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2144 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2520 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2520 iexplore.exe 2520 iexplore.exe 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE 2144 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2144 2520 iexplore.exe 28 PID 2520 wrote to memory of 2144 2520 iexplore.exe 28 PID 2520 wrote to memory of 2144 2520 iexplore.exe 28 PID 2520 wrote to memory of 2144 2520 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\758ad25d3c707d59d5aaac4cdab0672d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2144
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize1KB
MD556ef08a3e40e9a4b56c0f3e8524fa55c
SHA1dc5f02ddc5b5bb08b78d14ca32eccd9e9a745cb0
SHA2563b44e2453400e95680ce3f72c7ab4117b4f95b8e076125873d874467265c964c
SHA5123b886471bda1ca4248f9e6404e72a7704ab353a1437cdcebb5009fefef468fd30bbd78dbb7eeaf9e9080713ee2f0f31235b5c2c0614e040950c406b06f17e10f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize980B
MD55d4202859ee0a0a075c6196db4653d4a
SHA17a67050905323da525564b76cb7995c8818d5023
SHA256910a93770ba001faa52e3ef59a02ddd230522ed2a5a272ffd6222aa59b23e009
SHA512ac69fd05321c9bab2cd36436d20f89e1545705f2042df9a5897459f780e62ef78809e72bccd7ddf55298b65299c8817ba31bcbdde955a3f5b1b607f5b18367fc
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5b1473b9d6e644218eb5aab18cdb830f7
SHA1bcf83685023cca4b7244df949546a9646a936e93
SHA25655f5e2a91412fda6ff684c9edd90aa41b921bc5ac3cc6a6bf11ea4f9006299a5
SHA5128c0d72219afa64819453668829d0152ca49e36366871984c413786d4367d9f3684845186e3b4346e0ffaab2638d3989284878e7320be647b260ea348d2b7dacf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58732b212c8d2472e080e383dc5a6516e
SHA1765a9c13d72fcb85250ad9c89b294df8e24ed72c
SHA256609356aadcb335448d92694e2299acee593325c5de15baa4b78be3f34178fb99
SHA512b26aae63a4b2cca14c4581a525a643010fe10f7921edd78437e6f18638fda94335cbefb87d5fd5bffc62daf117ed0faec4cbdf44a693a69088ed7f79d8755dce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db177ffdd153a4e3199d1c19a9cee20a
SHA1776afe0d7864205c7fa5ab4c374819432b9fbc11
SHA25632f2a0bbb75a6495a045dcae077b006f9c63a1accf05ef28834cc57d838141c8
SHA51249b8e5b221daff22fee789f1a1ab8f3ea911ecb758a0d8794b20eab898899138a47fe8a1383b8e73a7cfe886942093e61ec89dff647d1edc10ffb6c8bb74bf50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58287b2e090f0fde4a7fcc16123705ba7
SHA1a812d9bb0894e30cbda9587ddf0670055ae73515
SHA256e446f6756bf1af59e12dc3a4518727abc566e79c311c8a03e94c949e314710e8
SHA512a747d976e7ef6a7ff2cddef55f35eacfa7b43158e6ae504d739b0846057c84366851352092b3029ae43acb77ffc9a3f3776e5e40e6b1c45ee9f888063a2daa38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548b697f19b2cc88c8e5446fa6e8b8b04
SHA1a9f796beea761ffaba3433dfbe9cb1cd3581d907
SHA256aabe7293db96b8dbda34ab42f460d4566b5a368ad361225d7537c5f2ab28cd55
SHA512bdfa98990bf3763d61e2c2b6460699d003ededc98db4a08e23d058bd0c7d195e98ac16e015074e1ef745bff8f71cafcfc4e245f4f4cabebded061d1080e9343a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f385bad7e21deed16b913cd9856c283b
SHA130faf2ec5c380c15d35611ed8e3fc2dc665f08d4
SHA256ea1cf159f421eee3c018b6c9a6783506106fd933c97d27e88543ddae995566f4
SHA5125369a7a0f9070f05cb7101a6c22ef4fc1f90773e5b6f038a2ec5c9c1b4b16e63f692644e309c80b2f0eab71e5e66e479c1c1b0f8a53ea9bfc5234f28df2efcd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579b63f57b2c811a9a100b441e905b862
SHA19497ca20a5bec76c98e6373666e29a401f18dbc3
SHA2563c4e67db33b3cd7d26063adf640491163dda012594848c80937b4617eae9ec76
SHA512531e60893f6994f67b43e07668a254f9f3fe7851bbd34f41c3c803bcfa676ad38008d9ede754fd6c3ef75b2c322ef07d5cf3bccad6f4b7de1d84095320320fea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e04910d601693cca0f6d1b941dbdd6f5
SHA10ed5f485564735217439930646a7c88c55278256
SHA256a61931596a36133aea0c337363b2666df4fe9c4a8294e3b08ab7d50119e0d0f0
SHA512890fa22b79157185221a6ee3e367b64ae15e345de82e582ecfe7adf2912f8202fc4844ce1ff38ebf7010fea64796176fd25a93bed22bc5cf25b333ea4bffb83c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da16e20c9a9a0a542386a5996fa3df10
SHA11d529c52119588ac72e36b79e3934adc29dfe173
SHA2567b23d6450e62958840fc47afa928a69612269ae76d75d2e33e992744372d633e
SHA512bb660632abb4aa696104fbd7cc0a22203b4c49701df8f5b79193f499afd4814787f78a1654892c6a678648c447b77fb5e8ecd3ac6d22b006f748054e3972512b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c35bdb5ac0baaff5418dd2ccf60ae58e
SHA1995c58e21e0bc5ec925237149d488d0949ee3cfe
SHA2564dfaf6d000aa1d4d61e8de0402e2f8abb2bc3a61a01cfa561bd567adc5bea800
SHA5125face066510fa49b6620ef53bd04cbee70555bdb4eb6b859150965c0c6688cdc2da431bb07a253ea6ec781c39084a6b4858e735d2afd91c7af92893c5124afbe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56fd4aa71ec68c0f1833eb4f850d75c9b
SHA1a79efcea4fb6655a3548a99aff5a0a1d66a077b5
SHA256e137da516ec1d33d0ff8fbe640916e0c8415a61d8b877c4c913adfa01dc9c7ba
SHA512a0bdb5977b6e1f33e091f6a7a49008873887a598fa4e8f243b0e94320fb71062e98f6f8418ee48eb9796fca2d5a783ac2d7bb0e69f8a93c924e9839fe232f132
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501ed80532d63628895b56114f0f28f67
SHA1d52883a336295c465f038c668540caf86199a093
SHA25687ed93bcb533e0baa740c0d0160c2d49d632ffb6dc77277c2cea080d75fb3457
SHA5124752f14a6a3312ce56d82cee4a94c898c4d7880de89d0e98d45c3fbe3d8a8dd2bb42eba82927e289ce068f72a05a94add39ed49970437c4cc2217f66277de768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD549fcc3ada6841df5214efcff59900c0b
SHA15940191bc17b56127ace2ac6ed3a660e66df98ca
SHA256cc19f72b6d56ecbf1017093cc2cf003be4e2347c5a2920a2e8da0f9d575f8429
SHA512c53ee54dd5ae0753ab58cf43345383635f47c3ea78df27e791f6fe66fb319119d70bc2204869b3829f3ae7257c87dd219cfa8c8dfad0783f99ebc8f11d847441
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_89854CA6A0F0936A4D2ECA78845CEA25
Filesize482B
MD5392ae3431c28676668c90a1f46112bae
SHA193efb56fee5d3787d1cc25af22c1b437cdcd287c
SHA256be57dcb88261cb0f76526eacc966497c944d37f2f9728d35c37f81ff9c8eb97b
SHA5123160a16b120fe688001849a6098c3fef8ee168ba4f06d4e292bec98b960bbd55152d0633c02cc209e33a55982e328621eeb83b4742ce08d271d1a962c12f04bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD52d2a49935ab10e857035282d4a0c948a
SHA15b8e827e8c62e07375463ec3a116b10fd6a3017e
SHA2567a9dbc2c11398a1c07adda07072aad3bcba0a139caee2e2ecd40bfdaf3228aea
SHA512ae0e045337b258f94c5b03c17a0cc589ee51a2b484feb9e2f23a561759b9aa3345e9188f1eef8d0adcc8261924689ea9864bfc0f5e5d0620c0352a19940dfaa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D0E1C4B6144E7ECAB3F020E4A19EFC29_B5F77004C894173A10E3A199871D2D90
Filesize480B
MD50403326f71327acd0a9a66de355f38fc
SHA1cc31ffb88129122a7fc0df190cc4403bc17fa213
SHA2564ed4152631fee4e92ec932156770fc732f48c949beb30c4780e6bf56e966dd18
SHA5120ed0b0f69c7e43b49fb30a69ec5dc316ef02f938cbf90ac1a0187405ecfbe76dd5ade7ed5558bee87654b2a486e0fab3c16e93363dd9469913b5c71fd331ec82
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD58dbcfc7570dcaaf618b64815a932c975
SHA14c320c10001b08aec8b9b34c848622f1aaa7e408
SHA256f500c479c14924411ea5912675e533e3aad47eb503755068d84dcec5d9e5d8f5
SHA512e28fca4189f9019a3e38dcd3c2c33b5f2f09ae645ae2590eedc1074b3255dc523d318c1e443983526155e5d6d88c9ab557699bb5e0635d226049c0536e57899f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFLWQ602\js[1].js
Filesize134KB
MD5df4fa47c1587f4854c42ddda8ac1628c
SHA1324daf92b73cfd61b10b2621c4b5d3e3cb0261c2
SHA256c38d462d49cce794cfd2bc3382fd0d9a24af7a2364ac5c805ecea595c8253dc4
SHA51299d40d77450bc5ee47352fb7fb1608e977ffddb5b98c4622662d20235b96a9135f52e5f95215e90852972af7c80f44000e326a5da5e9ae7b3ed7d84cc210d18b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LFTKP12M\css[1].css
Filesize360B
MD5f5a5517c7f3460add1ef9e85a2f8a251
SHA14acd08eca2d795015473244e007fc7ac2fd65cb5
SHA256b67624d841d9986f09f2d35da4ecb669594c4b44200951693f793f74bebbbfc0
SHA5122063a15552d5763fa4d03ee8f5b7ec30da30b9b042689c897671421de2ed837e8f82f14e8ae4f71999661ed6b11830d0815e5e6f53a8e6acada272dcd555cfd5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06