Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 05:54
Static task
static1
Behavioral task
behavioral1
Sample
7971f43e7ce428208a005d6f7edcd900.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7971f43e7ce428208a005d6f7edcd900.html
Resource
win10v2004-20231222-en
General
-
Target
7971f43e7ce428208a005d6f7edcd900.html
-
Size
57KB
-
MD5
7971f43e7ce428208a005d6f7edcd900
-
SHA1
0b898de01ed15cb603c469e2df5f7cfd4093cce9
-
SHA256
dd34c546ff7e75def51c0b44965f822cc6285c88c79ba6c78f045df8a42d415d
-
SHA512
052eba64a5ae66d5b4bc316c0851d6a33ee3915b22fed26e759f5835b51a1d4678c92a9d822bdf8d6c478ba7c2112951404bdd12fd005953b1b9358a1d55ce3d
-
SSDEEP
1536:gQZBCCOdx0IxCobyXDfTf1fqfKfAfxf3fkf1fSfrfkfvfafAfMf9f1f8fXfCfift:gk2j0IxY7NCC45f896jsHiYUld0v6qi6
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8C1E3DB1-BCD8-11EE-82B3-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0040e379e550da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c193000000000020000000000106600000001000020000000ea24d1c0d51fc081887e8b90599263a953e1f338fd5e0d95df06b572a6abcf76000000000e80000000020000200000005f1cb36375b01a362b5ef5fe66f19b260d50f218f1462605923653d46607b30f90000000c110d8a88fd3107862ef742afd249ff5519a940e5721fa7d5a58c1380995fae3d320f8d1b2c4ab5f2aec9358d24f1d9bf1282fd5716c83fdfd782e4c58f8f2de18df87c4f696faf31f4a74ff60fbbfc33077d1be38b5e7393035dacbe2462ba0db3c5940edfe1b5325d77e81e74f5a4263ff05dfed6b2c93a4b38f92f3a95737298a4c45bdf8795f25d895a8153a93bd40000000c991a1d503437cddbb5bd43426dfc00693d8d2b584d416c3216d7817f31ba5a9945b111edf5d9313ad5e2cf14e145f53240930686998eec01f709acaa4b1db35 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a883829c536588438b4279b7bc6c19300000000002000000000010660000000100002000000026096af7481d52a25003be7756cc8b96ad55f3b5ac5f3c49cc03a0100efd05c2000000000e80000000020000200000005f922a302ba889354e6e1cd6baa9cc7d8f430a0255d29ec03f53bf76e3229000200000000bbfd7613b11783297cb98b435c33ea1ad66ab7c17c71645c0c3b45638fa26b140000000ac8408dccb1b222eabb2bc8d99d96abb48cc7d74e9cf09a31327d37abc2425a9acbced88986e1bfa1eb351ec624f3179ef08e7802b1ab0c9162285f644f0eab9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412496743" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2212 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2212 iexplore.exe 2212 iexplore.exe 800 IEXPLORE.EXE 800 IEXPLORE.EXE 800 IEXPLORE.EXE 800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2212 wrote to memory of 800 2212 iexplore.exe 28 PID 2212 wrote to memory of 800 2212 iexplore.exe 28 PID 2212 wrote to memory of 800 2212 iexplore.exe 28 PID 2212 wrote to memory of 800 2212 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7971f43e7ce428208a005d6f7edcd900.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2212 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5219c210256d05d58d3bc7be2d56a02f1
SHA12dba306ea6be9f15743d3be42ebcf36f02ecc665
SHA256c7e435f075aca6fcb5bf62ba9fe8753afd718d5b19adce32832d919c044c5526
SHA512f8c94e5787242cbc59c01182ccd8fdd798cada1d7fca6b9c1c55b05790aa617cf84cc17aea426e7ca577db438e77dc8a08aba9e85ebc38bd3a79d86bab600d88
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562b120babda0b8513d2e4b41945dcebe
SHA1e82bf13231f7a1a85fbc5a29f9dc9d789e4b7e88
SHA25681f1302c9268fa41c433d38134da6fa7a6597ab5fdcce53ed99ad3e27cfe301f
SHA51269e61e510c513eb4ff0673cb68b4953676954d350fcd36dd7361f1961327f8d8be7addcf4df83ef97e6be4a0876d102984c979f22c511d0a5cd870ba7a2d14ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5756f50a022d511e26ea4f271a363306b
SHA14d6211818dccf4a814087f8212bda2f5bf300c81
SHA2561885702e9f68cf17dfbd9c86d54adb6c0b4052b718131ede3c6c85e0a40ccd5f
SHA5124c0155a74ce9794494b4ec94b7c1f5cf6b056a0eb33c10c9b13e21df394864f71501040484c8c8f632ce54b7a1623f7b37c839d41ee8bc45784322ed36f221f7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56957bd45006346f3dc08b5ca93b00f97
SHA1ea400b9403242b5c8ce2f55c7afdceb136d2a6b1
SHA2562c5d9c9f4b573145aa4612fac032cf4055c9926e1e3ebff92f04292b2984b06a
SHA512ea1f1847b46c262070d4d004842edb4ad57cf54da84afce3b88dd43424748e651e89255ee77c6ccd16985f2b6f1bb965ce00e5d30e78e19664245541df050e92
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f1782b72d4b098139b372922ac88927
SHA103f4b20b20951d79b5dc54f8d54e1dd7fe4ed6d8
SHA25664762753beb0e5aeae9e836ab42ed301f0e6abf9fa9b3714183f8f538c7d7d25
SHA5120321c0ecf9e1c877cc2c4a331a4c1bb99891670193c7af8bdc5c295a91f4b4a131b4216ed28f6afb880f1d62013fe60397386c8254e3ca4e728a7d569cb996e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52b7ce93a9f20c19efc56d2008c158dd1
SHA1517bc5d473cf005a19b7d2416d29ed7459ffffcd
SHA256741e197b7b9f9bea4c3b4cd3c1963fc1f3486169c92e4c3d92732dca9bce779e
SHA512f562b9fb446e3289e2f0d612583f85cc0f8f46efc65c3932fe1ac3831a1059d49fb30978493efe24f327c34d64a64698c7900e7964efe2a30f1d5a62a4b39eb0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5456f1362a28576ea5b714c73637083e9
SHA18df6643672aebd0631ff7bf009deaf82f332c7c0
SHA2569b058b6a711f6a5e842cf71d183de7f6a5ac0afe691a99d7db06c60fe5337ea7
SHA512957b794ee00117082ed239ffb1b326b55ed151c8af94e8d7709bd9b2e56c076410f5219133dd2c5404a2e0689dabd1cbfaf76aa164102e32b69dbcbd5314b3f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a187dbb301a2d527ab424bb502e649a7
SHA1f2491f0ee59148ea60193cdaaf9fe2e0153cb7b8
SHA25647f65f83e8db9781d5c09e6399cc4515f9e94d6fb414515368a198431e77c217
SHA512cc5a9b102eca76daabef2b8445b04403c0226eb71e5401156a4d707dfcd154bce05520a52edad5e2fd8dcfa09b52e68e96b3de03246161f444268b27b1fcfee6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f2f56a01ad8dcc20aeb874194a828f16
SHA160d26f9e7112708992aaa3cbdb0acbd8d8bd509a
SHA2562bd26b177c86544529aedbe66864d41dcdd9bb235843da3b619aa154d6107611
SHA51260af5a18636fb30b8f8c55eb43d26e7d2907f8df74f38a6cab03aba36a360c857e5f26ebc7fe384dc66d7e49bb4b52bfe3d0448a9e7d41f862060f446bbc4af1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ae4e0b2a1156a90a21b094c16eb43fb6
SHA11c47e4a06e951192dad6b7fbe47c6a59daa7f349
SHA256fc699ebdd1babd085ba0a86aee1a942e91b1a651f1052f66ab694d53829c6e04
SHA512f3c0518b97efc2f1307e71b334bb7ab24ab517087299bf85407ff4757fd085800f95780a7783422934d9771f163d64d0be8f9f85c31b91a8f56c7cf2ec48a1e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD529d4dcb138795f150b3551b820e7ba9f
SHA150f5d92f7967fb7df3fbfcd77d27cff995316316
SHA256eb808faf72f6e8edad604e7bd4cd977ad29d08d09655ac43f55165180dda50dd
SHA51243e54584548d6f5450df6b118337431a06d7e9724fd25e8804dacbded0544573005d1cfc2ffc970e6490c41fe8c2c65e036cef003ed73d29393310f3b299c8a1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53222194b9f7849a36c69ab6ab694747a
SHA1787b06c431b78fc109e50b344ab88967edd74005
SHA25639f8afb9ca67f75e44f0eef51a854b1ef94d14c703a46990891ea61031fe4faf
SHA5129ab254ad7e256d900cb3bf5df86be161532012db742957862c08368c584e86aa19ef407ff3420047c58184f8fe26ac702843dd215c9e649ddf1f9e71b5285c2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53949a96de595bc2f4dc4a64487826dcc
SHA1c07d085fb368d64f7361fb891dbde1774e9a97d3
SHA2562cbcc2107a1dff12e1e0a6b1395b1124ba761ad207aca64178097819c44703d1
SHA5125136389d647abbfa504b605eeea9612237d280e3171a8057697d5a2c9f1dbe741358a29af0a631c9121125442d00827dbff473c8ce01a834f75b1f1e6b819349
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58c499291f7c7dddb0b3dfc110d4d5ede
SHA10073b1b53a6c4fa76ebd61c8de573018cb0fd8db
SHA256c4577ff29411c9d578f57b726d0b03d952bb247c2d352c8df8b15136fdd9954f
SHA512f732188295c2d10afb52f6836a6ea0201286855729bc25d5fc4bf299af86728f7a0fb6ed384e9386ef0f142be39db283b44d8ac357c2265267d7d4cffebbfab0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a84bffb67abc01f1e5926e16596d3a45
SHA17465401301b088d23c2c8e01ae72edb002760016
SHA2562e21e19cf74cf63a83889cb4372263fc1393823be5927402ef42bfcf4eb9cead
SHA5123fc163e0a721e9ad026943aabec1820ff00f536bed83c1f4c0a65a34484c2826bde268a59cff678911c4df6fe07185812ef7349ce68ea899a6c1585a5b261402
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5beb5edc411e8384fb05799fff17d20f2
SHA1908f1d302fda1a6810a60666be8515fdbd60e5b4
SHA256c36c3ffc1b97848df2b5f2564e3770070fafe87d78c4b5c10b27e2fa7f4aca53
SHA512642fc18c2dbfc7ef7ac476e213bcbb430dbfcff4ffe4633122c2af2ae2161d55719594bca2754976c2c3aa5e18c53ec46bccb6f24fe37af333fc26a44e341359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58716155df1ac8b3c994af9d77298d237
SHA1ea8d994c8b23a20c3ce869dcb9100b8375543aea
SHA256b33712a4df9e2a6f95f8b3631a364a3378dec23586d4263012c5d8dc5a9d0c93
SHA5120f3bbfe09a796879820be0a0e4a744b65b5ff390643e1291a6bad6206aa4c872742c4adde1932889e06a087cb156582ae1738e6543ffc3c480cea462141297a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da975867a86f2aaedb688549c369467c
SHA1456d7ddc9b9719216cf04d4f5441dd03fe4f31d3
SHA256e4997cd3c9ee2a70074b3eacb5451eb22d30570e4f7e101ec25976ed1a67f639
SHA5128f0d198527ae5fb2b92752d1403508b64e9074470c92333a82dd1e80df11df8479e20759ba95aa4ce745f11c556e228c98c265b438e66138226c07a1d8e2680f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06