Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27/01/2024, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
7989dce12173cdae3ba72fcb36fb0db5.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7989dce12173cdae3ba72fcb36fb0db5.html
Resource
win10v2004-20231222-en
General
-
Target
7989dce12173cdae3ba72fcb36fb0db5.html
-
Size
6KB
-
MD5
7989dce12173cdae3ba72fcb36fb0db5
-
SHA1
091445f61cf276a026ce1451319c6c2a98701a27
-
SHA256
e4fba35b7fe20133746f8cde146c5ca4a7d109d9518827f4760d9c2c1c21f2df
-
SHA512
5c65f70a7b3fce8a6b7460036b38b09877854880217be603ca8f7bc19470e10aeb16634e62bfd2b68554b69a7bdbde38948b56d6addab6d807b5fcfde182dd89
-
SSDEEP
96:uzVs+ux74VGLLY1k9o84d12ef7CSTURZcEZ7ru7f:csz78GAYS/Mb76f
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{121F6B91-BCDF-11EE-A80E-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000022568c4a7463a439780a83039406e0dc72aec9a832145f08f080abc673c155c3000000000e80000000020000200000001275e9fe90defb0ad394d08e91baa5749c678ebc5724bb7332003b9e6873cefb90000000df30f37a2dd7bfe97c40b903ea520670038122aaf12d3fafd1592a6d56e98ab30b517ecf419cb2824adbcbd8b0d29b8749e6598b79ef382c4e040834e554587a6309f9b0f0bae21c1233f8289cb22022dbe438501cbb28a64eef5405d82e68b8ea824f3d74c74d24719295c235912b0db61a0de6bed5e052c8987caa1dbb4f86296bb26c0d9df84598c5d216374259bf40000000e52f1cd1b2d0359f98800c92d5ef932f86cdf1a769f9310f85ae6bce6621d10c991d48dd72e1ae58706fa93be7cc057ce1716c0e524f8c4e9f2022f8393615a9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000e6fbb789a553a9c666228d36f496d62336ef3b113a40c1d47e0a011ecc425dc4000000000e8000000002000020000000644a04d7b1d4c39029bb60588843bac73cbd463cb409be834dafd184bb2554962000000084be4822c92e559116ed4ca650c2e77278276f7b9d3b13474e01b45b349373534000000097bc5480aca73c3d5022f93853ef548b69afcb996a46f47882fd2b6dbec5c398212b823412a334f1338f78c9018f24c78dae0c3b1e4d98ed4af395b4a59c1c21 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80ab1fe7eb50da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412499543" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2148 iexplore.exe 2148 iexplore.exe 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE 2616 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2148 wrote to memory of 2616 2148 iexplore.exe 28 PID 2148 wrote to memory of 2616 2148 iexplore.exe 28 PID 2148 wrote to memory of 2616 2148 iexplore.exe 28 PID 2148 wrote to memory of 2616 2148 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7989dce12173cdae3ba72fcb36fb0db5.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3d47656958b626f622b2df698815f74
SHA1812a5d7c0ea7d60b3b0b15d6e59b047074b98819
SHA256e4ddc06c72a746c008374a1ef8d9571b5857b6eb8db92e9edd8fd8cbe865f609
SHA512a9b8da038ed95649b933db7791c588a36a92d2190cf1ccae3f15fd2ad78a2f7ba569799054069549cce0bdfb7f302291cc179494c740133cad01e03c6d6e75f8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c99a419a48770316d52eca00612496fc
SHA1cb85b463f8075fe9c78ace2e0a66625174d05c83
SHA256caf25970a8b6e61ac925d4f569d88b543f0bac2557d4b8a16486e180ebfeb119
SHA512b065ed1247d394a608c055799aa79085ba272ebfdad769c79f8d9220941d8dcb914254741dc370df3233612425a1a57f521b09ef2289bf970b74989da23e23c8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5898fb8662a0087edfa83f0edf3362f93
SHA1a2513bd5682b8d3b406dc3b03d2442d6e3f8661e
SHA2568e841046772335203a15b57569984253e992a2fda3f4aa187d9ef87a51b21d81
SHA5125d689820c854c6b216ebcbdc92a37750415a6b24da68d71d4e761d4774f478439aad387ed722cbaa13a85d0df6a8ca17f018704d8c99d6bf9cded33bb06dbc94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c53aa39eb36267783714e490400d0e45
SHA1371bf24bc08cdb57dda6512b9001cb815e459a4b
SHA2560deefe2018f2f6f2cbe71ef25bf49f5f04f5dd91d3291ea124bf05fbc5f2ed44
SHA5128b56daa04fef9191dbe1884b1c74bfd74e6e68a9d412416587ef5e1d8ea3bac742243c30d5821298b44046948314bc578d718b8959d590fd668c76c493784693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a8517c018fc94b915267cfdd4a932db4
SHA1a383bb515c5a88b1078494fe3a40cf6eacb09c0e
SHA256d025c987c15cf062f13a23b4263438d963ba2d939e5562ea988052dde1880d7a
SHA5121c22d8d85fdf8990fcf56b5db86f455cf66f23c6fde67fc04da01a3efc427ca871162fad288a2bd6eb2fa449815ec5b6b95d6cfc8f14f851c402a0701a216503
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562adc9bcac6398cc351f0daf0ad92d34
SHA1ece7875917d3120e8c023195c43524e80cf15162
SHA256359fb8da57ed95aeb1536d4cdba87454fef32996e4615b31783228b2e6eedd62
SHA512b750908ab2582696e6c1e96c255a615b07d87af69367456a97174833c1206e7d20e2693b92dfdb07e0d73520a1df6232442dbefa53e04a6c2bdbabcd28995a63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56482d6d7ff5ee286b1bfc25212f12a3e
SHA1aeef6762b6ea89e5c1337d6d8619d040243d3d02
SHA2567cefaddac849e05d24d2289289d3335d3f0f0fc51333ba9ae3823ee5bd5d73f1
SHA5121fd1a64e23289e1df05861543e33a8f79e3ec1a26cffe21c6013caf4284103fd8dc471fa52924a8979be03c1c209abe520ed1782a17ff227db3b3f104aa5bf85
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee54be06b9bda69f066575c73f8b1e63
SHA18dc2ea83e231ae6f8a58288a2cd06dbc77711843
SHA2565ac8def8a21431093dfa9d4d94aed969975a3426a7d2cf10819bc8b8640773fd
SHA512279efe5413ef391b33c64b6abef3ac38222a3ac80898b4792343956d66ee39345b6dcf398cfcc5ebaa4fd1058e51127f91d19ce5ed3ac471200906d88dec186c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e5283722f6c4f30e4c9eedcb263884a1
SHA1fed45d24d3519835c8ae003334a67343928aa650
SHA256eaf347e58454547443f3674f93f195219efa367e9371ec1f9d5dd255118b9234
SHA51227f7787faef62a1c49a2140722d8191b80b7a0c70dcb0d4260c6474beb9be94c40f050e581a56e8d16599bfe37403c075a003ed6996f01911f80ae59301bca3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b9b86d24219cc7dbf5f9e48aa9e92af7
SHA1fb69ce93942d08d2655e269dddd913473f024b5e
SHA2561c5f81d860e9e70f1f617dd9c1dfd76f5f390f9c10df403f511f48cececf2e18
SHA512aaddb0661826c9a35e53a36f35381eb87170fc99cc378615f48f804851cb8f09da81d73e5f82741930edd49dd9e993e93a6dd7237752ca7a12ad5240d60c9e65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f30dd3872dc2443a88787d1fbe03516f
SHA11786e2be8443fd72ba2484908632141688fa30d3
SHA256828db41f8c78bb9eaf8788f96577252d6372ad9917485b219df4fffa8f9046d0
SHA512aadd1c457d76ae53f0a527877d82647436d17c6d403914dd7792fb84d9a082d500c6f7ff49ecea0602c1b26fe55aa259de339a3e6e16d600371097628ebedd5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565e0e794d588b4edd286830649c62f89
SHA13120928f2f247c80a4acd105120db28f31af82f3
SHA256c17a267e5e914a02365f7f8dc7d860e51a5a485b0b24601aa8396dadd66919e9
SHA5129ff2d657e76a27035afae4c327cf2926a93aea357d6eecc43359eeef8a16d1da23c9f8cd7b407143c765ba882ec17d1d9682e2356f6cb1e1bbe7fb3bd419b34d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51184d5f35c6015bca62a91d05ce187be
SHA1355bbe169fe50ef16ae053239788fb69a888b0c1
SHA2565c47f3f0ae65e8b0ef3bba0f71abb67a88e002b5b2e9f5dbe81dea41fba0e345
SHA5125a61bc66bc9d6b89d774e08b9d31e5c9ab0ae2b66f51795405dd0ff9fd3541e9983260f6760e7579745d2ccd4e08a2e20316ee0e63e6ce8c0d9fc0f5a561be78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ac203b412f5df620cbc0500380508217
SHA146d4e6a39e61bb1e5d5b3a90295db4c1e6c62f96
SHA25637ca3879cb92cd3cd0c54b3d3db492140bfb10459ed16f7ce0445b487af29f75
SHA512b205f202ea0cef01b570c8a6a8af35086b1ba785950577e938da83c1e955325f584b3c1e81ab16c589c2c8dcb23ec42cf2235639ec715c0a74b10f5cd2c7e14e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5711812d0fddb7a68db57dc1e9bab7015
SHA1a3b125b4a394ddf50a8b6467766ebe7ca0503d37
SHA256b2d72f1481cd0de0f5099f7a72bc46a2041e6f96e556ccd5690a673b02b729e6
SHA512ca3c61394a868ecd6cd4e9cf41f811f85cb9dc918d04cbb1247856a973e4617236ab46c6dec8a45f17bd5ae2cc0e27348c78109bb07e85ce367597ac3ea368e3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7e0657c86040fb3ae3ee9f6d1138d85
SHA151680a445f94c9280673b23a95984522784784cb
SHA256cd0c6fca10087613c5e56857c3c85900fe0d3b32b8877bf7485a9f5587173e4e
SHA512a86a605e219064b50f665b3a1d6a2c430a09dfa6d1f61e174e64e8255c8c0b89833a4356666bd1fdd5b37b1175a6c8450cbb47eb233910c77ad5c41be266db7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc54a8e6a37118842f77dcadab2a8938
SHA1f3ef1abc2fce8359c267d2f215c2be4456f971f1
SHA2569978f7bf79297276dcde1fa5ab9f7963eebdbb1940cb4408bd60194f8efdaa62
SHA51213a3b1f94c8df2eec34640fff2f5e2b770bac21030504d0c4835bfc293769965bb62ea789cf6c83d4a446305c3557d4f761585da66dabd3d121231e9eecf0885
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4aee2302cf8656b77662d6d4650d952
SHA162ec845da2e51bbe3b17343a343ebb3f039b4ed6
SHA256c3d258e1e139f4fb2032e9024fe134d905ed8f1e96513b93bd5cb43507421699
SHA51277243c6a59921e3a18e4fb3e63b7c010819764ce403160006f3a8871ca6cadc1cb8ba82e08a3920eb2d172d20d878c240daae6da9d599a3cdcbfee2c02fc9e5c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD564f4bfbb1969aed6cfaa46876304a788
SHA10ca20fbee8fdf121da34ab19a10b901b3821fed0
SHA256dbd6cd693f922e1a53522be84c9e0619816797233bc84bd9467c3757b6a72859
SHA51218900ea20820fee2ea2e50519f105b2c6b53407301c61b805cb7c565014ea72b5149984ba7171152dcb7acf8d9addc94ab6625a431d7ad8f253a592bcc1f2694
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06