Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 18:06
Static task
static1
Behavioral task
behavioral1
Sample
7da7d13f4489a0e45858c497934db92e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7da7d13f4489a0e45858c497934db92e.html
Resource
win10v2004-20231215-en
General
-
Target
7da7d13f4489a0e45858c497934db92e.html
-
Size
2KB
-
MD5
7da7d13f4489a0e45858c497934db92e
-
SHA1
b8223cc1ca9ae9860fdbc31dc908256796929134
-
SHA256
4c0a86ae26a941c203df5d7a3b18500460a27cee755f8adbf13bd64e6f9a697e
-
SHA512
c166ff3d98bc7f4ae8602e03dcb5a5bd9495770ee951d7b101a26906286ae344b245a0bd8251e8f08cdf2cd4bcd80d8f834d2fbd1a67f00b3b46ebb1f66bf7e1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0efb3c81452da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb8000000000200000000001066000000010000200000001b862ec4b1092c32b545e4140466c38216cf5badee9aac37fa62fab8b2794b8d000000000e8000000002000020000000d2d67c35f26961708022322958f30eb9aa4271df8b3b67470abe958696317aa9200000007ed26f48675a37d80e862d069e494b3f31bbf6652800eb92df1b0d76737f871d400000002fdf3c9c587b80a0809876209a53aeb94162b5cc9212d0883acb42f9fde9f261f6b65093287fee5299512cee1b590f34e7e0848dc35a8a3cb08b15d8047e4894 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d80bef292bee784c8e3c940d61fdfeb800000000020000000000106600000001000020000000a2f58ab5ca226faa6811f6ae573c0854fab9aa5172a54cec0b3d8fb8bc498363000000000e8000000002000020000000ac5846afa243364f55f29f5a510752932a9bbb22fb265e17e667c0ecf2740d29900000002fcb0b6c06e618fbeb49dc37c1950bd28f74b9017aa8258cca1a7d51e3f3ea0f705bd50d401f39545f51100e8f75394d3ade5ebc72b99f988ecea37c1dd9aca3882e988af929395039cd736395e49faed57a92fa895f578b78248ddc954db8a003e8ea109974d92e2c9ba97b1d597af351b167cda0a1eb025c507cea5a4b62fe9974721b804151e7cae6d024bdd7a2e940000000e606f3142a04c6c87826c303f5ab1b4222be7d4586af33be2347e59172eceb7de0f103d7ce3a59a5f2df8fddcf47e5f49c451c953a86e0c5b67bba54e0d46873 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412627054" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F33FD781-BE07-11EE-9B21-FA7D6BB1EAA3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1948 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1948 iexplore.exe 1948 iexplore.exe 1080 IEXPLORE.EXE 1080 IEXPLORE.EXE 1080 IEXPLORE.EXE 1080 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1080 1948 iexplore.exe 28 PID 1948 wrote to memory of 1080 1948 iexplore.exe 28 PID 1948 wrote to memory of 1080 1948 iexplore.exe 28 PID 1948 wrote to memory of 1080 1948 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7da7d13f4489a0e45858c497934db92e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7b53c774715ee33919337729dae4169
SHA15d2bc4360e9d192f531a5dd73f0177f3bb1f5911
SHA2563c466e8b702e21a8e5a98284ef5f8a6f912a129cf7a43dc19bb3d70ae4128e5a
SHA512b6d10bd5412f504ed672cccffd86f037b67eb099657d6740e2347d2b84eee8c1dd133bc4feed0ce9cbb97e9463a7be3676c7f3ebd17f786c1c0759424703197a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c47bd3719def3ea21153ffac060b4793
SHA1fd480ed29845c4f761c3afc0ad50ec620d84455a
SHA2567dcdf635a067999c390d902cec23fe473acf6bab892d80fca9c89b124b74cb90
SHA512427aecceefe405b02fa88128927a81b5b117f2430c0478c930c382b3958fcd8f4aba563bcfbb13387f9aae063f7f2fea1a0f5182dc3746284ed00af55059c944
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51456f0bd334aed20cf39e36cb40d923b
SHA1f21ee56c99092fcc64c6fc32df8f1667b5881e92
SHA256ba69fb225394c4b791179e28baf5405cd0cde6d56361a5f82fbe99f5a820cbab
SHA512fe4dcf25ca49c51e0ccb11563fd13876797893decaecf2c2a4661cba42e6ce35bbd202bf1120c1449c3bf5b67434a811e0545a1f94ddb8f6e17d0ed7408e1ee7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c02ad081a3478fbfefe1daf068adcbcb
SHA11ed34f36f4770997006f52c8837d24cf1dc88bd8
SHA2566099982d5542331651c4675b581b925b79724d6fbf0ef8ec92c4a62612cd79d7
SHA512f6425e9c0eb50b173bed37afe33e0d0e5f3ebb3fbd88f8494a14690e2565ba1fbac43459ae2fc1a9ecccbdb49f5505870ed4202bacd2950312c1964204e0c33d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a00fd5557cf8639591ad9e1a8e119dfb
SHA1bb1ce540fd7aa17ac3fd0e45ef20bca05d31b457
SHA256a765c9eb8f8edadb5dfed67e67f392e12339da5fa5d4d0d6ec8d2ea28d6b23e2
SHA512aec24cd9c99b3066d309172963019fda0d1ef75a5ed22a19c377b2f95f303039e6666b000dcdf66baf9abc9d5dc1488f0acf646cf092ebfea186619274a236c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5401b668eae1da5b56cfeb9ee74e1a652
SHA108f12686ad15aa98e673f45f77c2c364175d3683
SHA256b55398932d52937af92d088dd90a2372e4d0d7e624a6bc3ea54d3ac6023bb37e
SHA5121203162140800dd2cfeb94699edaf4e171210baef1ea67022f152d190ac1e83321c8baf62ced4ae6e9562b344d2cea5b95088abb440b6b9d68fe60a8ac06dba7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522144c25265c3e1eb1b93fc2b79ab47d
SHA12b52636a8b35e3dc69ab370eb89d1fd228a648fe
SHA2569068f203f5612421c9d6f8304a13afd39c522fa48c7e3017e55c121c44f7f2aa
SHA512e6e39ff59d94dbf2c280e66adb27b691d99fe494deb77d84380dd6c914d358c06a067b2cd6ca7adca14ded5c94583ffd799d4d48483e17a44e99b9aa8b477142
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58541d55a1b3fd26180fb186bdb078a88
SHA14c212a2afc49b17e7e67ba2308156e41bd9bb855
SHA25645752d22bf662ac1504652b60047f364c1e54f6e32aa6b13dae3c878c2d2172a
SHA512f9707242d24bb52f16e2cfd4431584b5b256aeab1cb65053d6b94adf8b1a87ff731169e8610121b1e1c66cb24c43a54d010dd6e62621c990af3ebe64bf2894fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bb460cdc1f85b0f782c7135113bd8a6
SHA1206727acf720f1d765d35c4e2586d11f770855b6
SHA2560ed5e59fd57a88a3cc5300415893b981e231322953d90c3c1b286a8e2131f612
SHA5128fe4f6b2f45649df4c8c09d320a587121bda9d2e277ca7520b83f110be3d4ad70729301ffa96cfcdc2fdfacfba96f026e77ef2ec6f75c8c7bc3d5ab390ae26fe
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c3cf221a5955ee145341f4e1870d47dd
SHA1f34e7dc64b6362dc54e15fd31ffa5cfa4d68699a
SHA256fa6e5090dcc060a5ed82ec6b144e055ca0260f216291bcebb1017d4d2c42f614
SHA51286ae6be1b85532be7b43cd7e1a933ca2f66477f07d647ecc833335a48e533c703a564c650a975e198a358a694164cf15188f0f50420b4a5df127e5514dbc47ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8db20ae8135b3040da19cb5cf644ad4
SHA1eb4f0e8e9041663cb352b7cf63ad6b88acc56ef3
SHA25669978aa35ff3ee29b53f41b7fa38f47775f1b996112f00428886cd1948048462
SHA512d946f1d6f5de2e90c18dcd696e022d74588aa38b668d2696c5de27be9a78f0523655f3ee3101b9563454d2f4f5792b2fb6f8089f1779b8d1506d9b3e8775eff0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bb6fcc3cfb67de03c52e19e838eb51fb
SHA1cb451ba9e502944650435b4baee6af6d288dd767
SHA25694dc061cd00530b60ec41dda84d1a4cc49d1ef768134d0bd002ec9b3aeffd0d4
SHA512a08be7c0fcac6aad1cd87f2d8e0d092eb6e1f425298f5afd45a90dbf8b04c89d7078fd85835cd71cc6047e51bddec1bd8c242ba61ef9aff17ff005bf3d39a3a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eccc3789c9189b861b8204e458767033
SHA1b49c617fc68d485ebaabf8a9cc6b986ca54f341d
SHA2560cf71c2a46ccdb8e402b182c963f65321c6b40a454da4292f1c70b30a65c3a82
SHA5122035edf219d6eda37ad8c39ebd9cf79ca3bedd21745e10fe9a54bb491687164f380e658c29ab0cfc4f26eb516cff380336a99177a291ecc10459995069becdbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1e96bb1592dea229160a8e1bd75a08e
SHA16b59a0fb2a166e8ce6c2422f328e88d7c43cfecc
SHA256c9dbd638f15de4e968292e5460b3dea092cf5bccada858ddd262c05c73de55c5
SHA5123cb9187c5212732dba405eb66dffb715ffe3b22971b67f108624dfa188465ba96f8f71c20b4bd4d877315e6f0ffc6670980137ebf41727b58ee847c7a800289f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5227c6d77fa9570a66c341838d563ec4d
SHA1014ee35fd3c7efe0765660b4b50d5bae50fcef5c
SHA256ab0086b6ba390934b8c4ca37c8b76c06ed5ca79b891b81e03fa3c39d4c981cd8
SHA51294aa78fb8991efd895674dcf1fc0c0356e886d0bd2e3b435b9763aad311ded9924dce632f9797b5d58fe902c12d32fd3be0d1d563e0b3206a3009fede21dae0c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543734ff6a54cbac960809a99a737a1f0
SHA1491aadbb17c51cc39e749078a230980e8bc203da
SHA2564ae54447dc2ebb40de187f01e6e32186e333b44cc3023a3606ba7b1976f2329f
SHA5128622caeff8c02d53ca8eba4f430921177b436ffb3dda987de4436c73b249c7f5ba18ac10993582792686f755d8b83061b547d6063d83ebd1e4433fc4c0b3e091
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD559929fc4a9017999f2c262582cd1b634
SHA14c36c4f0c92303abd38d29b07be8b87e3af6f4a8
SHA2567287942a06f401bf00c9f1a58f41771c2df5fdb1808963a481f2c88ba2c2e20f
SHA512c8bed75f9bfa01b01855e31dcab7968f607884f469d9080e0611a3f8d708b0fb66ee86fc45f36d202fb2b4a02dbd0d970ee9df6ec35af22fec8622393eab7cc7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD534e82fd836d7299a4f253ae3003f8cb2
SHA1da44c2e77f35d40fba9f6ab0d464aaf8733edc70
SHA2566520913cfd22eac9748df47c9db5f7b664de8c586b7fa81c1ea0ea16880e242b
SHA5121fd56af0a5bbd6ad5a4a66b92678d9c26dfe0723cd8c2fa93c9a4b4f903621289264fb9c0805c6908c9e1c4bc5be5fc75bd2f62e80cb613632350892a9ddafb2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5804fe5596d6426626aa773e59ed7ddbf
SHA1e50e192fc3aea892a70e19cb1f1b213ce40ff4d8
SHA256d4d89edc064ddea2bb3c441b7fd9fc832af4a63a6f7268a6a1f266867088915a
SHA51249001518728edb1bfc784e50462f1910268a186d23087a6b472b0db3f7f97478d6762f5c622868f0af3dec65e0439e5370f31c674d2b25a6285d36c8ddbb5378
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06