Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/01/2024, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
7f12562d3229e2505c2cd28c93942633.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f12562d3229e2505c2cd28c93942633.html
Resource
win10v2004-20231215-en
General
-
Target
7f12562d3229e2505c2cd28c93942633.html
-
Size
7KB
-
MD5
7f12562d3229e2505c2cd28c93942633
-
SHA1
d837bfbc4c1854c6590bc401854b412f29058e4e
-
SHA256
dd7166b959e5c05fb9664807c645fa9e6797665c9d12cbd1d2a7204996ccf5a6
-
SHA512
18d5c2288a204a313bec5985336ddce687eecca5fb0da223fcbe22c340efb9785523ef78422a2e18ff629da25174b32af5b973d97bff3f37d21172a4f457da34
-
SSDEEP
192:SI3ionxuIuuz1hMF36olKGmNvfu046uw1aPveJ:SIahuzfMFflpv3u
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c000000000200000000001066000000010000200000004453d242708788f750a91db7f027d3a3184e4de76ea2edd19c421758f60ffd18000000000e8000000002000020000000c2f5c0c611799ac3449a3939cf2b49b5477114f3e806a75ec9c6acac946aa5a220000000fdc4681960e34f501264be69e2051fe018ccc5920011a425d25c3bfac873c7494000000081708062dc609a5cd4d2a5ae4ca3bfdb56c7bc823770e8e72fcad9813d33e7332a25e7eb1da4f50a274c84eba972c8dd093461ddc2c0ce028f1cec70fdeb1915 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F66F0891-BE6B-11EE-BD5F-6E3D54FB2439} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d048b5e47852da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412670009" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000dedb485909772f2d88c329f2e9a80e88c757a464e3aaef947e1976885db2fd39000000000e800000000200002000000051433198229d0f8459b4511ef3860d0a93314856a77779fd0b69e6d165fc52e090000000b865380e140df2caf219def215d062d8570a973a0446411a315726de6fc782490ecb8ca7982e03126b2ce8e7f72f251f9bb11b45d6ad69014ffee2d6033d6a8371de274959678dad9204b202a7978e033d76a4ef9361b902d96bba66fc3dd002d6a786e4606cb47b9717bfbd6a94100bdc83a50c418dacb527898793e17e3063c0a7fd705300de1162d785718377eab24000000089a2769964850360f09a31569908e6a3e6e04c7a8b786619eeb82b88d58e1260ce7b66b889311d22da0d7df037862256571bd9f03cb62834fcc2e45edfe3cb3a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1656 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1656 iexplore.exe 1656 iexplore.exe 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE 2740 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2740 1656 iexplore.exe 28 PID 1656 wrote to memory of 2740 1656 iexplore.exe 28 PID 1656 wrote to memory of 2740 1656 iexplore.exe 28 PID 1656 wrote to memory of 2740 1656 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7f12562d3229e2505c2cd28c93942633.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c228f0b2842cdfc0f3a0de8e107c6125
SHA13fc18f6f88385f42ae78ee6785d132ecaf7c898d
SHA256a5498fded7c05a276b5008e0a4c38664840ac255a5d90da2e77914052b6eded3
SHA512e4b7a1b2cd3e0a9622cd1af5ac1b7ed94f4e23acf1187b5aeafdcec73373dbdff53e0eea11de14ec519c7f75f77a4f7f1b78bea0a611b6ec2aec639dfe854577
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2a1a1a968b58250b5bf9926758a7292
SHA11f60c92d7557dd6764cf7d8695a12da0df349af1
SHA256a18888984c6147608d51f72a7146dc27c4058aaafdad1328f1a8a1fc642aa8a8
SHA51229a5748ab81a2591eb01a0c7479b011a986328afd46f3ad38246b7bebb8d44a672f0eb65fea6029c38ea97c59c8f619eacd2c706cb3a1b659518f11483cb42e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d468e5128f6a82ea31704f0fbbfc3195
SHA15115a67026c02ee8f4e1c1436198fd5dba7c3685
SHA2562bac698a30381ec7917f7de7f699cb91e192e665c8d581fe9e0e0ea15f9077b6
SHA51285dc60ec6236b3f9ce01ddf2d7e8770e324ed94955103b5e23ef3b9916bd43c4d5d24a92089ac81d5efa8e4874a66b681be923ff8917e8c95ab6e5f5ab075daa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bb0dff88fe75f819723019b63ddcfd1
SHA1491631935f101d3520d0d6ec1dbe1b8e34654c8a
SHA256f143b151dad4dec168451daa0af07ff9b49e9c48d1b04fb49f42f1482524a754
SHA512e92b1f55f3b4121e8039f04ed72fb234d89d8fab09fee93b980c77f371cbf199867efb54610e6eaad97a5560fd93c29641616f95951ca13000fe471c3242c9bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd73e5607a2130c76f656aae2e4616db
SHA11fc14a31f82ecffcdfd88195f8daed0b78357759
SHA2567c1e3ee893e260bb45ab7188b81d27efa6b672c13af78e01a94677f80ce7221e
SHA51259fb58afe21b2fca6d6ff37868d54e38107ec347f8efa9aa3a544ceb58048b1acf86aca6caf57a4a1af36274acd55490a1e1bb1a23f61d9110a1d9f7d131b976
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ee7cddf8b993d0307b0c53d7dff13fef
SHA1da96e4ffe7ccacf35b36b4cd3e6e1d8faab9028d
SHA2566a69c12a367fd334744c25536aa0197ede9d7505ea2444c5fb05ff0b4232af8b
SHA512754c2eb7532856320261b12c9fb4b05f57be18d69a2af022da2f9d90d58b7dcc22d74306e2df428aaae7e32943e13febbfe0ac08cdd96d329b342af156d1066d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2893f4461085afb5e9a7185cb6161a4
SHA1aed83d420bafb4d001253e603387647e76d0e63f
SHA256710b790b2663c5ca73b478b84f70f8bb4507396de81e5cde4b676b05706775fa
SHA512c5b6bf7461edbfeff6de3d895f69276d49e1c9b260e2e0491b5a26fa9bb61d00a66c11f64b8e6d9bea87fca097ecad2e2fb0b1716c3fcd9f56db5aa16739baa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9ba6868840527da6ab49ef7e17a64a0
SHA1e2689294ec5b7bdb49291305df7888be4e22765c
SHA256936487bd9351b19f17b7b0b40126e1d74d5fd6047f876c461062fa63d37b4367
SHA5128e930a42ec89d9c35b8a068735c10d1aa2de1790617c30329ae2fc26c86ea1225df5d0b586fcf11729b9b6da184abfc7ec0ac8df62cc68b71eaaa7772eb95a7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1fe0b2270af4fa27fc8f3e072eec814
SHA1d3df75114562d319fce54391e5f0abcbe9f5bca7
SHA256676df007c7bc69564706ebc03b00c480754b80e6ab34b9f069f627ce5a00685f
SHA512872ee8cff9fae8a3c54182ee949f32722bb25db64cf046aac24130dc341a07d0df295946d4f90bfec298cd77ad03cf8aff7932997513d3fef4871535717ddbeb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57827a231e1ff1b7385c002a679182599
SHA15786da11f5a11cc157b4c7f376eae7fe78503a83
SHA256716b94c4d2b45a66816f62a2b54a6f2acb0393895bbd318c331c7fba48ed4192
SHA512bfd19676ae3f8a40b93c367e05307c50a336fe0b2d50ad0bb70cd7de6c3aa22181919660ae64d67e93c81266a8fe7a60321deaf92267d3ded232d2f4a2778495
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c6e6c8a216a28d2e451b7abf4f35b38
SHA10326d0f90bb916bc1295e7544f390b3f7097de9a
SHA256d03dd67e45d038cf52e52215e82afc87338929eb22d85e0e61da4297d74660e2
SHA5125f99e479b7c1ed2684593fa25be29177ffed7bc487c5459d55f852eebf90f13a61f0912566450d5c32f0b3b366fe403c1dd5475439c1ecb8c6e323c1080ddeee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b630cce999dbf5407d454d45f0542c2e
SHA115be9b540770065980e534ddfc62fc7f08a0ddfe
SHA256bd97b0560202d42fcca3406ea30ea4a413d20cced162b6133d21f5b9b3dc20c1
SHA5125b8da8383bc671f19dc677ac8e77e9547fc74e76c6fd264d547024b488d7a9a32c75fb3b5cf485480b27104717df74c9c9e6b74c8041591b9a52c40e71b70e4a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b66c73b0d519ba8fceb3ae6da93f403
SHA116da763dcfa8f5e515392b2f9eb55120b7ed6c5f
SHA2565296544a975a2f9be3ae842089eb518a5128bb80c0bd79b37cef1f47fcb6d7b4
SHA5122cec244c70c3a8c1d63bd4222058a07f8a7e1238e4a6f99efd3d3ea2c174ac9f5d07de88bf13c3d016020cf422b27942ddaecaec9f667dc89d21abc4008aa1f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573902624e422555bef138901dc05406a
SHA1ce5f8a9be3751eddd6363de310cf76610f2e48ab
SHA256c5a274cba5496a0072a3eb695ebf091886adc350ca1ddf33aae4d8d52f82f57d
SHA5125df4c0fa74b585deaac0822b9bb480397c89d633e50cb04475e3b9c3b175dbdd6af9e500c8f084862134074ce1fdf22fb2515a27eaa35a9ea3ebf6805700b299
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaf9cc3f09db314c0402333069928651
SHA1cce3e50a76c866c8eb4217fff8ef4c67626129d6
SHA256d0f45b079bce7578584782924fc221b91244b0dcbf1a9f7f058f28169d9fa772
SHA512f5d4f31af267dbb538b95b8c2c31ff9418ffa6917c4b1eca5801b8c746fa33f29cce802fb41a94a94804993aaf72ddc3ad4a84527de304fa4eb496edd842d043
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afe90b5d0724052871466086f31ce2f6
SHA19cf591eac7ab1bed423a848d708f2ae7858d6e93
SHA256ee649db8f23ec461522fe773fa3c701d55f27b4b0722a5302bbe66fc9c02e588
SHA512fc90dd16902cb3ed09004657a9dde2e92d300402f95736bb633220f039b19399b7c312de5225a2ed25d357f6c9badbbe0901740bdbfd213fe41049ec9f01c868
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510484d9273a486659ae855a00ce57447
SHA1a6972da65e7c369ad3ce2ec622a3547bfc078051
SHA25669ecd8bfe58ef9a17632655d04d567d7df880276e68afeac5d6cdabcb5a738ca
SHA512573600a8eb5dc870e3b5267a2efa25edaa5da21926e6c252e81fc4dc7d63ddb2523fb0123e24ff8d56946db420ee856cfd1312d17dde89eb17bfc4bcf4cdbe4d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a35a1e4941c7701f817d7985db7cf266
SHA11540193ae72c72d3e416990b6c91a912514339d9
SHA256ad2ed7ff9de186044239e84c5ddbbb18526f03f38fa5a1fb18b009804e022bb0
SHA5121847d803ec985a1e7521db071550dd2d2de26799acb669fff99b04ceca9a3ca2e708f1e542281a98ecac52e03fadec5b515af5feff7eaf748aec1d5c1c2cb723
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06