Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01/02/2024, 05:33
Static task
static1
Behavioral task
behavioral1
Sample
860f906c8cc5d76ec3a201ed341777fb.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
860f906c8cc5d76ec3a201ed341777fb.html
Resource
win10v2004-20231215-en
General
-
Target
860f906c8cc5d76ec3a201ed341777fb.html
-
Size
4KB
-
MD5
860f906c8cc5d76ec3a201ed341777fb
-
SHA1
0bd801592154fcfac71cc346b40b02b4ad8e9444
-
SHA256
e269f5d72efc9ad1cf9b8502d50b948773eafabea31b3cc01e85fda3381d4fd7
-
SHA512
14d2d5f5527b98abb68223c58f3f9b7d13623cee8a304526f76d6b548601e7c977eb5f90836d93278df7e7e122016ca31ce700d7779c91a85c8db6dbac0de8ac
-
SSDEEP
24:+fSY8ks8m2VTGZIijhVUTlv9Fu70EwDL55gSbY:+fbk8qZljheTV9zJhbY
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 409ead4fd054da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000d8f1218e37e34347e1eff1d91df490a3c89b0b0dd02ca75a7a8beade4e8d096d000000000e80000000020000200000009a66415df0db34663fdf695376b05c79c60e37888f1dad5d95c60c1091a03861900000007b07c2c32ae74c3628a2924925ecbdd8161b6b7e2d6db610e55dfcf7c46a2caed931607b9de6693f02d093989ad104e5fbaa891646292ff02b22f9ad7f4fac1fea2d70a186ac6ae4208303b7c686a3660b50a99c5974843ebb558d8ed332312f3d514aa0f1200104be8b483309b19a780c1ce67ce3d6bf6cabe241c120087d28f278bc735f750fbd5fb4b072f5339471400000008285067f4b46d8631e7787005c4f8137880fdf37b84657f0afdd260f04f6a01771f1c079f4519a1a77635974bebc324032b3c6d7c9af13dedddd0573eac733cb iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412927498" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a4f48103dd6aa33e8af113b9d1a9602a4b59b29f2f9c70524579a23c2c697789000000000e8000000002000020000000744facb11f9eaeec7d0356f15c38e05680611dd26633589ef74e0ac0aaa4497c20000000fc5a9bbbaa93719ff8493320a4afb76bbf8d5b622a360921caeeef89e1a8c691400000008fbde9041a0bced8f6c59180ead8fd9cb0109a08369cedd67f6cac14a7bef9c928166785d66dbba597cafadd16fb44763c32bafc3bb6c109b90e38fab5394764 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7B2CA071-C0C3-11EE-94B6-42DF7B237CB2} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2052 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2052 iexplore.exe 2052 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2052 wrote to memory of 2700 2052 iexplore.exe 28 PID 2052 wrote to memory of 2700 2052 iexplore.exe 28 PID 2052 wrote to memory of 2700 2052 iexplore.exe 28 PID 2052 wrote to memory of 2700 2052 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\860f906c8cc5d76ec3a201ed341777fb.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2052 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c1aa58368dfc7a33c4e2d0fdf4c3d3d2
SHA11e40d2caa8adc65942baae81890e37dc9333bfb7
SHA2563e20dae38d7da3447b67fe2e9b6256ee7343d7053495d08f9bda0e92a0bb6a74
SHA5127c2802874010de9237af738bfaee5f370d9423d5bd470a1bf45fd014b68bc6aaf6c14b34c348f7c982f6f71a0a7967b9afe79f9a14eaddafbb8446711a96cc41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe738267a6fa8d527a921320d19b33ef
SHA1acb9a68a4b967eaef503bb4f6ae009642a710ada
SHA256dfbf04bf944496db08987da89824d8a3616fd1c76502d9314d1002e388093d06
SHA5123087e9e9b79cf185397d940e043595eeae5906e03a0c4ebc4df1c090298537656c59b39fea39306015a987eaebaf59465b00a09a6386746b509f32acb64b7733
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f76d57ea642eb5cabb62c607bfaea1bd
SHA1192af2e077da4179553edb679e5d5752a0dd27a3
SHA25622dd61490b946689272c21dbf99ec7ae25b1a4df2f6762fe754f0ec15a23be7b
SHA512cd12604b1cd27ee4954dfc395cd8214c7da2c512a4ff4e1427691a228997e4a7a9af6c8df8b84c754972cc4402d48454aaf453ce585a6b7e36e7cdfe7700bf4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530e312c0e78f46ce81872bcaed07ea2d
SHA1b735e158a8ac90f29146d788c01057477bfedbbe
SHA25669c81397896acdf925d59d1c50a37922579ce10ad92d6e13ddd8394487245662
SHA512c057b5bfd751dbce5dbc0680e77be2f29e537249f40f601d6d6796e08cf32aed57ae24a3cdcd3c23631d7a9d89c4e4a9bcfb653dab73d2b4d04b61efc8da5973
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5665838dc23ea7ed296814f4d94bf954d
SHA1577c33462ab405358ee703bef363d44f8072b94b
SHA25694b844f2ebb8c75e143be58c6914e3098deee56848d341fc2c857e59141d1d2a
SHA5120e9011bb6f5d8a3375d3438c8bbefc711d14e129cfa6685dbffd4fc6f4e0e6141447ad296287a2cce6f169567166e81209cbc77411d3940294b724ae27c7fe7d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fbdeb3eaa07bc524ed78eb1cafa4892
SHA12a303ca5eece7d88d48096eb9007bd0a0aa1ae0f
SHA256e61a760df94b4a83bfbb4195333e5b1513ad39aafd74e350e2060a940f8955a0
SHA5123637bd8cb74644169f8d036abb46dd9a12e424f3d13cc4f636f35721dc42bbe03f34d2fabb86bd66cf42f8ff59bdf898a6c8682586818a6a7ad40eee96cfb548
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a0a32effa023fb3d3a011ee204af0ea
SHA1d048206d4ccedd7c0d0f33bf9f4975d66a25e68f
SHA2562d409038582dd9f71fc6c7bb20e91b57d97200e9f648c3f6b2fdd90663f78ec1
SHA51262c97c290f68d6dcca6f2cb64c7d9ed8d849f380c2d0a81034209ce98a7192287bacc1fd870e4fca53333fde6fb51a80ce2b320c468533c2f86950a3a880b3df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59b9dd86cf38c97c610a075f4d7beaa12
SHA17b8577279e92304a434ea26329fd6497283e6717
SHA256f20e3e60e60e611b11dc5e7f9a5dc12f51bf2fba791fb636774b4e5aff231d0e
SHA5122df5bf04ac6304c7551cc4b00e23547fc73e8c686f4d35d2a816fb79b2e78622e4910fc4356218102e340582e830fb48d8392b68d497a9a033b496c2f4e73977
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562a18873c0ee66520edc180b2306db7a
SHA1d3ac7aaa1979e5f1408e119d2c15fe5942e81cee
SHA256ce7659908cd84979b125b17ca7f9c9f72173ec6ae37232217118317d3edd27a9
SHA512d54166496e885589ed5318b541286e48fc4787dc3021b22d9e066e3c050e9cadb00b941033427e98855dfed2f8221628ea3e8e139011408da0ecf6e468b843c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d8bc4b39b69b7bdedd37b1dd38b215a1
SHA1053abdfa7b1c85c74cc63b336311c322c74f897f
SHA25664a3a3a4c994cdff71ba91c90808ade1fd36ccc94b349a0fd0bf84d1b7e5c15a
SHA512768020e77e8a14f5b4ab1b6c6651a59dd18ef958b0b03fa1358234ad261e630b6e4fa4261b177a372db361d6f0703d127f633711898b2f8b64ea72f861f18348
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55acae3b5da29efaabffde7427cf9c682
SHA1bd8bca7adb23a0a4ae8fb03f7adbfaa5c7030db7
SHA256dfb080cdcccfec36fc27a7c001e631af253cd4ed7616f7dc83174034686d499d
SHA512339c55cc96b301c586cb13b975093b3510b42871bb18f09bbab0afe1db6ea0e4a7e9db0670b7f5da352eb55aa93a7ca6f7aa16ac21311a9c1c2a773ce65bd5df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53fa68c6306a29be3afaeb47c5429f206
SHA18b50b0e6bed5b64edda8d622d87e556fef91c221
SHA256eeb03232fd050e2e714fd1efff734532d4672ff7fc461588a49e3644572be00d
SHA512bd5ec5e2dcec19bb8ef8dd717ec1ebdeb1d02836ccfccfa58056a64702757e5b3b2111bb030b59775a476cd18e83e98aa39e7ee663b56b81544c6dbc90e105b3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8f0117b26fe84a2641402d145568b44
SHA185efebc5067a5dce43312e468d54a531a7708cb6
SHA25625fd7bb0bfcb100ebf2b3bf395715a360be9fe95a94b3031cdf948bb77e534b8
SHA512ce45f1f274d521425273dc419f2c92263ec8507c010576394043654e19794464673190277fffec6ac703f9996ce863e68439c2e3e29172d82575516c24ee3ced
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd67e6701fb4a806ad86b0148e413ce9
SHA123333a99ec92c4b518cb5e7054a04953cbf73f72
SHA256dadb5f780f81c7cb37b0128adbfa0db4ac7db23df077af359a871b47a63fd865
SHA51291dbf185e9ed473fb5fe24fa35d2420348876835e46f695b6382592701c7fd3593da8eb133d4545c72c92989351ba8b576325afac4c8fa0e5e49319fc8baf8a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD575c160b0a31dd8c2b34f6d6f52200aae
SHA13163326e5fd2feaad94ce43204223b75bf667899
SHA2569e983c779ba2b81599408094f37d01208cb915edef762f112e150e3ec53d57ae
SHA512aebb6bdbd9f873fcaf188d60f6e9777a751b7f27a29756dfb5510fdd0d587c6e96bf23f934a8fa0839a9ba9e62b461ed6691b5abf1653ba19b3ba69e61dc0c91
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f50f172c1650d9312075199cd6c5606
SHA1f643bb883434b52caa870f594f94c6847b9f29f9
SHA2566fe551c4ea9bd2564bcedc245c5511fe358d24dfaa97361564a99c846fdbe815
SHA51220232313d2f074f5e88bdc7c5c2e669bdd6eddfe68f2a2031d9532c11d1525a3505a65049ee91bde2bccebd715dc0e3245b8678235b16d09d4aa865ca5f663db
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58b70cb7bdc35c8d5bfee8b471c409e96
SHA1c8e7a2102e890b5b7c5cb3cd8e92a5bfb03a3f48
SHA256363b6c25895fca56ef7c5d204e452d6922d9a8a6d255ba909530899a415a1bc9
SHA512c851aa7d9754655033ed7943d36b3c515ef1b107bcb3da58100036b785c3b6410a494918b30674a0985be10f1086107c60c52fad4c2bbe5718d5b8f9d3b5d44c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5572f19281838b8085afdd323506f3b59
SHA1265d557e3b402080b5db0b7f08aaa4c88cac8340
SHA256a1b5c3abb31631403c5e972ec58f1262fe10e0db83c84d8d228d7dab56bd8be3
SHA512b346e693ce5c90869a71c13c68568640116cf6ea0c935e8c346b87a33608fb3e710c971c0af8db04e5278c4d081ea5dfc5e19ab36c97777c4219e4baa179da49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e500eea61ad2f587f4aa288f81d19d4a
SHA1eb2f36a1496880ed6221b0016754d9c27b2c6a7a
SHA2560cba99ccb74b60f6e99c141efdf7e997b6bc948b99905fce894cb455503b2782
SHA512eb4755be3e6f4546ebae205d99a60a7fee5c7ca8459031bca14a71e7a9513e903daed118f640582c66b0f240feab07489eea6ba1ebf9b6162ec5557d8c947a15
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06