Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
882cec43312d47fc054dd283e28d862d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
882cec43312d47fc054dd283e28d862d.html
Resource
win10v2004-20231215-en
General
-
Target
882cec43312d47fc054dd283e28d862d.html
-
Size
1KB
-
MD5
882cec43312d47fc054dd283e28d862d
-
SHA1
d6a7df48aa7c29afb70cf28d714420d36ffb4831
-
SHA256
efb0ac3de177e2d5837dcc47e4b3d7f665fe7e0f2b7b30db9b70c3fd57a2826a
-
SHA512
7abdb96fbd815a36344b6ad6135239ccd4949516b405c5494629b648da16860bd666e790c06fe7e3538005755eed8d71b37869ab6c18b48f73a1ff63444e3b4f
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E4AA0A1-C169-11EE-AE81-EAAD54D9E991} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000cfc4575ade6a09266010f8cfb9ebf232b581fa71a8c5050219fdb9708607749e000000000e800000000200002000000032b5caca9f6a6ce1a954a8f8021d894b1577cb65d67c85cc7207b5e93b4625a020000000fe2eeebcc979329e8f610f34d437023c8b280be362899c91fce8b277fe9cc0e440000000418c0c0edad95cca5444abdca3e0b5576acd8611716a995c4be255bc28cec49bc85fb233198b165931d77271e40efdebfba268096ff05abe598d7a5f4b084c49 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412998746" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8016fd327655da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000061abc7770a983eb28952a2de7300b07a2986fd6125c8a04403688c1d2e8e283b000000000e8000000002000020000000f80501e51380cb9c7153f58e2d562f86c507b56c26bd22bcbd171c0573ab6f1f90000000f2426b712e22461a464b73003f4ca31919e4e82c44a9587d7f05240a76d590d5c994c67daeebae939b99411da5aeb73270629339e658ff2b0a4dfccba5bfa4c8a53d43e159806f3838da6a38a35d2ec35848ff45b704b08463ca0790263c089b60897e58bcd2e3a691a5f9ff9f5f976a83357d47c6545c1ad57c46a04bfda5a805de07ea4edeb8428c7f9e1994632cd04000000083266a8ddd00f3a049d2dbb96356fa37a80cc27cac22715d3d400b2e3f4c8c60fb6d67b6202fb28adb0c2e971d56be0a8f0e45daaf220f827cdc7a305a204f4f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2444 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2444 iexplore.exe 2444 iexplore.exe 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE 2600 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2600 2444 iexplore.exe 28 PID 2444 wrote to memory of 2600 2444 iexplore.exe 28 PID 2444 wrote to memory of 2600 2444 iexplore.exe 28 PID 2444 wrote to memory of 2600 2444 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\882cec43312d47fc054dd283e28d862d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2444 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2600
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD562f37b4cb666bf0550e4961b87914345
SHA1339f1bc6ac3c1b3d50b350f0143e8d0e4a920771
SHA2568632f077226e75e7a47ea9f2fce85c6208a450bc9e2cb15ac4b8e831ab9fa77c
SHA512466b46f1b8fb8a558707cb9ec324f880a72c163c11505d17c26bf1688cd17ff7ce1a44e1875dc473ccc11f9364fc725df30fd9e292a950551698c3152c4c7a99
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf4fefa78e75d6e71206dae7babda924
SHA13e8582268364f3dfc0596da68cef7d7eca92f259
SHA256326bbb6cd783dffc43b3996257e5ac3cfa11f1670f9e3d71da19c0037208bd40
SHA512d48585e7b1b8a9da9ac58a8c678ae86f30c826fc2400d5c204f0e02cfcf72b8a995eebb7ab6a259c584551ca74974f060484a718c3da56d51cff4d4cd7155c21
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5110061790ccd86328cdb829734ecf12c
SHA1f85968638f070b70191ad169dd9d5209f8b92c92
SHA25680d0a45981ba011845ad20f06b9bcb994e3ab97708965a3621d0b5ce26af514f
SHA512e585be5d94a8ce2c679cfa89b0fb8d2f8e2b7722340242663580f7fad8d3c4db15b693b7289388314ac4b1a37850294feb420950d846dc1db19085618b5488eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ff7180727f39e371598161dbbb22186
SHA150ee137f8a7a9242d859bf16214e6678f7868dc2
SHA2566cd8e3654def0d6b4cb5bd2af9ff0ca6f0632d8869dc6f2efb2f7b8d34adec0b
SHA51271ee8bb3f9cbe42cd364756faa384dfece95ccc610998e506230454d524bd3a81388686dc97a9f1cd82ccbf8aa8aed129318baf06cc1e642698aa7e93c708a74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD508c3945d5c39b25225ed27eb7f5f4a30
SHA1de450d662c2d7337ad2740bf5499cf39ac1b157c
SHA2567a3faae91ef8788fcfe589c4348dc8c248a69bdc98316f624583d8e24bbdf8e3
SHA51248e93b19ad4d611672e687cc5dd2aab55ac55af7d4d812015f9eb302de13d8255264237cea9ea6491a20e36876b4e09c1f899d8abb8462a3b53c568204a405df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ba696c08628aeb2ee97734703e5f184
SHA199fb4f5e8982e47efde28103f77a23b920967030
SHA256dbb42ab33f1d91509f7205a8ff2c22f7cfd73a9a862ddc687d56e03d9ea18a92
SHA5120e0a363d2c3afba1adbc014bad41e06b494f7ab6256329cc286919b51a60201dea7b59dd034bf0fa563b8a658d239b5c5ccfc1f38e5db71ee40dbff147674e51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba554c54078024310b8efea0580c564f
SHA1be2d4f5bfff1de4cc45c5f245c3b3b650c62e763
SHA256bc276063a6be516f740357e97f58808c3e7a13fd50832d7893b08a617ccd5d3f
SHA5126cd513e75670a9296266ffa8fb6084e824b10eb1e6c645b9e404ab18d23435a56878167515f0315348f9c680e91727517a5ee539b4394300ca065e89cdc8c298
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc832555ead64f79ceb8d1651fda314d
SHA1d62e57cdc593cc3e5c5e0d6d978bbef0bed15f5c
SHA2561cc161ef02f5623309759a066f6f2563fd2af6bba27e05512483008cb11d1c85
SHA512e61429ee5d1957150625115756a82b935a78f2b31c85c8c2cbe2fbb0b434d0076869003e39b642e9a67e5c4bd577ecb8f36f9a7f8d3984ba23698966a5c3c3cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad652a6871f53976effc4cdc438d2b78
SHA1520269c0d870b89e42efd0487e5bb802c90ee2d9
SHA256ed04bbaa6daad89e1265c1f1525c47cfdb6a2358b376276b46312b8abfc5993c
SHA512fb05b39b1832f15f9655c55bdd4244c26a630eb74c3ff8ff9c22c804ce9fe5f2d572ac7843f85a9d6627630e645a3b5e612ae7604bf62da008e69561bbc7f6c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eff8166258fa4556e234aeee3e2c1ec6
SHA11af34f9a0fd21eb0c55f06555ddd9a36525d4846
SHA256ddad0a4ee200eea387e55f34d6a337862533ae3a566c3fd7a09b35a6a44accf8
SHA5120e6402767faff94a9c19c60ba57239e8f64d047be31bb352edd491f30313077ca7fe1609c50b807c9448c78f8463f4eda9ce3d70f08bbb8e628f34fb8d6fa6b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57f0a91202799089018e9dfc07e4cf668
SHA13ca7b1480c016f522263a1ff3ec6dbd79978f7e3
SHA2561c6919d5bec31afa845f1b677c7a1c8660940b3199a94fad31d9b97e6d8d73b8
SHA512e57b8fab1190b5531ae0041ebdbd97045668435a64c9d091bf76d677d6a00fcfd8bad6cf1ed9f816552be12cb23a997f03e973e40a85f75ae96521b975971f87
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b82d524fd70f6b12ec53c8ab02c7ac7c
SHA12cf7a970fe4535e27d4fd4719eab499e0a00cc12
SHA25667cd727e05287a3308960ddf8dfcfbeca24350601850292e75fa5bdaab2cc866
SHA512b18c55751c60762ecb0a5fd1a4380a8b4296567496574750ca437ed43bf2d982c41fe3484df6ef074cfaa00c56756335e9852357e428fa8aa152769df8f30dcb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b2fc66a52f2e10f7865605e9b916260a
SHA1e6f67c702ae58f89efe5083c66535830a9157d83
SHA256e9bb72bcc751d7c694a9a3e36b5be009d0ec30ad0d50992243464d961bc2edba
SHA512d023ed090cf13793dfbc13f919c31b37751f66a0ea9f7f02caf02772478b2a4a048e4ac09e50ea0f0a4f97ce74ae5860d5ecea35523af60415bcd03a556fbdb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fe669f8e748cd5b4212e6d68508ceb8f
SHA1eb6f7fa1530b27fbab3e12269ea4894782c5f2e9
SHA256cebae8e1c6e14be3a9ad001478c7eb3df593c3895b262d5be900c48236d85d6d
SHA51295e4d8744d7572bca22d9fe2c1717c966a74b1f7045b34f44cef749ece6c6540b25672bc95bdecf34518f0bcad94ff38e349aff5bdeb6175053d01575d425e64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5131bd7a7f441f95ac083d7367ef67196
SHA16db435b53af6f8d0ccad8fc6e5fd5cb764cd8970
SHA256ee899c1a1ffe851ef4e5ba0688950bb21602b5518a281ff5c00863a1edf26665
SHA5125a746a79dc8fa31ca85d36502b9e4ffd7ba922d06574fd65b8bb992d791e4701d61bec02356563e0d4f17903709b640cd8057a595461fdf1e0b4a83fbf9aee45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538f8f9f67ad369084818a2d80cccdd20
SHA1310a1c7c2f99127736d055acc11f52d559f06b78
SHA256c34435346eaafa501dfbe9c87342cc4c5f05d6a46045cf528f4c19810c6531b2
SHA512e6e7fbf84514fb563198222f6eb2e0ede699eca41adf7e8f1553ca95506cb586b3760b4e13ebccb49e81e9e29a95ca88f7cf796d2c503f0c180bb9680b6d3d35
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adb9d777ad86b18ae659d8f2935d7669
SHA16db80432d0d745e5101da550292da866ef404152
SHA256dcbfaa7b32c95e0c8e537d5ac78493793d0615a72a7573e099c3208bc7f31c2e
SHA51287229d9a27c73cbe2aa61bb77382f2d8580aee27089d114cacd9a014836c81516a95cf9596fff90ac00541c7c167aa75e8dd1998966efa452e1c81237a8c0604
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD540c8a74b00ab3a0341555a406754bf5b
SHA187733319f74bf80f7c2885c6c71f6b9b2b8a1d67
SHA25696774d8519a6f7d6b30b179ef0e6259f8a678f1891a3301010fbcf362a6f6783
SHA512193f89d357bf11b87e256763ff5cbcd5b96be495cb203c5c3e1f4e18b429e511129109643dfcf12f73d214f6a628bcaa4b866c37a27a127b96cdf17f7ddbb0c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c5ba8758d421411e00a264d13489226
SHA1f32b97a8abfaabc8e7ff6def9d213a4aea29924b
SHA256b283a7055e2056cf01dfcbf27a3e9bd8042dd188f4051f1180d8fa329737e004
SHA512ffc62b25c68341520120dab791866a79ffa3ad03a394257ac7d42ce492b60b65e7b7202bbb18ace616ecc376eae652efa654b5e3576c23c45d11670a4b86906f
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06