Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 10:54
Static task
static1
Behavioral task
behavioral1
Sample
8c268f16761104f94a878642427dd427.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c268f16761104f94a878642427dd427.html
Resource
win10v2004-20231215-en
General
-
Target
8c268f16761104f94a878642427dd427.html
-
Size
23KB
-
MD5
8c268f16761104f94a878642427dd427
-
SHA1
c00809eb4842a7eb095a06f264e42dcde17f2297
-
SHA256
dc6a8183d6c75385734f4e2b694de337e9dac88a33c3f3fffeb57ddd71f7a293
-
SHA512
5765ac4f0d9412c5ead2646921a179a0ac374a8e58dd05cd427d70484d8ba77f2f38144cd56b87907b041d02c04cfa0a13e1f5a2ebb56a8631529086718897b6
-
SSDEEP
384:+hl8bdmkxiOojo6sLguzBY6ypjx98kDSUAQ2sIpeKsJb33Zcmhrl:al8b9Mpjo6sLg/dQsJb33Zcmhrl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000004f4b8dc3d6ca75fb77c3a0782b112d3781592c5c91e1b72ec6cf86247421f58e000000000e800000000200002000000058308fab6fb0070b34cebf0be1316389214a01d216194a9f869aeaa6adcee370200000007664db2848ac94c749ffe493c8a9cf125beda3c37875fc76992c2bfc2aa31fa54000000010b48a80707af190e23eade9de917ae63fa75a632a2c11c9282c3eb4d9e3cc8cfdc52b3637f924981bc1380f9a58b1cc4cca0d347ba915b57916a20f800a2417 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900922918f56da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413119511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b26fe1c5aa324e3c22dd394dc3216d1bec9a964828577a10cba28d8eae248228000000000e80000000020000200000004f8cd54992ab7cc90f0423937bd228cd5d8ddaa20195ea6ed07fd0eca0a26249900000000e17ae7a1f567cb45645dc5ebf6df6a077495d2e8eebea767374b284d7bcc9231882fd0acb7c09522185f27f39d6ceb0e5a7d9f8993a912097901b2e28335917c71f364751353e4e52b85282e53479dd0fe144797e2d35a1d09dc8e65a12f65651c4f66c5b86c02539d4203cd910461f25bae4aea365f0a132d58d9053b0ea90461889fd0cec99382af42fac4024091b40000000a56325c726b23db4c6c4d154eae166f07741a4bb0c57f563aee55407acfaa6db52fc7b91c9b03ab14ec7699ec6b02e452effc1ab28a5e176e07f224b0688cf6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B49C261-C282-11EE-9E34-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2148 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2148 iexplore.exe 2148 iexplore.exe 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE 1816 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2148 wrote to memory of 1816 2148 iexplore.exe 28 PID 2148 wrote to memory of 1816 2148 iexplore.exe 28 PID 2148 wrote to memory of 1816 2148 iexplore.exe 28 PID 2148 wrote to memory of 1816 2148 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c268f16761104f94a878642427dd427.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1816
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52bba2de3ac9db9af24b5ffcb29a16d6b
SHA13425fb2f224ae4b254c379f1af529fe5b7352510
SHA2565c4a30b1abbe564240d514ef726c255fdad5a64d8c1b02a7d9f0676f03796e21
SHA512f25280be609add99e3de9c1d365ce91f93a5252318133d0b494f84eb6cb7220d427934fbb147e22e0a2aace02d2f68021ac8a5ebe7d5fae1605d36139f169d6c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f70b5a9243b9202e9ca52b9e3b67cac1
SHA1c4945a171d89669aaad2830459b20650d06bdf94
SHA2567d141693588f4189fcd44762df749bae7bc066464d009d14208bafff8179ca3a
SHA5123ba7df88ff89c37d269ff69ddf139ca12c7b41f03260237bf61aeeae39885fc7f0c775bbd5196c2518073e13822e7f2ff2ec36b012e7c60e9106fbffea20cf37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eb3af9ac652ce80ab3940d0f9be560e9
SHA13c2404e9c88b1a176bfebd1b2fd4825178370266
SHA256ce015c54d958c7882d7cf712fabf9aef6936c6ee6af85033dc4c2bfdb05b21e1
SHA51236d01abbd22c7140b5bf0dfa9084629cfe01a083a26d16c0894deba7286f6d4fac07f098b204c80e04026ec3081d63dff3af1b39dd0cb6ed59d1a741aea73484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0c4c94d23cad3235d8ce5618b80c173
SHA1128211a88a93be4248f169548f4958d29b9ae785
SHA256570e9151223c55cf298908b424de0616e1f40d11816fedd9ff6fb99c440687b5
SHA512ad813a8828417787a2fd13ec6dbae8aa262d764e840ca3a176e05a700314ddf8509fefebe36b00ff3c3500195f1eb1a35dedf6e86a61e2ec30f69a412ff6a997
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD523ff8cd8c79fed94496eb9a2233d7563
SHA12cbf30c3bc250d13243702b45935eee431642b7c
SHA256f83e5f7e66536552a2cd17d23031921292dc4d0790a2edef2936b88535f0e98a
SHA5128d5e8387f745303c896f11eb1a36c450c83e4128644a2784e526440f3e5ceebb8d6a96a264ea08e6df62e9ebc1882ca172f819c64b0a68204c68b1fb4e62c51f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD565e018b3ff1949bed043ff4c86a28989
SHA1f85132c38c1e24078c3870450f5f3769792d67b5
SHA2560b47026563031c61495a27f8d279c3ad7b2f784bb551b2af3b77d910579f0c43
SHA512cf88c101dc2a83e6f280a58eb5b6d077e3de47c5f122383201a2d1fc4278383b9a6c1249ac92ad1c5d254156d1ce05011dc527922fa05af8491e2d70cfac9fb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c80e5e5574caa5b987293d7d09450f2f
SHA16b102e6b6c1a0f8fdec85cd5bbb5b7060d4dc120
SHA256d8935b0a9d2bb35b364892f3d8a4e3df83fb1ed2caf67936d3de1a9b2955126f
SHA5125bf81cabbea202307b7dfc12f3d46147c72adefbf9d0a80f013bb3555ef1637d8da4d08e02b3b4f597024ef8e2f8fcf925efd761d5305860caa4febed863633f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c58b3efd1329442061c1a1839185662f
SHA1267e92abb36771e240b5f3ca1e60ccab0939868c
SHA256f5158ce9f312e637532cc5303036c681ba97464cc5dd263b931e3e23b111b281
SHA51277a35a4947b6cd9ade28e0c875be60c104b1adcffd0550e5868ad621d623d967d8ea769f4cefb85c8597d32a8418a940887268f6457b3dae6230e01b7cd09a15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d2ee9c03df16ed51d963acc47428b502
SHA16cb9203484ee798abaca3ce45e2ef4d1334a33d9
SHA256008f6e0cf9be360f3b96c7f9ba88cb6ecd928426074fb868bf8631bef0224c89
SHA51295f159da4697f9c27e40742633df8c521d9d31fb1705b4c9401f942455ef5609018cbf94f1a3712b558818cc9230041efa4473dfccbf437d8c6e0a431e25e269
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d45f1ac4bc23372815e50fe795fa67e7
SHA148cf4e5b09ec940871bebd7adaea77e03262e24d
SHA256b026473e39ccd86ba82ff820e8c5b53aa413cf77a6b486bf7d3460e50ea02029
SHA512bc7165494d6d915536ad8d32d14cfe566f3b17017a0c69e398c1465db82893390e4c1ac8793fb64f1121360bdc4a587cf6c04962d502302bd4dbd2a37a79c000
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b484280c9fc5e408ac38e75b50d5a16b
SHA1075366b0b4c2b75016012962245c780c129c811b
SHA2561288b172190c0c38855a88d14e1aaea335bbf5587d0bf045d99f300774ab2efa
SHA512b5f3fd535d993abebbc4c25ff19e1633d1c1d3c0aafa101b3ba0f0eb6a75bed41c9918bc6cbf8b168ab5bf7f238d2a54b616fe1dd87ad37f92247ad37ea91a12
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD557c3969eb171982d3a409a32f5906334
SHA16a67ea8c8f2dc29f7e21e1b2fa6472b8c06b5cc3
SHA256d43f764f4fd366fde5efb35bc0a078386c0e0f4f5d516a6f1d7abbfaecf17d3b
SHA512491136f05167b7d4e2323b9bfaab7a934ee2165a71d1f96d3924a12074911e0a1b6d26b6aedd5422949c0082ce185e062eefb48eb9482d26639271bc80b7d3bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546f7ffe6a81faa3aabeee315ba4a0baa
SHA1519b0ca04c77e46d961b934f1ec6705e3f648832
SHA2561870da9bf112a6e6697ea6b38317c1baa20eddef67b1ec17d798e21ffd0c790c
SHA512a5134894926f13638884af609e7183442f9a5fc965efb21052606dcf7d3721f77d3889c84ca6fdcb5b2bb3ffd3b433d05dcbbcb974a7a8c5dede80955b608cf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da7ba874c983bd484372dd010a611c10
SHA17c5d928549705ad4a0176231e7903c3bc71635d6
SHA25665fc0e7948a8b6af29a0bd02da60933e2123879797e2c02efd92115f48d756f2
SHA5122587283d04bddfe1af1a0a86b02c17ead2504a615e5d0f46394367e50825ed9072dd3efae9b21f812c0bdc4092efbe8eab6934d40f231000f8c1f6e63fb53285
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD560eedd6a2934dc41ab5138dd2474a450
SHA1362ad2e9300d72e23ba4d91ff555c471bf60ad6b
SHA256c523909fa6407fd50b918898ca8ac670741bd3bd7f0f94a8e08ec24ec241b154
SHA512f45db2ad8fd50377473fb8c98dff0e7a21de3d5a625f41ea21e1da23ea7987a608a5ff859aba9453f53a0cb08c3b1cae5043a5d3cc8ce62ece8cd7ba7b3286f0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54e6af26a1e4017aa26f1bcea0cc07802
SHA199a88e70d061babae147383d353c338febf8e261
SHA2560716e154e023a2b7031a5cdefd4fb2b9b05175ebcdeb9acfdaa7f54aa049e180
SHA5122be160ee3a641f282b0389fe796e347c1e18a50b569368675218e92185d3100ebac6a4f680ce37b38f9120ffc0552c949aeb3dbb7f87acafe98545c0247d7bc9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a7d088f791d26a34c34bd6594dc263f
SHA1e031dd0774bf03cbab478b646360f689c403e7fb
SHA2567cdcabed53e19eda8e0c4e6845181af072a97e421d7a4a4ad17fdc0b9e035929
SHA512321b86d16e53401b51a929806fb5b1c65c0729b500b50cefb0a873c5a8bb06819fc734d697e6ee1ed9ad3ce41e4bd754454ad7c813f80e8769123b0439c9d94f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56202d9a93b120f1de70c926b25a9b60b
SHA112b62628426a5b16ebdf20d626b788ca21ceeeaf
SHA256c3256a149049bf87ce2b08e603a810478d890dfe6c05b5c566be8136c4f661e5
SHA512d1e31a56c2f6d634df10a09d95a1a4f12b1aa51a27e4a7372ec384454700f61085bec6b40347543e71b91a110b866c27f852ad4afa9781c9e9348f89097bf535
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50d2af4858542755b6423b7691586d6c9
SHA1548f789f89145ec2b73134de1319c071ed311895
SHA256980d14aa86c4f1e02ebe3b53cc5969c613171467bd93c7d105edfadb74639aa4
SHA512b78d7a62282f8247fa7eb4d33aa64137b7601cce3c26812c9f519735b20fb20ac4b5cc2ac613352c1b9de088e491fb8993a1fc2fd7ed050da83e2ac4f15d317c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06