Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 17:19
Static task
static1
Behavioral task
behavioral1
Sample
8ce631863d24875000bf6da7f1a2069f.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
8ce631863d24875000bf6da7f1a2069f.html
Resource
win10v2004-20231215-en
General
-
Target
8ce631863d24875000bf6da7f1a2069f.html
-
Size
1KB
-
MD5
8ce631863d24875000bf6da7f1a2069f
-
SHA1
d01ec1e57fd6d1dc2cacf95ee27124cf1585c114
-
SHA256
368659e5fdf36c8de087134981f90bfeb5e9ca6cde74fdc0ca6b93c96a2b5a6b
-
SHA512
b7a785242123f329a0b39e9bc0cb8308b367003eb568dc387343401839f530d3faf71b51401c1a0d5773c6c673568bec7bc8c96e1e36768408d8e5fd3a5eb8d7
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5E0E5281-C2B8-11EE-BD3E-4EA2EAC189B7} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0455833c556da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413142662" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000560d90dac9562a55b15192d430e0d8a7d085cc266f9554c07f91c51f1a08e783000000000e800000000200002000000060fe9697953c0f68ede97092a337023d2f0254f8ce035b5bff8b18ca1e3defa090000000babe771710104ee514d9f776861b5a8488836b3bf11ef588f2a863352923e5b5f48941b98d75231d61163464ce063847c65691fc16d1e5dd8d6e8e3043270e1bef21837c34645475cddbe1cbef49199cd92ed65cd6ba1209d76fe583c1e2a28f7492265b7f93afc08772f9b8a43a416f3954e6add82f0ea552481e7bc41f704219213e0909f8d9206d206162b6b150ca4000000043eaf89ebd73cbee248f4011689bb24e040187b343233de2fa50d0dc04d3d0d617976b5e04d5674b3dd38d573fcebdd9c7a326d97ed0cc5bf1995508a5386a47 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f1200000000002000000000010660000000100002000000001bc3e87674320386a4a1e2fc5bb4f146d287cb83ad297996296c558480d932e000000000e80000000020000200000009958ad71111ca819e2c3abcc8f862d09d3cd3e4b9d6282a315867615eefa0a1b200000002e6abbb4fc38e2ababd54a2e1c7e87dc3eb0b25a0f39bccea1a29f882c3832bb400000001cb1cbfdf86a4ae476c6da40e9fe77ed908e9c0dc78c73cbd5475e648c4c180cf4f883b8716c402509ccc78aed18a45e39462e0513ff4039fc004830d9c9f782 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 628 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 628 iexplore.exe 628 iexplore.exe 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE 2868 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 628 wrote to memory of 2868 628 iexplore.exe 28 PID 628 wrote to memory of 2868 628 iexplore.exe 28 PID 628 wrote to memory of 2868 628 iexplore.exe 28 PID 628 wrote to memory of 2868 628 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ce631863d24875000bf6da7f1a2069f.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:628 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2868
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5072c6134545dfe14afe1e6583d97dc94
SHA15900e1d414928d2402ec33dcd71087452e8d7a16
SHA25605189f3936a124d1905786880919cf61f613780aea641e8aa850e8cb3da4f723
SHA51226aacdbfd99cb4a7a3cd534f275b210c9f1ca42ee94af56004f9f07111f84d22910e1daa4aa84a25aab9808156025479f9bc796c14c947fc0533b21764449b02
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50da35d61479d9b670b23c6f6cd271aaf
SHA19591a239dbf03f461d4a715ae2c919dbccf13f21
SHA2568fc468037ce06eada8253a9a6a2edc4ea22a722c37aa9d41ecd2ba36f7328002
SHA5123a490f6c5eff32b6ce0a861692a8f15386b2d31c9ecfb254e61f5dfccff743aea8d091a4124a2a2f116a7dad1f5b0fd3fb8cad3d651006bb71fd765e6e2c1707
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53a5c56a93fc9f08910125e6efc459863
SHA17c93dc8fd745029902d14ecf990f06df9677c9c8
SHA2564d2bebdc3e1558e780c5efb45fad69effc6ac2c1b85f0e05bb596991ccbd70da
SHA5125f11712fa4f12244b1ad25b03286a0070fcd72164fbf2a86c63b1e2df9352f109ccd87f6dc32eb0356c987c9cef884afb1b80ecfefa06829533cfcb20634b13b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54cdba97428788a8caf8e3b78530f3358
SHA19de320c8b8db2429391bfab7eacaed4dd55d5075
SHA256e04ab99577ca4358288cc93b41332f4a00748784ac6d900ba6848331510a5e5a
SHA512c23995b0d686898b32307977222221c93b4dec7af7794344b362a3969ecc8ad27c177ef9fc78c6afb12df521f340c0e0bb7bc1ee09a075eb677ccc2dbb55763b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52c66b69d3659bd72e3d32d8d01e678c5
SHA1eb794179f7eb41bb2c7caf155be344b0691c98d8
SHA256d4aa8f4f59de2cf3d2d2034de566faeab190d3878d82b8e1a3c2afa6db076c6e
SHA512eacfacc77047a13724c723e5b0fbe43f5c9b6cea637f6b0e620905168bf0ec03173278d9a988db02152b48e0a04c4cc15d86301bd315106f2b2a0b3ead93cd6a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51c07e279ec819ac839f49b2a927e8ce0
SHA102e34f6b0a4e0030ba9513d021b946a9c0fcbfff
SHA25661f9bb09f282516362e62af79a3f822cc5788b660bb907731c45c97e43c02a0a
SHA51286178a252f4b347d8bd5eeed78501b2640aa96e45c329279496003e5bf67d4e3d4fdc9e3a1b138662265a9639b1e6e47ef375aa4c122fcf4ced97bf1f2ad5423
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5192db76e5f910d24602f6975ad6dab21
SHA1c4f62e02378e5b85fb5f4655e3749a23c214fd3d
SHA25676f4e1cbad314afd538792ca6c7d63fa636db8024fba5afc25913611b75f199c
SHA512697d996fa5e72b0b29f17bb48369a0c48b951cf9aae5ce9c03b85e17807823419c2581165da4c8e678802a91230cfc66b011b8fbb2c5f314ae83dc411e10bcc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50685e07c5cf379344b4da2efec455b35
SHA1ee7e58851b84eebc76ef1dddd8fcc34e489bd480
SHA25688000a31a7cc6385f80c0b235463723d80029222edfe40361eba2dc83f4a24da
SHA512b5f6109149ebef24058fbcfa88e0f19a930b1319b5b607ab17ccbe834ce89f99b6c326f97139f065f8cbaddd9ee0807c84eebc9b55ddf6166bbd6694f61534e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c248bd897e9f63ef4ab93bb0805c9b9
SHA1adab827499f21670fe5a7ca0db064c6bd8251db5
SHA256a617dbb3c2f4b0437cafb6f35d2d775c8ae22dd30e5d0261ec277ff7e11c78c0
SHA5127eb510583dcf33c72d4f0267c709e1f82861f52f89bac6137bb9f1714e545020847e205b9b66cc0d604604d4e007320faced88a0cd8ac4f9b39154bbe1a914c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5844892d9c58ce216c18e5fb39ec22a87
SHA14a886e6e70337829cb710c9bd1f9b67c61600307
SHA2566e101112e516d7fa56883a68e4d3a35fe9c4fc57a64e17db011e4d058c8e9df8
SHA512e712bc1b7563aed4a93d547b6614e39c32fd69a4232b0b5422f53249a160ec7c60cd9951b6b8a3dabc08ec81db235b6f1df56e62be8c3898be7b56b556426876
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d5d700c89b3d16aba8d2bd146a27ca67
SHA1c191dd17489d7329679956b788afb55cffcc6095
SHA2562df0bd9592d93f3c4c8c908a9b12b366e0946a2777e5a7231b0ae2536fe0ccb1
SHA512295482948e1966db5cef92dcc0392332fa6da2db28f8a6c5c2669158ac6cea7356791cee2f087ed4be1240a0409b0a77913da956b43ef1daae628b91936a3faf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f2455cb94cb88308930439e78c0b9ba
SHA170d5697a0cc1c41b26918e61a842b3b813a0a08e
SHA25668b83de6562be3608d8db9cdf9838461ca736c31a7cb739e9e82452248994cb6
SHA512b43ec81361a6a1d55b4a8ca62abcc5863e17f866f087d46ff09d6999b5dcd47871947ed7e3533a60695cf717d0dc5f42ad390c74cc9a928e5b93bdaeae327e6d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51006379a2cd5c3b76e4ec8f48f59af0d
SHA17ca81fba42997aece6f1b9c3359fda7583dad5a2
SHA256d8df115304620d53be1f07e0d23ebab5be3b171e78a9d02c30450c0e49541224
SHA512b47b7f861e28c0cb447f27ca110404640e472a40ac468f6148aa90e6ca2d93f329b066c96818632b77b5120042df7a35b326e4a1bb71d866031bea223d296019
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD51cfcda58b8b2af882de94618d8b7aaf4
SHA1bd135c0d2af0ca1550b65b788bc00711556306cd
SHA256fc5d9abbda83ca5ce2628717af6ecb4389fca9cf86da1fa47d2cd01f555e2acf
SHA512d2062865ae4e84da5539d56b717eb9a95920b95d611f7dd312472117efe1338cb1e9b45968868e66444ce991857c20dc45331016a3b5f3ff4b593330bd9b71fb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD501365869695f74767b4e1aa0d1217000
SHA1f61a9c11e23c22eab73e212d3f1e7393c7e360a5
SHA256c975dbd905994215a9c2e4af91c4aba08eaf9a43f06024a65326255950110dcc
SHA51244d55d7b0eef9d15e1295c64ca23cc42870f91f758cbaa2ef6fbf096d714ab1ec91f40ad3796d2fe678caf7a18c978a1f6b99b05b4fb868ad029ae3392411679
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06