Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 02:15
Static task
static1
Behavioral task
behavioral1
Sample
8df7e9a08e960618df8565cea96f08bf.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8df7e9a08e960618df8565cea96f08bf.html
Resource
win10v2004-20231215-en
General
-
Target
8df7e9a08e960618df8565cea96f08bf.html
-
Size
6KB
-
MD5
8df7e9a08e960618df8565cea96f08bf
-
SHA1
75b42cb8cff8136b0189e9ab97b15f4d5e95e5ff
-
SHA256
de31cec24f149685bf653e38225e4d77e0ba78430021dd018d9ae46d8aa048d7
-
SHA512
8b7824478b7f1488f5d7a3e902bfb1b64d3e366487784bf3557aa1f001cde2364c8bec21cf6f116eb45abf474d4b3d85d5712dab84a7a009842df6419d986f7d
-
SSDEEP
96:1OEsvVbPxJRzTs6aaK00FB5xPTSpNA3dMREs5oJLPjHYB6yCl17yPTSpZwv8u6:QtbhM5aK00Fhm4NMOLP0B6yCl1+mza8b
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa000000000200000000001066000000010000200000007bc5f41430a6b0e5ad47ddc99dc93fe7f466853a7f6955a4d93854f4a465c8af000000000e80000000020000200000003f6a22fd848fb56bea5df197b8d5ecea48d0f9df637fcfd0154461a5a6583ff22000000062c2bdf1a668d31810a1af285398b215e9be305f2c0b3b834735f3e438901daf400000008f08a7d4efb3176cd3517c2448edeeef648c80d791044989b74ad3af17a55be26477db1c9c8d71ec5e116fe976d2873d745fbc2e4b89f89f5ded8adcd8597c8b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002213d23592f6d648a137f9bf65c22cfa00000000020000000000106600000001000020000000d141b474d5e80ec62a77f13d7715477eb8ec31c556727cfbc72c498c7353eaaa000000000e80000000020000200000006f17070a9a0395ab2162ca5451fd255000f35d6f4bba9aa2650a7153ab9d725c900000007a0438f1132d180749b0458f998c84cc992326560557db0030b26ac0d23eafd653d6777476eb84f51237b1e61d0746fb9b0336c0d561228458074095ef7b96129d91ae6086eb0fa7934b60b8421b2bad585cef72b744427ce7c6ac010c12265807f28cd626aa3622c0df6ed937e064dc10f3b49f35fd67d2517940d3ea16582bb45f8413e0f3f0451c1ed16d239551ce4000000061337e73d96c3e8bcf6b9e3aa6df0e7c8062e090e73109cf39f8af470f2e194b734c8e1589d40488776dd26817cdaaa1c5fcefd6bf36dfa303cfe5244b70c6b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906dda201057da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413174811" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BE3B321-C303-11EE-B383-EED0D7A1BF98} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1603059206-2004189698-4139800220-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1768 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1768 iexplore.exe 1768 iexplore.exe 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE 2388 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1768 wrote to memory of 2388 1768 iexplore.exe 28 PID 1768 wrote to memory of 2388 1768 iexplore.exe 28 PID 1768 wrote to memory of 2388 1768 iexplore.exe 28 PID 1768 wrote to memory of 2388 1768 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8df7e9a08e960618df8565cea96f08bf.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2388
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59dc48f9393ad615d7b01b830e8213112
SHA11e3524d3a96e05944942bd0a6a7c180396ea89b0
SHA256e89b29db32b74ab583236220fb2eec63d8fa2ee8b88ff7728989e8b5dcbc5a63
SHA512d0fa59dd02ce5ee11f90622a9d5275a194bf261154cb4725512449028133aecaf1816c8ef418d8470a4ec2d0cb155be9328bf31c132b9eab21a30f1d88a92719
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c6429187b78431b14a0b8d692c090266
SHA194e1f31e02ec72d9075a6bbf037be25a7b740dcc
SHA256b932e3b6eff8138663365992da35f883ea8e8fedf3043f9e1f28e0e38edfd908
SHA512bf5df8a32a678821b8bbbe482d421e67f2d3362b517b4738d0d62e95a7e6baa363311702cba82f38168c0ac22473a574adf207edc908b9f0ca392ec6918f78ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52f7a1a285fdea3d1781ea0b5a340a20d
SHA186645db73f9a36ba6c6b324e0370f500ac28ffd9
SHA256b6cb479a9e2ea5acfcc57e90283a95357dfe708027512aad0982101cb634fdea
SHA512cd53e7d28f0fadd9fc03eae864e1ece9ac044334edde8c247fb782e01875e886fcf386d05d47adf660fc88998e5a6dac983cf4c037fe10aec5b4eda43a4dba49
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55739ce44f450aa61ace8124a6adeb7d5
SHA10203691976eedd3bd6f4779404a42c5bd482aa23
SHA2562cb2ab7093e0c810da0380d3c38b9be13d467731a7ec0005c8f7ca18f66c79c6
SHA512d72f4ddc4ac1381611f5d61f74454e4b78fed842712f2db6980d4f3f13c7dc80659c69e597475a7b6b550c66d20cdfcb1d3c9a04bebb259de72244c8b9498df5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fc75824c61645b0018f6237b8c3ae9e0
SHA1f935af558b2b3aedb5ff938cc9cdd86658a0c953
SHA2568f01c32617d630a7b79dbbadd896177fc6de3edab603449aba3cb1924ce3a9c2
SHA51224cfa79829de2d7488d713fd7e250d3295a16e7592e944ac9f6a320999280d3e8a7aa8d0df38cebc42008d80d2a8ce65e54b452f98865fae1ee31414c5813aa0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daa8a1565995d54bf8ba924990469097
SHA135bb1d53eca5d7dc31f4aa295edde332f7e0f767
SHA2565231b5a059e25a88c9ad5d5e28865f6d5b14f2866dc6375fa939b3dfdf8034d4
SHA51275da42205228976acb7ebbb1930b8185e862662fd052179a635f9aa61284cec1af7cc62e4e5568ef4fc854a954409e0f7a134fb51ddbc8b60e3bb0d932b3442b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5adbca4e62f26c0dd5115b93be574c105
SHA14e505d7517271b4042e4bccf878370c0cd110861
SHA25615d456341ca8db382b351babeb3546e8c8e4237bef8aaf7bdfbd5f89ecdd5aa7
SHA512f5810dc6801d0e7cf9e7e7d95c2546412d854b39b16b3b47a069424113d10ee1452b281dbc4f8eabb44091bac2dc45335ae061fb0368d0cfb8fc11649be9497d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e4820d6646d5e15ee5f4ca661148fe1
SHA167bf7f4a82f33a02752fe5ec799bdc21d227e203
SHA256e1a483c7a6842fccc86eff1de7f81e0feacb9eb5e43b99b9178237154a9aa721
SHA5120b607f4fe84685133523de647a6bd80de24dc9a78f10e04310f7cdd683d6f760c7e2b7814fe83289aa7a99580cc4ac8893f32f36c9b78b1a0e717dc7f18355e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD511e0086d38e80627183673fb65ab866e
SHA15265ab185172559474ae9c17399f831fddf6c80f
SHA25668e9a0170b80bc6033f688a79fcf62c9fe6dda36a0f0bc033e32ad575729f792
SHA512c9266dfe7aa5d56035d8824e54c0e72d07ba4a16a533880b3e7bb03c3216991f37cd6cbaf24e6d76857035351367a4ddcd78308eb8df4e4250e79457428f58de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e68842b8b179eff8012b55dfd20620fa
SHA131f18eaca5539f5c0d05fb703db6c9f82b3c72da
SHA25677e8c075bd6ac7dba2bcfe54a5f455ac32bec036281596df8c365dab67018595
SHA512f9b85ce7c374777a83dd353608935d8528326e39545eb3b75c5a6596c692c976dcdfd786308c724f08d7d82eb8a1ac39ff6b30bb56a466c490bae9cd5f3720f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d04febc21ab7311de438a4b5317a54c1
SHA1ac20d97fc21938217ef7b35848f4a367b835eae7
SHA256d785cd7c586120131c4df83dbfd9969d0fe9ead74fc552e9cc5646b8a5e2549a
SHA5122191f6edd2672c8e033dcf25e76c22700818aae6831367d33a125fcda0e9831dcf304639d244aa569de902883707eda65b455f6fb5f9c0d82f073deaa32944d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52ace4e2c61435dda911a3d54ea0174f9
SHA1bdb45ac6399d56fba7730f97522a2ab27d9ecaed
SHA2565cffe90f40cd8f082f88c314077cc5d8d76af8592c7d5a57cab79336a56ed356
SHA512828f3703fbacdbb841b4ced6d82b0d992fdd1a447f1ff061ca63ecca62bd82900c1f43862bd3c032d3491ae26a7acaf5c023ce4d45cd21624392675f6064d35a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56454828991283131015357d93b1cc632
SHA1d8c5850a173fb4864b3ed2492f81949660267d5d
SHA25602178e00d962acd8251d96110ee90201444c834f452f23ea524017f81c5e7c11
SHA512f61f63297fa4e2e170621e4b77e31863c5ddfd9cbe431999388f120a37d171413c1d7f0ba07533aa616972222313da0e354559a1bcb4c6a7a974f3635687d622
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5383cd99af8e1e49f7c9995c487dd4754
SHA1139d11063b722708fb64084c1bfb19e178102fdf
SHA25639cb6ece71920d46cab2eb15d697c6955fe82a621f0943749be214de0b67e2e7
SHA51273b01ef0e4a6dda5704f4fbd0f44e5225ebe11883e69cef46a55edd04b862280070abaeba1191a16d85ad6dfcdfac029ce86cd2036271bd146a98dd96aa6c61e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be1d9b3a1535f11ed7eae826d0a08a3f
SHA18a9ee61483948f66534415c3b64084cc51282bb6
SHA2560b736e2dbcab96b5c4e737114236a04e4446f7e1f3c309edbf8fd4ee2ffde901
SHA512e5a0ff3d0ea219add7f53badc62b72821e88db7ea4291fa35b6022e50c60d3a5eccf04111151734f59fef55669c29d57409cdfbf93b850b01a45ef37000d6041
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD505de9061eb146855cf49e5a390df0c05
SHA1b9b198d1a64ad743c880fcbbf437ca5b00ad5f8e
SHA2562ead7d6134fa0db82a7a01309766e94fd5efd6b85d011a43fbe3b2995b2865a2
SHA512b624a6eb4b963af7a63525a5fe6d87334151780260713d5c4651a8e73065092c1d66f93913aa4690894da1d8214bbcc7a7348e7eb585850e39e49da0a2e540da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cb14fd268681f439302b177a2a70b5c
SHA17c9c49022c7b49fcbfec2251635ceb35baf330d5
SHA2560e38f3eab0f23517b0a89d6fe09c4a91c09b739000a6f9678a707fd46ba597e3
SHA512f4463035e04e0b26a8805c8bb3ac31fd6838d8e0a61a6df3137049b6d3ffcaf5eb576caab685392e30ae80853edbb69ec24f7955324ccaee77bf3226f3d75739
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db14785b6f83db3408d79c90e57f4d82
SHA1f52472384b87e6296cd517b40b0b60c0ac9d7f5e
SHA256de6fd4c7cd4382d485f9db2e3ec6f910b682759cc5f92407a15ed985c8cbb8d8
SHA512c191a08444127dfbe3b2837c0da093fb5992cb17bae7ce34af1964abeaffffc0a04450c90cf8e22ca9c701e87d91b729180943e1060db233ce637236c8ff5987
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06