Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 06:28
Static task
static1
Behavioral task
behavioral1
Sample
8e73de4082a4303279052a70b7ae8c4a.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8e73de4082a4303279052a70b7ae8c4a.html
Resource
win10v2004-20231215-en
General
-
Target
8e73de4082a4303279052a70b7ae8c4a.html
-
Size
43KB
-
MD5
8e73de4082a4303279052a70b7ae8c4a
-
SHA1
8337588a7b5acf71fc00a192c6eaa31432deb22e
-
SHA256
2d9588aa5cf5db37d2c9e871d4d0475ab8c1761f179f6993ab33a237649c3425
-
SHA512
26aadff91c1159059e9de330a5b60b18e4f638e10c8cea9a9286dec134f20b754e219c6cd80c6e15ffa03ae4d292d735de3bdc372c94fff6a7178859bb04e744
-
SSDEEP
768:53J/1WHbDPHElN5NrkfoP+7Cg2wWOatqEHFIz75AmEJhH:53DW3klvNrkwPaWOatqEHFIz75AmEJhH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d60000000002000000000010660000000100002000000019c5dbf7ed36b290507ed13032bd66185d957614d453be5ba4e86e2f1cef53f7000000000e8000000002000020000000f59d0c9c724ab3e343a18f996c9a555bfcf4ccbee30e9547ae5f27426dc58c1c200000007e522d44ffb9200998e70ece275d9bdabf5021373932805648626928a043e42a40000000802fedba981f1dcf9df59851e807d7f6e339dd69b52307ca7890ed2682213909de0e7e4d92155ef012fed5696554451a4a8d1a986a24be2790b5a37770fc5e14 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ba66943357da01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A661E0B1-C326-11EE-86E5-EED0D7A1BF98} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000c5cdba259c9c2fe5f0c2b0919d88d91988c27cba23b1e6c2c92e8d560f36e8c3000000000e8000000002000020000000f3d5fbaf5ea88e44cc92998b49badb2e01102687ab55c2b634b14d65d43316b0900000005f8b7e82238fbf634c40770a15bf1429d2445fedc0305d6e33c75dbf37b377e628b49064f0dd8ff23777221d54b93d9b00bf4308c8d7293636c1c0033de70191d77697cc4a8ff99031b31dcefadf21d053eb4fc1d682fd64df7cefdeecf28072ea00f7a03a823fa41962a11f2d0d969e1ab414c1ecada8b35d4e06d6d592ba38d700e457a663afabb232ae62db671a064000000071fb51d7e8037364e8101802f6aaf013d64eaa189f668a205d2b001e3e3bf175c6cf467bbc1df8cb81d93f2baca6a7c4491a3f5acbb3d3937bfc83303615f14b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413189994" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1988 iexplore.exe 1988 iexplore.exe 292 IEXPLORE.EXE 292 IEXPLORE.EXE 292 IEXPLORE.EXE 292 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1988 wrote to memory of 292 1988 iexplore.exe 28 PID 1988 wrote to memory of 292 1988 iexplore.exe 28 PID 1988 wrote to memory of 292 1988 iexplore.exe 28 PID 1988 wrote to memory of 292 1988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e73de4082a4303279052a70b7ae8c4a.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:292
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e2fa5eea9fef6baae3764cde39f4513b
SHA1cb9d3b09650e4af3b07b559f05a3f3bac0a2662c
SHA2569003a42c0123fb4f0c9ab7bc69c7d0a090b8c27d028ad37c2261c74cffabe659
SHA51260d87ef70b29afe57643278d909d7ad37044b777ce3729f4e8ff450d25d42ba776ee1f0647511f800237a0636e8a937e65cc34b0f0da649fec90b60741931394
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52188c544602560eee48b2fca61c8d4f5
SHA1ecc4f86d5ef6dd4ddeebb18b24e22a863bd215e7
SHA25681e41e8c349b6ea6c770e1fa8b66b67b14dcf4adf0258d53ed1d7eca66e8b79e
SHA512e3d515bb0c281a288683bbfecb394a05c477fff3c00bbb22079819fd540293ddd0d6cb07c70e39b73917ec8d64c3e65332986942544b30648f688c7a4751e11a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59534ccd1547885e6bb0f493e77d3393f
SHA142cb674c51bfb17b3276baec7593843577c65ea9
SHA256b212c0514e2dd0a8afe3d57d33d62347f611f367868e7699992e1446a5bfb8f6
SHA5128bb4980948bbe890148f20a986f6e761687a1d22709c7a845ce973cd42e81daea49fe8ad00466b78ef1bf91bc982a8fb930743202e56697bd21b51270ef65de6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b160f2fb65a4068593d90240582d563
SHA1c88abe7fb69ed0bda740f5b98f7fbf4170f423bd
SHA256ecac0d7c2047d879154d52b91a9a7277177ab3dfecfcb099dd684b6ff5df7d28
SHA5123b1b07b6bc83282f496863815bcabeccd62779cb9391530c263a54b3ab6694d68937fc4ec5e0ba5296ea8ce30b13ab3c965b6b23ec0ebf63f2dbe675e1c5da3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5463759c3b23e364a2ff7060965b2cced
SHA158b3e02f4dea68061ea4e95e38a56efd04c01c14
SHA25644cfdaaf53a105771d524435b33324abc6e5893812023ef0059d6a7af6917f33
SHA51268e063f6d44b76e219cb21714a77f91910e6cc9f3647d0fc22cbfbc882a7d67911b6dd56fa3b7d81549288613e2d3b14ff8eb4157555604f26d3accc066ae110
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597b03c10369a3d00d6703633f2fc012b
SHA12abf32fe957b007093f84453bef114341577e890
SHA2564c13e6d9647d2ff822771f3c9127c56eab60542d9d05e3164a32a54d1a99314e
SHA512204bcb26429df21abae87277316186316118b11f7ceded249f2e1b95f1f3ebe276e004cb1e3bf10789869ec76197700124d25fa15fbffabb61c2902e3a7f77f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52dd2a94a43c0a20b47818f2227fc36e0
SHA1df22782dec0ba85eee87d775e367944657d00c43
SHA256559b56706c496cda529e790ecdaef421c3b9edf0aaee05a6d2233eaf2c5fa060
SHA5126a7e6141cd96bae64c13d4a59007763bac5b0a07dabf97374f64f5230aacdaa73571241cb97feebcbf79657d8e4f54856b1ec1eb34a878fc6e5cb15fa937ac81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5580c37b70490cafc028cf56e0b48d7fd
SHA167052a181b5fff5b1005765921b3a8dcbdec1d4a
SHA256fb32ef3956dec9bb73b408a668303e889a48c7c8da53c95ab7c39a69b6f89e35
SHA5126031772bbeae0e641ffc90ed421d98d14b9324a6e96bdaca925a97acea85be93f882b8a3e5e163de5c620895ede5469edae4ae3449e4f6cbf175513e83168043
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572b13429a52c58a1547f20dfae1dd383
SHA10f45fd5395cde4afae10a72f7f54fa00c00d3deb
SHA256c23cf1fa6d44fad608957551af48c497e3fde3c3f0b94ca8a5a8aaa9f08f70e5
SHA512d915a1120755e98c5c5f91251d25aa7db6d7859be3449f5e1b1f4f23a3554bde9fa422cde57d01c3f7ce7fd7bd2ed34474efb596eec45fc3d64b3a8575e561da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd2257355b2fbe9130d90a43bb7dcc29
SHA1ebdc70e4139e788fdbd78710f9f8584bc127bd67
SHA2560c1e5234fdee11bd17c03665baab84ed139a821eb2ff55280eb3304db6744f76
SHA51208c16eeb369118945357bc4a7638a0e3d4e8e90d9ae4fcdd611889b7a32e512aa5826f8edc345c94786b1c01e0591164c3be9b3d275a5b08b32c19bc59a713f5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddc72cc8335ff9b683633070a477d4bc
SHA14314bbddb9942c5c19c22e916ebfb4bf058e021c
SHA25612c904bba67236cf070c102cf7696137df4ae885c5c159843fcd1cd364db37cb
SHA512e9e629c20a38e70816e48eb6a59f0deee560abb00a43e837c8660d557058a62d0b22602063a4d64b4733cff8fb858fc4823bd5344fc8a94445bcbfff563c8c94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59548880156f83e333a267484e105a82c
SHA1abc556d0baaf4362576c7efb5736fe589e28f71d
SHA2563493bb4f2b5b9456486ebf85f216628dbdd5c74c9fc834b3e63e4443f8482eb0
SHA5127c3f197fc677da7d87802ceb77037063efa13aa08447d4326427f4efd7e397b9da1a4dbde0923afaa82a9041e8fd3a623832d87c09f701dff43bc44d01cb5c50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dff36dfa1e84d78c59eeb808b0e86408
SHA189942279dbc8c39ae5ef6b12bb30d6fec1a31ced
SHA2567839189a74869e606322e036091b80bdac3cf5180750efe6df5e809b28f3f7a7
SHA51255eec41ce62bdcab998d26219cd4bf1b50ad255a24f0d775fa56fae18f67a5426c45169cea259de486c6682e1ffa1826f36bdf8cd0821b7608bc41dfe10a84b7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b30e4df771b378938b89bf235ddd2aaa
SHA10106782436d757ec259adfe04e48d5cb04f37bd1
SHA25668fd18f6d9f290d35c9cfd2e34923f82f3561729ec2a2b162dc9afc4caea1eda
SHA512d1c667f846099f9dbc2da6807d5d9556bba5307dd4183498b9ac8deb8b2a8cfed3c6fe874bc052a4208d92756263c002e35b80218fdde0116b98d2a81e699ffd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f26445ed4ead9f13590fc6f5eed7bd49
SHA1f12bde23d38cf4c7f060db4a4e236bc3e62f1244
SHA2560954f60b956a42ce66767e2e80f7322cb038982895286c36c569c2340ada6012
SHA512c81ce40e05e890b542d466cce156e583949ed0953b662d3171a6405267f3425b923743cd9f237a3199cb01e83a48cd45a2bfda3dbe85ddde8b3d5e4787552af6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a4b12fd51415035e0074888336e44627
SHA1c3bcfa7839caf7af997a49c91b448e8e27619ec3
SHA25638eb2548449d32077e81eec4ce8539fd444bf29ee7b5506f4ffedee4e719aa4c
SHA5128ba0aada86fe58de58fe4cb0ef078cd683c3b9b1d66916033ebbfc56e7d5fde8fd297f031896819f9a242a50f90823a6716d4ddb9c1ff432cb39bbc7b9e87cc0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57469c2d2505f50c36e0acc986a78df52
SHA1ae9dff753690eda35f0108985709ff4b117f6702
SHA2567eae6e8f4f83220912c7611a1f9ca45de4557bba96cdc38452238655da830001
SHA512fb14edc63a733ba454593f9dcbbcadcb5e3c9e82dadccbca8cce122b8580f6b775eacd7d973f6af3227b0f6a1ea43ca85ea71d5259defdc8746c64d0c9c59716
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f3bdbc8ee66f0d1e916c7385b944b5d4
SHA19844f73af4dd372160ab8f89ca5e6a8ef5150fa0
SHA256d16d25193c8410fea5e9895aa713ffd6d9f525b5f21447eb1de33008e0746fea
SHA512a44970cb21b058ce534b3b3a83848758f1fb9444078bd8100cf5f6e38875b760d0cec2bd44b57bed452352008a00f8fad100c7726cf40dd865c3269ba7c7389e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ae36a4cdb572e4724078981d7816afc
SHA1ff160d53c8051d46d4fc3b46ec106a1965761171
SHA256f6775bce085b696dbe96db54d0fb8345b7e3b8a758688a19d09514d4151d30ad
SHA512940c4e69120608e64f8256365cd0814b8fe2ce61d3d7a7930d00d7374e9a6adcba2f7a3207dd2f69746a08a882abc4f320117fca5f51878c1fa6ed818c1690f8
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06