Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
969d119fcc7c87b2a5f3af9356eafc59.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
969d119fcc7c87b2a5f3af9356eafc59.html
Resource
win10v2004-20231215-en
General
-
Target
969d119fcc7c87b2a5f3af9356eafc59.html
-
Size
25KB
-
MD5
969d119fcc7c87b2a5f3af9356eafc59
-
SHA1
27c4b679a2f696f97934f770f04fc7dc5fbef5b9
-
SHA256
2842d500a94defb357f6da7faad6ecdaa66d1b9df86824bb9de68a7ac8437002
-
SHA512
61a9ea512e7e644558517dcfc1ddf550b7883dc3db93da1c4e74cf3cb399599d456b081233e8e85ddf8f9727512686d703b154ead9b61dfbc82b5301bbb63678
-
SSDEEP
384:fdg2H8osVGwaFdTOUtxKTeBfKTpW3QjfOz0hLgWQQ/U4yhoy7jfIWrYc51IlSAuI:Fg2HlsV8ltITe0EAb3NG9p6
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30f5ec42855dda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000def522dae06405ff32c851640f70179b6dd777df1fe65c19650156c61da03701000000000e80000000020000200000008b4a09a18d63ecef7cae59f5b2e020cdf136f897499e58b00afaa219744a21cd9000000046047239ae789d99d3f38e230ece1daafdfd30ca2606faa9f2454a571a8bf2ef501ef3a7fd7a24e8b1fbfe1b3525b7b43d392a349025c5cee7868ca41e102fddef903f6f0c66b55df4aa9766a04db5e922b5478172b4cb443feef52539d12f165a7eefae699578098e71191a4a57ed666569dfe24a05b1fcec8cec727afa3f94ca785e981aad2eba70b3635b89da3ba540000000d913c3cf3c25a8c506d2e91b5b837c46416ab16cb822e19fb79bfcaaa1100a831067352dbba74eeca4690ceece43e019d7a73c18bfe57f79642234a68842291a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000429d3af34477a14f8b2dd7691733418900000000020000000000106600000001000020000000b22baedaa5adc213b7ca10f9d25e58b055696ce405930a572759e9e1054112c8000000000e80000000020000200000004b39fc482ac64c9545e2dd56eb23bcf5716462d0d618ad4354f3f6b33930456a2000000083f07334d733b1c7c0a85151936616133879b2e174e6cbeb17daa93f6cff3e3040000000ff14265a82bd54d3b745e8da5fa40c9ed5b636599c5b949cfe37d2c283404168c3b299e9ed931b4bc48afea1ed8761999da5a0a49cb5258cba2ecebce781ddff iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DD80461-C978-11EE-9F1C-6E556AB52A45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413884826" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2292 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2292 iexplore.exe 2292 iexplore.exe 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE 2456 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2292 wrote to memory of 2456 2292 iexplore.exe 28 PID 2292 wrote to memory of 2456 2292 iexplore.exe 28 PID 2292 wrote to memory of 2456 2292 iexplore.exe 28 PID 2292 wrote to memory of 2456 2292 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\969d119fcc7c87b2a5f3af9356eafc59.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2456
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2be99de7baadcca7821a40b057e1c61
SHA1a29750cc2826549ce0c8eff276e9708d48fdf751
SHA2567190ecaa7eaf88a4c42c09aa9dd3a174da1e08582a941957c5af7ed6c2eacafc
SHA512d6e5b8ab8d31eb0a916f8437df0bf53ec8cbf550364b8bb7ac21c08ee96f2326611a65d84be095632332ff582435e431b30d125a1f5d7b9c657e2e817dcc5c62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a06dfd8d21543bc4a7a1d9500f6f0b9d
SHA19ec45e113d8070b72821eb72754ce3cc586f19f9
SHA2566da0e4393141c832e109dc5846949756d1f1d143f43bb57118eb7ed6b56b73ec
SHA512ebd449bd7848eff631e6aaf1ae2bbfc503b19beca115e8381107adbac2997a04042148f45f8398282f9727ee4b3f05ed410d28e6e39c7c3eb3ac776b351c0b37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55850c40634aa053ee4730f29d868bc05
SHA15462b7e3d5f38d2e6e1039f367fb5e1663b1cd84
SHA256a9188eabffa20629a6118309223f0ee6bf7d27dfc8794e6d576cac046c328713
SHA5129cfb903f6a7ac1537a90d775f3c1f7627cedce21c5660d4b86f50ffce069ff24916d8e4a41039cb54f68d15e163b57b2baf9e2e08bcd6ced9118194654c35b22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5974c8240c6cb8a90eeae6ca0a7f42cb9
SHA122c4f6dced191e9ecca8dcff27855823af223c68
SHA25625dfd0e0522145f071734949801caab285ac24e3b02145248b86ea0a74cf7e73
SHA51202aae9aad7d88c4344f1bf8a906a81b4f95fb0a58ce91a37a3b09cd4afb474fec4aab24c31862f246476d160e258714763cae84902aaf49f43f869604563f3ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a14da7334124771a851b9b5eaeebde1
SHA14719c3a4bf4f0eaf6dc20ba126d34b5018db8496
SHA256d79ce96e1efcbf1fc6524ce43917744993093ccf7117b070ea2e5d3cab5a6d6c
SHA512c239743c926f95d78d3d9bcf9e8d94efb15c5cfadd5fff3489c89b9e31955b60e084c5bf0cdfb1518b84f9941452e7f76947b8d12809333f316598e61ad91d56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b692ad91568461327e94aec5c7cd3d29
SHA1f604024232795a7e152bb692bc9a3ac653d75093
SHA25642fc82b7742ed285fbbaae312832af40e4cb2e4dd0bf005116f002d2fa15d6ba
SHA5123e7436e9e392ff043a1291b260d4cef455b960762d86adc0890a472f388e7c8ec221359b5add775b281094c0172b676fb34f2eb972e67a2b45efaea05b7e3a7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD515c48804230372d5593a56bb9ee9666a
SHA127a8535df0393ed14ba9dcf8ec895856dce552af
SHA25623f3889f06a285cf7a437438af17aee38d648471b4faa1bc486c0886e12ae522
SHA5122a94e1fd42fab67ca496f6ecbde5397fad2e95ec0ab64a9b36e8ad96394689741b5eda6cd4af2d667739c2f746fbf4c0b3915c92ef48efbf4f537090116ff768
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c13760ff3bec7bc8b51a288a02a3311
SHA1bf204af6110d64714e004c6d089fc08c904b4331
SHA256a1beed8b2046447922bca19b33ae6863a94b1c291c2a6ce1c97183c2df8d399b
SHA512212b464bc7e71ad9693a6c64042c7ed44b6b6b0b6b548f2d4c39eeb4f1dce71f7440da8741b708315189ef3d622f3288a0921698dd81fe9054250546d89f4fde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f244a6ec707e7596ebadb1366b36fca
SHA1b0b284ea7ec23a3407bd2324724f7d25a862a26d
SHA2562a0a9bebc81e39021ee9226c0f108bcf7fee8feae7d1b5027e343733637e5e23
SHA512c55c4c415cad114e956c2cdf2ef7f0a97133a043198979eda77a0df05061c0bbe7008d6ebfea10290970721aec16ff04c595d3640d62ad652bf2c82491904ae4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f16cfbb5b135e57ff14f7ed79d0b7231
SHA1ef9d467b8b5604e647f715130e858ac312bfc12f
SHA256faf6af5d3ac0fea559d45f1a70589d6517277ddaab64b106c0e1bfc31bf4ead7
SHA512b9c66a99b127c8a5583967fa713c08bac6e1285f84179c5d83629a2c23752d076a22150bf0c018f66538b217ac99bd927cb67d65140d87f4489173eb6ccd6d55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b2d3fc76f482a1ae3fbdec6ef2f6fd0
SHA14a9238c5bc584d4dac6a65e44cac81f9103eb8d1
SHA2564f954ab6af585a762afbd775d5cd3577ba7fb63f06a9a29581407692e1872212
SHA512e4867ec04f937a12cfe615acb76b72db6c3c347fa42b71ea5491b199e5651f1f54405c8639a28231d51d32b9369788ffdfbb66e3dff984ee9cc2acdf86773816
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5532dcac669b696dfd9ba695a798a2c43
SHA1dfd03e1bb21c65cc9d6ba446b722b04c353eb697
SHA2560e5084b13a446572f4883dc4129b9cf05a082a9678d722e7befd46916d2f1cbf
SHA512b37e3cf6a28e1e95e39faa9e15187b9d5b2e3519ed9a1be1035192105e2d32342346606297d0b98de3b64d3da49c21e0514733028d60b9471ecbaf23c3480a65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532fb8b943c9b816ed5ac7249bcbcbfe9
SHA1afc66548ade53f39096bc8e55dbb55fb6756666b
SHA256f06983246291fc124e55ddea13db88c3e4f2e7e1cba006e32cf439b48b1cdc57
SHA512cccd4d07562d346ecd0fb8069fb841a86a1d29a31ac494bf1f3c8f80a772245f7fe4f4a43f0d773fb7ec2165c8141f00c19a0f4669714e2682c202356ad95805
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59aefa0f9f976849b94ac1b4330fa6610
SHA1ef319e0c4ec697d5b6ff123cba6239df788e25cc
SHA256f70c1635edaab19c920f95459832051a49be7411140ecfcec1dbe4e7b42ec136
SHA5124839743ad0170fc288f3bded03ab8a0931a7e079b98ae497eeabc9bc4ccc3a564d730af5aa4f9099695359e3de2fa4367bcd3322700b75ec4d0553a8c2d3cf0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc0de12b21a9823d379f4d09ba62390c
SHA15fb5f16af7606a71b54936ae9224ef9e72111c6d
SHA2562b12c4a8982a0f237c449f9b0cf423ea97219b767e6524418a1b32d1c1dae87a
SHA5126444ba9f59c633f48c70752c9594992f8dcceec0f926b671a497c6ec9fc2391845d381cee73ca11b6a40e77e5dda8a2eb7c48369d781508b1cfc64d6107a7056
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b8031b4e494dc4fd786920e0eb3261c
SHA15351cc7e122906a0c9a34f38cd036418fd6d86d9
SHA2561932b63d322f40b40361dc18cce7a512b7fdc1934b785000218fb6b22ae8a97d
SHA512a594e0cb3f27feb1b49dd5f2fb1cbe27ba6fd3aceccced71f958ddcfdaf43756292b176cbdce68db0b70a0fc99aa7dddf82ac6932c1f8e78420999d2db96ba52
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50938c7ce8ff8ac24b8b3af38aa671c41
SHA14337c740c79956a4a891af3b5d4f82ebbd532ea1
SHA25691faa3d2b2d72f09de8811f41a720b2046e9680142a796a2547b483c70fd9ff3
SHA512f4935cca431178ffe08de45830c0f81bdbd9d4fdd621edf7bca273c9ffab0a152ec9fe242c3b2d00b885d2cd7e398cbede877fcd6b827c5e5ac594ee858dec45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f9580dbd3a21280df27df818ca5bba2e
SHA156836eed55a7f3cba3e786411ebbf3a5591bc827
SHA2563a65143737c79d0763c4adb1684e5a47b0ece5d94a7ce6fb82ad70f3b7748894
SHA51263f8d0c94884bdf02eb494c1fb52dfb56fb7c49e3ff039c04df66b19abc239bfbab3ebc7e411dc56f278a9757d649f131f7470be19e32323168e414987208eac
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06