Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/02/2024, 09:38
Static task
static1
Behavioral task
behavioral1
Sample
96d842b70824cfa0f4a4de76a69436e7.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
96d842b70824cfa0f4a4de76a69436e7.html
Resource
win10v2004-20231222-en
General
-
Target
96d842b70824cfa0f4a4de76a69436e7.html
-
Size
2KB
-
MD5
96d842b70824cfa0f4a4de76a69436e7
-
SHA1
704980883eadee13e3867384128522273cf77640
-
SHA256
8805458b3530d127cd7660891b50b384508794dc82bb524352ac10785edb5967
-
SHA512
65e546cd6655105d076fad7465833ac5c801dbbd42f62c1d94aa6429575774ab3e2223d0ed5ac1502c06bc9289c7ac7c36cb003d4e184b0b2e3b91fba2ac6b98
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 802f0d4f975dda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "413892578" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000340784616c36068d687a14d7a52242e88d4466023ed722e467f0dfa2d5378821000000000e80000000020000200000003b9c13a2abd4f1e9247605d1f67aeb3ca08a0fd7e7020f4f66ab752dfc84db64200000004adc92dc3755278b04dce853d85937e250442d61fe79beed7e39f2a7f0494f1a40000000dff9849b1e91c7d38bd370b8e604e81ddada88c43ca09f0af2e7aa95558f25a0a0430aefde2a2bd6609280584754b0bf43e3c81d1fed2fede78852d3f3b00e7b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A535ED1-C98A-11EE-8C96-56B3956C75C7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e9178664000000000200000000001066000000010000200000002a7a8b0afe56f22e4dfd729b58d932a0b4631840d259cbbace547856cb5ccaa6000000000e8000000002000020000000afdcd086ee448d48eca09d249fc5cf7ae21a2ba23f1bbf356ca2d971f4f37c4390000000ef58ad0c5dacd198f71451736588d77d7d10972f697e98d6889ba02269ca61f659107137362efa4a882b2857961d128137201f558a826fd8cf3f484c6299ab37427f93b97d334941f2e6fade8e772ab5384a24cf6a49f9a448c09a52efa848b225f3ddd7c877445207e7aa02ad4c63ee8e764510337ec438dabc87c03c712aa20c14ef0480c6df6cb28df5e9955f8ecd400000008116ce50cce81fc5d7e5ff8dad59edce7edce9e16361b8e965e7b0c4e6565307e32f9bc1da4f77144cad8da1a9bae6816592d200ef5657dfaf3e1e50c60f2f34 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2260 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2260 iexplore.exe 2260 iexplore.exe 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE 2688 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2260 wrote to memory of 2688 2260 iexplore.exe 28 PID 2260 wrote to memory of 2688 2260 iexplore.exe 28 PID 2260 wrote to memory of 2688 2260 iexplore.exe 28 PID 2260 wrote to memory of 2688 2260 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96d842b70824cfa0f4a4de76a69436e7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2260 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2688
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5962971114b71bddc438be009576e7497
SHA11eb2f4c01bb77808ca311568e1165b2c35c7d544
SHA256555afc8d28c7e3d231b918007d09a04fda37731fbe2e4d95bedc3ee60192870d
SHA512790c35b7ce75807d7ea785c64766b0c708a65e7a294950152bc0fc015914fafc07bd458e3ad36bcc108acf7e7b2df721ac39d664af9a502eb2f2266c8aeff50c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5106a56bb86cec8b402d4d3988acc112c
SHA1f3ac423b4006ad77519811ddb0a90c0af93db54a
SHA2563faa52564b39f2d68264870b686875bd1f0c702bd2f4c46d4aa7b1e7f8ff130a
SHA512f7f93f88c7eaef93fd7136f803ae4e64cba5d9ca4de3a5ee9e9d9c8a199eb3038de36735f6b197b448d91ad4d2e4a70450547dac13e9cac0671f049157b41357
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55ce7aa29ddfed16db20cd7a761f28c96
SHA10ba4eb9e3255026dfa6f39b5ab3addf9ff545b73
SHA2566d3f2c2687b12025bf8076af3081be55fe0679b62418c547e2690c581c249a61
SHA5128f1a20333dc9efbcc8d2fa27614c502d8603b405bcb20c2600d7951169554ffc1cf09917924cc596c18a64b14154134b62c6584935afecbdfb7fa42f40247e1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f8da9dbd24508d404bf7b2ad97784219
SHA180eaf209d894fd1650d86debadaebd9361ac7543
SHA256fdcb2bc2385697690e5f0379d69475c44d6e62529492df951a543a1cd8093517
SHA51220ca810a8a1dd96cd90f8daa17600b6dba8eea042ac103362dc4c3438b85686b403f723f8f1b75a6a1427a0fbe7db425619e6b59bf0060ba04326de7b70a51be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e7d97345a448552a9e7242a4484efdd5
SHA1872f47c1af6fa1e8ecadcec5b2e1f869696d0bea
SHA256e7ac2648d04fd356e4b09fff508ac4e37133c1dbae56494e3f4acbcbd6ed8370
SHA5124e88e4420e0301bd1bcc01623131395b9a3de96486606d14d197122bfccd83a4542242f6d5ab04e099495039ca2eb15a27f598c80ea4795bd01285150cf7f95a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cf7397a13cef645588921db247fe376
SHA1d1a2456cc0097e3b9649565daebb65b9705b36aa
SHA256d57e8f8fff18002396e3e70ab4dd2f87cd7cc50bf1a2cd60605ded8f3a45543c
SHA5127cd7f52fc90400cc5ab7ebdbcf2fbb8a597cdb176bd4e0237dbf50b441088cc9db265f67dfc9aecf41cbca96a0fd1d0477c8110e4bc8db4d9c9ba37128788587
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5646242d1cdec179ab7a6092815d4eb44
SHA184b622c849c69c03b41ec6c82874ecc39afbc6a1
SHA25635886e862a56035089f3369a542389fa514ecb973d911001db6e192e1ade65a0
SHA512ab69cf02321d08d7be3a3a3e4bf07d3e8277191ac7bc9789457a97f620836b7de5d54e3f04c0c25928d202564c0bb81b452b8e4144ce6624d7c840d51ffd1498
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5821f81e4c74e6418cc600c41b77cf6d2
SHA16ee8f86be3c670e8f90051184c909887e28591b9
SHA256a243ab7392ffb78eab1fe2a20bb6e4b6c4a657852a2caab7a0f6979654c1dcc4
SHA512d1fea1cf50caca84c31d015f9d9c3ad3b6a76d6162cf5b5addaa8b3defbfef739550ca2f66c48a7d23a364abea9bf378a37d1ad162d4db9e62c11022c7fd3fe1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5de702ba7765710accadf630f08b55228
SHA1f6eba7ed1fd645b084aaefb1fb2ef4026f3a7ca5
SHA256e95237e1e65a08d4ae7f84b3d850288582a5a09cd55420b2ec65ace04a69a194
SHA51258ab9962955d901a9890a85a552f6465bde98efad6c5864772401b44506e1571f1b6a75d0161b53dfb34e1213e1ef1e7c4374c47f14e8ef0f150f05bfe9e3c0f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b6c05985ffd82c6927d7aea82d92d754
SHA1b5beec5280d4657c2dd903ba3f29b9e7a375f5ac
SHA256807fc043b55eb7c56110dbe51e1bc546d472d80ef08c8854d0b7fd5212594af9
SHA51285b1f95227ae8faa5acc85a84d13a0fc8abf975e86d375d14d4082e34e393c47c6b816ba2703e73adfd2772796e87ada2673e577f570a0316505fb0d6f314001
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c50a3f0d2fb2b9e2953460dee21b8840
SHA1bf0a791bf328916c7d12187c3070317359323162
SHA256bed21724900ff599deea16acc4e4d7b62759d2e0babfa0eed66e488a25a05ce2
SHA5122a492d3dbc00ceed1756bdd6c4f2ad33dccc1e3ceed54e45d2909d35770f0b29b443210edd6d88d275623e08238d4158b0b40d268e267cc9eaa91800e53c0347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c2e001e91e09bafd56945b4e635c8e22
SHA187277c5c3eee2778c301b209d31842a0ae237be5
SHA25605d228c26e94759db321e853d5c1ecbf707530560b654c5cb748310607b6b477
SHA512378b35c3200a2e6e7a2b1c14eec3b8e8bf3e7fe0a31597222e5fc86d90e105b222f17743537016ebbc002b3574b04ed941839bbe77be095a500d0f7b051a91a3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57492ba8689fd81b36402357fe36d6d16
SHA1f217aa9475743024f3b05b16c7cd549df14b4f57
SHA25678751f4eb8809d9592bf973fc7d6966339618a1d37ae12d24e9f71a94b2080db
SHA512cec7227a22bd7d60940217d4a43c9e669046e5dd6a1b5c1859fc2654d553721f4b8d2c9dbc5879d0c394f5f75c476980383a8b102e03d7c13cecd8868224b5d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5257decaa721ffd2d37a1d58aa662c564
SHA1312a9d89eb10e0e86cbbe0fca3e35ec78e504c72
SHA25678bbf2ed925ac2c35940b1cc35052b914077bfed46d830a55a2f5faefc0155b8
SHA5123013f569c8a663b8288c74d6e2036ccabc5e04b7b26aa3ba58d30f3dfa4bdd10b35f3179fe5de16bcf01ac55d75180c4afda2af8374128636cde3cc3f739ff2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b5f9ce3ac96517e905678bebaacb9f2
SHA17f77c15ce84a1bd8082a0f8921e51d4fa775617f
SHA256452b624adf57cb896afc891fd216fdfb5054b58ab7aafc3d241d28da5c73c9ae
SHA5121b9990e3e57a88ab015f8a2ac74b821db381a1afbe0c5c36b34deea618e8f6bf9428f1e416a645150ea926950d6497e797983317ac46c6b62f6ba385927d9dab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5806532d9149839922178314ba704b151
SHA14ea7c9a620c8701a74f32e08072915cf09ccb1dc
SHA25660cef9404fed942bd46f293355e5b071722adfac86016e3922344df9a756afb5
SHA512804b252ba2896accef7f8a06e96ca7da4b9b3b4768673bf9f8d705f7e398efe4f6d1605d0755a8a7305aadc4f4abe5cba84c1e8f811a37957082be0306c18359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5293811cca75041131810eb3ff8739f51
SHA19fb698b6ff64dd8a2158237cfda880bd04b8f5cf
SHA2568a49da5b63e042337622509036baaf0a169d9e016f771b0d73181908d6fb3b79
SHA512027b1bd92b8b3a2428f81644dd7d5bd1801474698b80d8792e5b057b20f9d10226d2fba1eac15e3266b3694a829e329ec546f684462f9538039b995f4c240afc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fae4a2cd9bbe88827a37338ab9f2d8f4
SHA1737e20a89b2b22770001852faf7d7d37a0162d17
SHA256a149fe07680ec2cea06e2ac4afc1e90d2d6fedc837caac095c567aba9cdf0f8d
SHA512e5b753f14e061cffaf7ab1a0c74ad693a600efa431c5a9fb47915596f0ba5f47957bc42e54c5408e581242f3e026823512b99d96684a915178330afefb8285bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e57784fd8006a5f6c9af90814ed0b929
SHA1a889e8afab165ecffd6740236a8e53281df63bea
SHA2567c882302ed6d7e8bb702836076edd16f2b4ad3b0d97d4e7b9a87d9daa92b7ac7
SHA512079501551646e83958763d97da743f0a1a6e0b9984fcb4dcc567c14c0070e7850abf55cb07441f52e77bdfa884ee2d0b3c2212df28e1c3e7b35e9977d2418cc1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06