Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 06:34
Static task
static1
Behavioral task
behavioral1
Sample
9b01d93f5a703ff012df0c0556775bd0.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
9b01d93f5a703ff012df0c0556775bd0.html
Resource
win10v2004-20231215-en
General
-
Target
9b01d93f5a703ff012df0c0556775bd0.html
-
Size
24KB
-
MD5
9b01d93f5a703ff012df0c0556775bd0
-
SHA1
5eeac67a1c78192476716866ae603ee294401a51
-
SHA256
15a66cdd3b75e7cdabbe7b7281055f6f47d5eeb7aa582ab504f9c19070e979f2
-
SHA512
0d3cef55a4068328fd339795032e1c737760a6447592dee33a533632e303579ddebee2825a319f0964493578df1ecfba1543e78347103d1ab2bb8ff27d8e67c8
-
SSDEEP
384:ErB9u1+QMpQl338qWvv7bFdqJ3Jj/odrLRJgkA5LwaOGBr5:kB92uc3d+qJ3JLOQk44Gh5
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{162EFA71-CB03-11EE-9CB1-72CCAFC2F3F6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414054329" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2092 iexplore.exe 2092 iexplore.exe 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE 2376 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2376 2092 iexplore.exe 28 PID 2092 wrote to memory of 2376 2092 iexplore.exe 28 PID 2092 wrote to memory of 2376 2092 iexplore.exe 28 PID 2092 wrote to memory of 2376 2092 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9b01d93f5a703ff012df0c0556775bd0.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2092 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2376
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD580bd14852a17434afa3252d7b9f98aec
SHA1b5d17bf3c621bf73b44d1bc6d45f5380f8d23b41
SHA25654742a783a72ff545805ed5498be059b1e2e2f889369996f3a26e24d17cafaac
SHA51285f11bd52f1efdaccf86ab2cee6d782e4cef8fa399f4a005d037e821f5ed061388b5683f57b07949e9b6290d48796ecbe404e79cdb69afa84bcfb2326d4c4c9d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3180cf17969079d4c8ab143232fddc5
SHA1c3b9c23bd4d6a53056ec8d95546992035ccb9841
SHA256b05b721b700699e82e246cb89d6d67ed1e5dc4c4aa8a6607f6c9fc6b212c36b4
SHA512bfc87d82e87447e34a85fd830f5656a218befd150d2c40350b0066a70a125f8d6f8b797745e96c6b78a1167aedae1db1bd2feb8a8efaadd10f4aee5f88e33b4b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ce680ae06831cf785672baca2d7faaf3
SHA1bd86637f0923164769b1f88678c4aa9ee9754392
SHA25672338699ce96dfc08e8d65daadcf1af3774d259194f2e93611b66c451d4a888d
SHA512397404a0a1441659038b2a8a527177d3a1ca23214c42792c833ba1b1649c9f5267a577d46c82d36102a5a35803eac43a27fb03ce2f93be43f21b63337e08377f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55452986057b403346b4581301eb0201c
SHA1d09b12c6d07c850584bd7a2f02c848e6a5e641f0
SHA256b6199c65af441db77d694494accffe894afe318068d9b2ad843de3ea96fc06c0
SHA512ad982c684034c454470d1bd935be6780a7e9b072ae2026dd9e9d043461b0093c43a8a8d9752c1596ce75745a34cfa995917ed312508985108c2c156319bef78e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548596af630d0950ee12dc3f9af272f52
SHA10cb6804ebd680a229532fd3c6628327210e9f85b
SHA256b639bf51e7f949f22bda7e301a550cb2efb18dd3c8681fb6782843586e8af40a
SHA512d9b20ce3b789b64e97cfa334556433fe3abaeb80e2de3c5992aaddd3e5b0770ea74cac8be4a8bc0fc2031c20a489fc3911ad871e10ffb486b97788945fb491e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b1f9287d3c1b19d31d0ea88640177c54
SHA1785064f237e27e51ebfc71f9e3aa2f8056f0277d
SHA25678ea39a08a52b5c9f68e04d486a75d19adb2e37d7ce061feebd4f358adfbbc98
SHA512835e4657b53004c6d756377536cc84cb1e205e47f881eaf5720508f0f41d4c4e4eee9d149849e674dcda190413106b8790be4e1d4fff8843aea774cbcf5330f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7c9554b2f41e9d4ff5c850248127fc1
SHA17fbf0761b0df486f47e74334ff3f72903665b278
SHA256643f96f0d0ccde7ee71096b8c1bf3d509caac710cdeba019bf68e5ab12d52253
SHA51202f640a234bbae17606dae9780d8b216cc74513dc2a691a47753437cff362d25d5b71203ea1bc2845a90715c87b04eeba4684e130357b8c77f7f1bcbb59596af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55d9bc9c58a3aeafe7626816c958440fb
SHA1b2decc289cad9554a03c3b8ae69e0eec920b4d38
SHA256e64ffbc274d5401bb042be843cede23dafcc2a17aebafb031f3a20896a01cb42
SHA5124dec38bf412e0ac3a36d206c79763c906ab219cfd03da3e6b746033f9801faaee6c9452e697a84f93c1967fc9d5ead03f3bca0d296be6968b176a2eb57f9aa60
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51af1bb441275bbe81c9a42f90bb61afd
SHA11793dc05daf3c95a42010449bb09ebd4582adf10
SHA2566bdd88f6872755f245a1ffac9a91b546ab6bcd14fbd4ea1f8d7ebdc505988155
SHA512da4a9d155820e0562c71213323332fef4c0ff3fa5ec940c5680c190bb177e2aaf1877081c8a75a9acf04bec93d6f60d796dc736f8b27da70e0c06357f608a33c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c677f1b8c79032e48f079337337255a6
SHA1a347ed362e40eb0e12e8cca917914013d416b7a6
SHA2565d396c829a882684b3283f968b157b43fdf54f892d260b32c2fc73a358f105a3
SHA51225314d6b62eb348e76d53572878c639cbe503488439bee41f13c5c7d98de162a0be035db05469ab69a42da29c50bffcef4ee91fe4f89addf7f69feead8966300
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57138436a9e9d2e3a8d1f3dbcb7baee00
SHA13008092e5fb06caca14c49efe6411f8aec4e0e50
SHA2562a5c20f7655f5109b6d70fca54c004bc89c1952a7054ec82b19083a473cde488
SHA51235eb79e3a08e03a717024e8434e41ecaaa5b7e2e1d754a033b2d1c3305236027cdaf7de548c8c80eaf18256e37404a12fc3bd873781085c462b4e0c232706de7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5df9dc8dc2e7696f904b94eebd3a8eb04
SHA179e26784d77f20bc807e55d88f3f650066a5f9f0
SHA256416a5b2ab149d384b5147a608a4ae24f5a37cc01a479e96292bb83475c886a9a
SHA512dddf3d98aab863d2adc8a5852c70145612e205e0394bb5a4814d5b96ad2963b74f71ebd29910cc164cbb6306445a51abe82672f5d91aa7048cb82e0506982ccd
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06