Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 10:46
Static task
static1
Behavioral task
behavioral1
Sample
9b790249378be1768e17f8538552b099.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9b790249378be1768e17f8538552b099.html
Resource
win10v2004-20231215-en
General
-
Target
9b790249378be1768e17f8538552b099.html
-
Size
23KB
-
MD5
9b790249378be1768e17f8538552b099
-
SHA1
170ef09a32f539c5740e93a2ef4928e3c1d161de
-
SHA256
7aaa0ef6adbc71487da6669be84b85e062cd7e84c3cba3cac61f497ec8579934
-
SHA512
b8ab77790ec43acb28394e070e4c5bf0992b969f7730561465678f0b54a02267af2c571b231f4ce7eda443487fbba2c494ef740d3a53badcaf0c263af79a18a4
-
SSDEEP
384:FnA4ywOGKt6p5j0CztvukeKXXTuFwCzdlrkoqKL24UTpNyOcn8tvG5nTDuU5esT7:t10HtwtWkekeRR9lqKc7wV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d300000000002000000000010660000000100002000000097ff08316c79f6bb294eef73d93be78df027d20d6284117bfbf386e7a59a2e32000000000e8000000002000020000000a6083958ef07a537b2dceb230a808eafb1cd16e45d4d476e84cd1ae42d8108ea20000000c5d4fe4d5ed92ec069e1081ea88cc429d6e2ae0b1b83d34d57376f587501d90040000000dc417fe30c7a7e806a2b1b723a64cfd6367e30a4ed8cdd1ac1c6db1891d34194c8a8c4834481a82599cfa574923691798ff849f5c7e7f909c8d85e641108a743 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "414069477" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{59C831C1-CB26-11EE-B1E2-4A7F2EE8F0A9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000008dcd4c448ce8fb42a8f577f49cde6d3000000000020000000000106600000001000020000000e9edbb4bcc26de7920772d5e6a0bd3d5090a11ad79fc21503430dcb117c553e1000000000e8000000002000020000000f6d845e2f6edc6523644feaa8527e76bca0424f0ac7132a7ab98222bf504932990000000527ace9611e9850e8018136a88cdbf00c10d3ba8ea0bfa7736538dcae36b83e4ce51b21b6924af067fa22ccfcc531512d67d0ea96c5bc92829e81f853a4bb89d34e095f69c6fd0b54e005280a88a5b45834cdc5324af9a838c9a5e1bd03b5d146839eac8477733848780af0cc6cac32983e08cc40b85f6214dc95cd9f9bf24d2d6cdf711aae7eb3f7259c34281a40f4740000000be541ce67f93d8f724c865ba617165243db9045cf059e23ca2d9d7d87742ac43a0ad658d76724fd5c92d81ce881a4484a1cb079e3a59a1c0c45d318ef7b1960b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2065ce2e335fda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2112 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2112 iexplore.exe 2112 iexplore.exe 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE 2656 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2656 2112 iexplore.exe 28 PID 2112 wrote to memory of 2656 2112 iexplore.exe 28 PID 2112 wrote to memory of 2656 2112 iexplore.exe 28 PID 2112 wrote to memory of 2656 2112 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9b790249378be1768e17f8538552b099.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2656
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da6588387f41f8aadeacd465db9a7d9a
SHA1cff57faee393ccf3accf06a3d11b149a6d3e8365
SHA256784fd465428f26d9e908e60bd66174a1e47e51cd523aa04fd5accee7880cac49
SHA512bded3f0f5be6baa9509a841bc5d5517a9ded4b9bf647695e90f8e7cdd3569ca57cad4bc987df36ca96b102056f2c9248bcfadb552745f7ce87e2469e18a830ab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5553197342af701bc73b54d243a00ffdd
SHA1385b62a46f3f11980300304819245154b0b96e21
SHA256a32329587827f4b50c0b5b8b056b10770bd61e0057f72cb507087894b0187470
SHA5129cc5f190c738c61f1cbf8e876a64eec0a0c78813d86d4c515117dcf72f33bba5d553919c330b9afb325161419a75ddbe1269085a72e0f147457bce7cd0d5459d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a33a8f9663da53c3693eb2fdfc6a8959
SHA126b6f2bff0042243ac7cc5790b4bed57dededbef
SHA2562f64b3f8859482a328f3a575510bd03d09d4087578e110c4e7ecbe2ac1cf11fc
SHA512a1d99ad80de0c83221063266023beda0d186911d7eeffe70e2a46a663042c5e17c4286ed823ec373eea64130e9d6abedbec2198f7e7dacb912fa354a7e1f5f45
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5152b697fbbdb5ec44251c3d15b911e79
SHA1857ff8715ed092d27c2292ae64a7fb012223661f
SHA256527306815af237688af5a0f886237a7d5e7500ca331d51539c76829e988fa072
SHA512c2f3f986a8a7ee1016f0a3f1052e3c74edf54df44414ef42ef81a97369e784902371452c1496e66fbf1d012156a9a5a25d72777cdf3f86966a0cb0cf57955e3d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5501fd929ec24ddbeff1904894c924594
SHA15487488784852a424e3ba26866e964b34d3c79b6
SHA256693d233dc937d8303858f423212fa0ee0f149165876c2ef194e2f0135a7dfd68
SHA512b584347fc1e832f72fcba16b92fa3d4951317d3e17372334167d21e8ee4bf16ad68f7fbd7b197df3650a50f4a43ebbda31206a9d32f01121357c5d31fca7f7c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d5bd9b0a9e962e955f6a508ed7865b5
SHA1a63da698000892c60c07f47ba4435b85df2d9dd2
SHA256fa920364c62a0526f78e5a6eeb8807385434ceb0fa2a9ca65084fb4d8f859996
SHA512ff4679b1b5bf3c2d2cc049a2bda57cd1f3eb05b254cccc47e680ecc99e618274e0e3c91beb8bef87aa53834cdf25306c312e65a9fe0e87fd7ce2d4ad0c5292de
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574ddcfae471bff64a5136b118d0568ad
SHA16b4a07fe75f4a19e5b95ff643112159f23f24518
SHA256cd350d1d216ed0b3e95872971ab5f4170537ae32172d810b5d5e241d9731821c
SHA5126fb2acb8b4978033bed8604ee18233a42dcaf7e5d25fe62181dc136d6133db73ea910990364407085ed4ab5802204392f1f1632ebb5f1fbe2683039aa82def4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dce0d024b395dbe894f60d72ae65190e
SHA18d84b6102c929dcf777b70669c012ddfd8960a90
SHA2566b283f712d27903081e90667085a782f547ed7244693547d276b554948308899
SHA512aff16a558fad257fb95ada22e7b60546b763382e45f4f823cac39a6154f6fbb0a218f2a6e6b2dd2d3943f01ac660b57544a3be8c0f90dfd0fd17c842e1f8d727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5610e5c2fbaaeb925e2a5cc8bc779584c
SHA11fcc0c15f9a537d4e5806158e76fda4c3f00794b
SHA256ec7efc2d427d5a8a7adfdabca8245c75ce343e5960d1156b9dc25cab9385d53a
SHA5124fd7c8a8334c65877c5e8d3a68d94f042db24a0b0d74f7c96b4b6ada96dc391f103b7364bfcb67009969f997be33a1d345342b104e0c2e9519b28e597d745980
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf1b2499d4b1aab9b5a987b8d6189238
SHA12e55c7a7f35ccd3c18067fb8c7b28c08a33bd513
SHA2563c3c49bdc3d2a655991d63684b7b3d4dc3c679531834816918ccac82534a6f62
SHA512fbd42dd2774181d7c823c6ba9acb619e9f10b51b2382cac8b8f033e3937bcdf316c976753a97ab72c877efa8c626252f6653398f798f800133b1f8560cb9b007
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf9cecb0027b8083766e8583761cafec
SHA1660296234666eb8baa5077f95607e2779557d19b
SHA256538f2233c207624e5b5f36bc81c765757dbf2d7db7cdd6ab60b6462c5144b225
SHA5120daa3833c71fc180d6133d88731294d516102096af50f11d19395905b3fe61d4c4ca71f365e0d4741154d301c645636458704988811f60190a1c27a4935139ef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5220896934bdae55467116935a502d7fb
SHA120cf2e3ece80bdb6f63d6ef3a381fc5c1344faca
SHA2561fd2d358ac139fa43e1e707af6fb7fab87cb11180eed6b5d92346077caa0d4c2
SHA5128ccedd4d5c19296b004122f473d6bd0d12835ccfaa64f4855d80246a96447f405eb706828abde95423cdf3ddefdc9ef7630c5acb9461aec869786b4349f47971
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc4ccd0fccbb9d68947d6d7db686732
SHA17607808522025d36ccdac302141d61c089030be5
SHA256642bfcbda2ccb16600ef046257223490ba9c39c52c162c084b5df526940766f4
SHA5120318c801995ee701eb7716e0923b81f23a0f49ba931d85aadab97815b576d5d3bc6c8b87cfdba5f112bc250bd7ca4bb2a97aafc262390492cd502607cada4cbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56b79ea33e20326fc0e19f2afc54f27e0
SHA1af60f549e291c52054dfc596472b38ec0c93504e
SHA256a425d7ec3226ba70153144ab3943d7aa7aeeacf5c423b0fe7e10153cd198c506
SHA512736e45f171b26e554f9aa1fb1a2c49c99e40cd40b2fabb686fb9029e97580932e706246ea9be07ca2ec22ac77e4a4eed666e9829a6c7bd428c00652e138a27cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb7e0e5243e3de22240e25d32bf76d97
SHA1e465f613aba8b180a2da15e14074c19e0dcefcea
SHA25680bc1f868bceb04564d845ec06ee089759910d2fe7d0becbc09e1b20953ecf37
SHA5121e365f45f69fb781712db4340e73c8d0852fc8281377cc67ca8c5674d17d2b8cb5a8e22872e1f92969271453c76feb38a47ee61d4d27a8fa744319f06b85bfd1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ddda4d1af2c48e3289ff1b6f65d2fda
SHA12880e8ba6a75ecc80e4816501ced8059500cbccf
SHA256e14b57961884aae1a6fec623fb30a7ed5816a299a548bbcad4abb5c1c5a10407
SHA512b96ab379350b5a92232e3b3c540aebadc6f1ba6d6c275753d1619eede6cbaf53f9e476079923091348e22895c45f312dda71b62ccf1617881672e4747fbd3418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58dffa58b02bc513136184818299e383b
SHA1c0df923dc3f2cfe9000c19951918d81c59845b98
SHA256a4ebf3cb769964d0fb88e00c342990f92fd1da1a8437ce685b0df70b03f814ab
SHA5121aeb8756a7e4978c4c23ca72274be83ae22108817a642d89608a0d63c7c14fcc605208c7ea3a3697b9f7faa8f7bbe54f3b7d8507a2db3ed0120d2c4166f1dc5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580067b8e4ae6548611d0aa0d76fbfcfc
SHA16c1a02665fdbfabaa85236786035f1008ab1effe
SHA2567c9a4571cea4e0b3e43bedfc308fd4d48f3841d9a17793bae6be54675943d1a7
SHA5122572fcc6b663ada94827fddadbde089c5d3a49f28a00df80a97503d0bff7f5b61ef740280e7e93b6a4593de981cd19992e9f0bbe7c8996b6e604cc236a983641
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD582044ce75a8cd99fb341d599a0f17283
SHA12cb6fc12fa747e670ceff23dfcfbea59e55902fd
SHA25649dd6f7a65935ed6c4b25f1c505f76a7278bf50bda31c18214f1d60d34d223fc
SHA512fc7b5d6d5042d695bc0b46b9ebadd3b3a218d4294a3c4dc2d59714ff669757b6984a2997abc6c7b06093990d3e388f8cf5ecc05b35c51519a9696a9346b70729
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06