Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 17:04
Static task
static1
Behavioral task
behavioral1
Sample
073e4d3e8a449ae47097d9e35aba4350.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
073e4d3e8a449ae47097d9e35aba4350.html
Resource
win10v2004-20231215-en
General
-
Target
073e4d3e8a449ae47097d9e35aba4350.html
-
Size
53KB
-
MD5
073e4d3e8a449ae47097d9e35aba4350
-
SHA1
64bb312a0f3a3f06931442bcfaf9776f0863b10d
-
SHA256
dcd52cef9a6dcfb0711d6c72fd80187079469b0ca5f163ae5880d060659f2369
-
SHA512
3af9b2f0cce71cc0a11491eca5caf72b7c08cf161e53dd632348cfeaa525db7cf1be1293cc77ee8acad94126fd96e88518dc8fbdbaf1c7a55a4ff8fa12f8d1db
-
SSDEEP
1536:CkgUiIakTqGivi+PyU85runlYy63Nj+q5VyvR0w2AzTICbbQof/t9M/dNwIUTDmR:CkgUiIakTqGivi+PyUarunlYy63Nj+qH
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000ce1ca48f41069095622402863947b4ea43ec9a4c896a9819a1a0fb9fa397796b000000000e80000000020000200000003545a2c8fcb73cc2297da4d6bfedec5d6bb502d591892c2dd3924a36dfaac871900000008b80c62367dea1d1d545eb93b6e42f2706ab79edecfdb925df525216b50a2fdd9afb13657d0a90172c0b42729386e59c4246ce0968bad514839b43c7a7cd5603438456f67d516f3d5c05c2d31497f31debafe1d6758d59d79580c38879c149c5c6d284e23465d2662c19a8b60143c3ede792e84808935fb87f00f160433061d74e9cc59c94977e56bb17f004323990674000000075d43adabb588ab695987814e8c52d4bcfb48ada29ed435132d59e932ec6c75d298f2ace955ac1e99b6527373d2488ede5573523c2be23fb7ca91491b69c98ac iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F3E55511-A292-11EE-A552-CEEF1DCBEAFA} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000a452e292cea158acc1efde4dca8986cd57f4577fec802c534dff283067bb46be000000000e8000000002000020000000af8f0dcc52f618f8ffa3b9f86abcc9addd3f263d44b40f395d0f72cbcdcce73820000000f227f7330e9f77f3736cfc608b1cf934ab49d2c390a81ab7ad673256f2469dbe400000005607bfa2285751f67ed936a977795b49ead32a1cfa95b6d8f516ad0434697ea66f011865d43e979d1d724498fe06a2629d6d270b7d64de48288d500db1c5c017 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409608125" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0dd5fe09f36da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2488 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2488 iexplore.exe 2488 iexplore.exe 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE 2068 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2488 wrote to memory of 2068 2488 iexplore.exe 28 PID 2488 wrote to memory of 2068 2488 iexplore.exe 28 PID 2488 wrote to memory of 2068 2488 iexplore.exe 28 PID 2488 wrote to memory of 2068 2488 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\073e4d3e8a449ae47097d9e35aba4350.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2488 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c70a5893e9ce37dd635ce5fbb9541f47
SHA10c08a8c6184c39b66fe09ed10849d3e87cac7816
SHA2568531a60206050080a9f0b59930330f936dcaac08c9a03159f5e6ec20e6f4f414
SHA51256840e5c6ccbdf63b49a53c065c06a6e1a457d276b4d460a24ada3694a4bcf3712e375fabd79425ddc3813322fdcbc20f81c9bb8b3686998d5b942de117e71f6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583c982c816a889c0fc1cf6a6207920ad
SHA134d187be41ca94fd5833bc5fe2c5a51f32b69051
SHA2563d5f06f87800251bf86e4daab33339177e92b8fa2a4bb60240d81e2219e0a550
SHA5125b84fad65bdd905129b2d479161e09fa02e8ce2eb32e3f85a9187dcb5277e3afa77df7ee2194f9f13b97ae8536a5c1dc0d282286efb6a6a7f5cf5abd3cd043af
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD558f632e0c1d47030bb2a6ec249457183
SHA164d716ac1b339a5caa12064c7b55c27d88f90c78
SHA256ca2634b51556c2fea69944169302e161ab155e9244205672c1580a8617d888a7
SHA5127717bbbf0db1099ec4c9cef6390c6308890916d5f5ac7b665fdf2c969e176731257405c57fb117fb54a18240979cca0ea9bdd81d756c28fe16e4a3dcbd01745a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c4e526da58f69b9b8b68618605b9032
SHA1d8e8378c8ed7d4193eb070bf0c415654c841bc74
SHA25688f9c169efaf626ef08bd253393b829d76e4f13a9fc4d24b4c9cc33a2cef83a7
SHA51257132c8dfba61c80c45d5c1a4942b08497deda881b6772a9e5e3e2aaf325c9cde58b652861c2530abc92057b306a1e08b2566e578584f15180775a298939ffea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dc309312b123e61cb8c9f1bedfed6d16
SHA19de9c69b7e64f75903e8856abf074c546e8ae01e
SHA256e9f071430a86428c22744e999bef25b0cddd87e0c2088f3ef454a761900cd64a
SHA5123bb4d0b6039d73a91ef83d47eb5ad2d09e4b9bdb2da1b9f1242a32f2d8a072cba84377329fc6541fe6e6b5c68a7d1a77519fa9b644a83488cb57f33708dbcd90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579ff293de6308eee7f40c7150501f54b
SHA123a991da26fab40c7810e49b152cb69799a1de58
SHA25639cdb33a97c89c0167e8b4fbc57509fc8b00c1b83e16495416c2df5e3a84017f
SHA51257ca87104f429cb338202df1def1814298b930dc074b1d85da7a1379a7aa219733a0f719e688aa313f3864f544e7839907ee40c1f9dca42f215ad9da8d276e2c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548ef57a03ff10df2a69d98f1380fab09
SHA1eb025697a3fa2e835951472fbd6ea033ad431d34
SHA2562db3660149adab7266ecb9e41c63b7ef66449451d029d2ef8a816ae1742d53e4
SHA512bbb18dfc356d6a8d3faafdce67b924bb65c8b3cd3bc6848a2635fa349889833e6231ebcaf11dd32927db8fd899d8303bad5a4ef7f2e0a235a06870b8f163e8fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eee3a3d3c61e6858d6369db9fe34106c
SHA19b351477f66e112a486181b83a6a5429be26b5f2
SHA256541133967bd9a2dc469bee524b3a33dfc91842ae3a848bbe02a2da64359c0586
SHA51209d3df4f2d14f7fee392092f9552fefa03e7c0c0d523d6b19c91185d27579cb08e2f8eb7fe2073e90e72f48d278b2c283cf6594c584e62c6e60f72fbe8ae5ba2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efc3373056d1e8cc6523ee8631845667
SHA1e4b3fb36f8feafa2dfbc7f738ab208629eb0a4dc
SHA25613420afc9fb2ba6bcada2ab193687016261c7cd4d365716802c007a328dd1590
SHA51238d299953e586d49606f23a71c810f9cea1094fd848c203395e9ddc737906fe7703dbaa3e577ec8cc82bf7e633f921e17de45b9d29b8d113eb8d0b31290c86da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d31b9d698d8511b0261693e7c2999fee
SHA194d335fc828d6d6badc8d40dcd62e46833a15263
SHA256d17fc6c086022aa3278c60b77ed11cd188eeaa8d82099cbc8d4682cc3f5086f0
SHA512af3fda1c0e1cb1f7377d74d57e655850b7c7ce89047b1835c5e38e26428ba2f0d87df421f16582d63cda3fce3ee17c0ecff812dad9b219263899a78229a508c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD578c240c23988b957b3ad15f74cc1df4c
SHA10d8c4a5354b31b4c6ecba53916d1a1a6e55ee6ef
SHA25634a51ac85cf9f1ad01b44bc8ffb5b55bb5436fb4044e87c2bdad06ded4659715
SHA5120e828df9f0f9b0534895d1aad8fd45368b83540607db1b7b4f38c18657378670444362834d7e672359601fcadcd9c38f20ebff5cb1f00cbdb37c12c4f97f703c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50e5a57c70973524627d8bf4383a5687b
SHA17ae256fe691dd1495aa2b6078bbcfdf38437ebb9
SHA25675a85c9dddd8b99a4119e525bfba1fb60c8ca32b999d5d1e5a03e0ca75c1e548
SHA5126ee1d13fb56133e87ba652aff24cc66a2cd9906eb7dc9ae8790926a5226ad0e76c1a1cb4e35d92fd7705c7b2fe719ae0c9355d5987e732f0b9ec7eba3b0fd4c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546bb642da54411c9ba7976dcd0e8130b
SHA11c872a096e616aea1a89d0c17aabe4925f392848
SHA256cb0c2f193eec4a953e4feefedf094964ba4d7aa122d306e412c34121ef91420b
SHA51284b9ee448d32f858b107aadeb52152b1fc21f30d35aa2588c635a8c542483677ef9f3a5b716fc2604ae95d6196e306fa03943f5014a42db59e2d8108d116ed86
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50ee7a86d75b78a2958ba648aa594e19f
SHA1d41772a946200f552ee95d3872ac027de883cf83
SHA256dcbc1fc1b73c55f8218b2b7d27597531de641dee04d8789bb8d2d1014c02761b
SHA512230472d26a6d39ecb9ae46db1a54a40bd9c595e3f329fd5645179b23999d181b25193b54492cc937cb00730b54828ec264896b2c4765fd1e1902fbaf6356b14d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54eae684405f0365096d1cc3a751f6c60
SHA144b4a0e38826d8dab213b24220f9ab1fb33570a4
SHA2563c69dafc2c6e886d7396e4a11e79eda23183fd74c2310b03b87dea30bba0f869
SHA5126034bcb8f61d2a1056028530c4b997510c55e28347eb0c891447dc1bdb71d00c0da22305e914af8100bb0187d3edf81e332b090d710630ed951b6d709917cdc5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a05b1300e9e0a67698fa362644e0ca4f
SHA1f57633119b069fa73b18558a5aff32f7cf09240c
SHA256107555277ddffa93e6018c774ed50672d48373190bf73cd06a744fca5c97f43a
SHA5120962f5b7da40d93de24ab761dae0706f87c17bdaff58d83802d8bace1954b201870959652e3685e254b868ea67fd539d2d7206b1034947934d4e4c4335c0035f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fe3a0d4dd9005c85f8553c40d054f43
SHA19257c6863bab25713de8cbebcede615a5cc4b3bf
SHA25671ebac5c200c13aef2aea49c84da4bd3889ce9b4a8cb05902ce03d215fdd7c93
SHA5120583eb7ec62199419908575f2a83b4bd4c2438404f694688cbe37a46c51432b7d4c774841634f1d5d1686a01e55eabab360ee71e87ce2f8df4ea175e2ac4756c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YV6H14B0\print[1].htm
Filesize706B
MD567f3a5933c17b3ab044826d3927d0ba9
SHA15957076d09bacaa6db8ddc832b4fd87ed8f05f8a
SHA25697e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64
SHA51203ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06