Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 10:32
Static task
static1
Behavioral task
behavioral1
Sample
16011ed9f7c17acc378b6f8d8f8fd78d.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
16011ed9f7c17acc378b6f8d8f8fd78d.html
Resource
win10v2004-20231215-en
General
-
Target
16011ed9f7c17acc378b6f8d8f8fd78d.html
-
Size
44KB
-
MD5
16011ed9f7c17acc378b6f8d8f8fd78d
-
SHA1
c36c1ae1831ece64b82732b1ecd49473169f9828
-
SHA256
9c09b94e0a3583701ec516f57c268c663012e3d73e2b30b859c605aee820611f
-
SHA512
7e5594e84383d5907261f9d2f73498059cf6ce5c8cd9997bcf84c71b624e3fc1d032bfc1abac078a32112d2e3432fec4ac2f142e84c434ee0964fc706b56ef26
-
SSDEEP
768:mwS0l/sGVLsk8ejW4mTNn2oDIelgefgk07AtQ:mZJtlIelge0
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD83E721-A91D-11EE-A62B-FA7D6BB1EAA3} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0fa2ac52a3dda01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e91786640000000002000000000010660000000100002000000082eadb839040be1bd68783a0177b966d8a1002365bc527d8c0682d7dd58a8f6b000000000e80000000020000200000002fb0ebc63cb57f5f224765a92cea034dbebc3491980a8cbcd03a184d9905362420000000b30f2775c3833a7f4955f9b1cd7ce50d7d0183080e83a324118882664cedddba40000000d6aec11e6f58b1a8d805342c75e579c0866fdf7ad9f94721c36a3f5ea7ee5545c456c1eec07167c60a662e3559b17cbc6108fad4b2c0304dab448532e036e0c3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b0720b1d8642c344adb870a2e917866400000000020000000000106600000001000020000000909a2f6150107ac966fddb40a85a2f1cb624c5fe5f56d6220a59b31e058e5776000000000e8000000002000020000000b21c652593fd430b391fde163f255db35d81a8a42b1d47e5d9ba5510337261d790000000682543240e6a50987057ea9fef57c9bbe6f745767fa1eba585cbb6a9ebc7cd39abffbb9ec051173003d7f954bab5629ee1d47e277d96bb9de56696d651ca333e1b8d95ac41d9b64c17b1ef7c79c605ffaedaeaa424be68f4711f0e666e059615924a0721827366ef99235f9d7ea71243381fe56b815c5ceabab499423ab486752e6a3920bbe71df6f81dacad32cf3502400000004f0482da78590ef7b2ff82396b3fc79b739c938ffdbf965dda62d6cb99bfaeab63e504559cb34cd0ee1312361706a7a6aa7fff105fb15589a65b706b79bb56c5 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410327441" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2448 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2448 iexplore.exe 2448 iexplore.exe 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE 2820 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2448 wrote to memory of 2820 2448 iexplore.exe 28 PID 2448 wrote to memory of 2820 2448 iexplore.exe 28 PID 2448 wrote to memory of 2820 2448 iexplore.exe 28 PID 2448 wrote to memory of 2820 2448 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\16011ed9f7c17acc378b6f8d8f8fd78d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2820
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1dadd8b50b4d398ea45fd77dfef94c3
SHA115d1c56fb50df8370143687aba2ca925573a3d5d
SHA2562ae0deabfbf46b0b484943f21c8cf43822124f3c82ad98bef0bc91517aac4ef4
SHA512a5c81864918e4457093b56591bc862eb2a067fcc1ad00090e9e84337d2210051d0f4fac86924e4626b31058deb02abe7057b2b28c28bcca630ff56d08f769d2d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d52fa01ab4ea0b892521539655517462
SHA12194b7fa04e4cf94f6caecc43cfc008e953afe6b
SHA256d31406ed35ac2a554ebd9cfc7f99fbcbf2056fd36b9a94ecaee64bb5617be6b5
SHA5122b59589c513c0260c71e16580c7c675aa47644648575e34f6d15e794d059684e2c61365f589ad4a30d4de19a4fe73e6e423888dcb4f0d6dffa6aa00f74375d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52a5c890858fb7c321e642afbb7434e03
SHA1420fa692f338a1fdb7820ce130fa187c0b50de7f
SHA256766dcaeba3f794379081f458127a4a7d40613377ca541287c92ce4d04b46dcc2
SHA512615e8619234ea412fb74caf9938e89557354b44bd47d690d2022540252dd96c61f95d6b7ae862e89fb190aaa9e4f3641287c5371d6591b84aaf68c236f6c3d0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521f442d17bc0b8d8efa57ef25536a892
SHA1ab68fa3e91349793f89c74302eaa3909b835b652
SHA2562534509e26aa44124f2f77d7ad525a255aed8be3086cd70f06cf3c1ffe1ede02
SHA5129855a9225096fc227638ca65161eaecf127564d3dbafaba92aa755d6e50933760ff2dda970397cc89ac885d1a7d9d4258a381c97723ad125f39e42500b667bdc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553e51506a10afa1cbb27617dbe86eec3
SHA1c45926c22e32e25f889a4810dac766d77039a9b3
SHA25654db748d998e848feac7c8a6609fa2e653cc9d26161345d32fd2c0ea5da2c277
SHA512f875343a68a5688f3ea5ca0fe9b3585442e591bf03dccc32820af4867cebd15d2c65c201e69803d539c1257e16fc4f321fcb7c5fd7b27893d482b18923a67a54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57776674a786711253b83e552b4ae78af
SHA1ddc21cbce76ea45fcc48972ae270c39c7c2a986e
SHA2563f942c872e4781cc455cb486e0ef971494cf5b74b206940f75cdf12717f7ca0e
SHA512451521957218171d3340f87a996db5b993bf0b842ba6205ed7e396a52a27c92e1341e14389c6e0d6c9e9253b9df487d1068c116ef3ac99ad6cbf712f892a226e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5846e579d3352788ad3cd1eac3709f441
SHA1d3327229f107c60a3d6da0e3bd97bb4a2c853737
SHA2563423419c98cb0d58e7b11dbfe9691ed28416295131bbb0b1d7945e70479592d7
SHA512b4be2739aedacd068456420bb3325e4173f2044d63f106bdec8b74119b7fe6d81b0e209bccf5af777938390d99b6794cc315820f289ac0ce4259a246af8bee64
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57c69bd4732ee88028c7b2b668111a4d8
SHA1af7f529f3682b3941e5e3b0f859158ca6c37edfc
SHA256c58ccd1e01cd168f3425d9d73188a4d3511e795885ed7dd996757d8ddc0c8986
SHA5122a4708b45f5c8884a4ec5a9dd2d3082f26948fd3e71a306fc6631a79e80f70e2f9d91c1d89773443c48fa581f6ab510b13773e8514d4f784838273e0bf3e0339
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ba5a4e90eda770e46bb8a660aa12df0
SHA13227a037900b6c382ddda83a5a23f94d332da9a2
SHA256fe41f626ee4394a688d944538a4852c57aed9cfa6bd57cc5e0716bf0d26e7737
SHA512b7ee392b4ccaffac6f14d2dfb3229a6ed7da99f662e92d6e8678b0ecd52e67f30b5aa783007bc541a0bddb3791138a4b9c7f28d79f0f4f94a815ee2992c121b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD570a2c89776ce5b164ec5914513f6a770
SHA1e8e57d83753b096b0bfbd0692fe05a347278442c
SHA2566e879228fac3288b20a098fb12818c7527c5cf3f3aff4346a20a22b66b303dea
SHA512ebad3f756b8145441e63f9a3e61410fbcade094709f35334a05dd5eb54cddf76023de05249321081b9d141ddaba5377b72af86681eeb76333457f8b76de7221c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aa8ee2dee06a54679dbab61371fde3db
SHA1fe4280eecb372fde5f4a1abea1b7ffa1316b8ec8
SHA256b2588af6a67a704384aad29895693ee1e9b005d63b6ef13e8171ad374c9f2c36
SHA5125ecab9b4f246232e4939789ce86d29b154812887a97e20a8b2d2deffd968330daa9f345b00211632e8d552c9d2cdcbbf0f31673d11138054672e501850e87ca4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b938ea96b2c81c48965b460b0d2165dd
SHA18ad795bf7711004d81624c4fe71226ba5a2cc648
SHA256caa83f7a94bdb3f7609c70ece63a81a17dbfb19c33589aa2813433cdd7302465
SHA512eff0c16d760315802a3d739c6cbb8cb0da77bbd7de4cf44eb03c6f36c76960dfa41a57ff3d3ce947c121841a4f4f057baf22d3f02d60797f53d74c67b8bc6e9b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5753b996448c1bb843f960a3d2d5514dd
SHA1d5245e9edd05602a544c1d74271a7b5f0b48160e
SHA2564eb9f8ba445d662ac5934551f93ea02829d5161fca81f732933ee1d9d00f07f1
SHA512b5c54b0df9fb9d35fd5fdcf0d452987bbb4955ca226a2eaa1f54a42dcca83e7340807de94efa0e9398b9fca0ea178ca29648d2b76595b9fbf3e2d547717f6648
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5afe9cacf2c030900af6f1ff62679846d
SHA10fefd908561622ccc9ed1c243c56ab96aacb4f4e
SHA256b4059aeab4227dc481cfdc159e2d2b7f17e003b0ca670f64c4425136ec1a7a29
SHA51275e57287ebc9de1a4cb7cc9855e58cb662a36ff025e8e7e58513e841a56b690fff76c34a7174ce905767aed3afbe67bcc7fefd1e8decd6985ece49536aeef731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5872539aa6e1d0bf346b408676ff10b07
SHA1398ac643fb5a5e1c494c1587ebbdba7bd8a3693e
SHA25666a0a1330bc2f31619226213d33544ac49f84ecd62980806144f5b4e83f31332
SHA512d304163544c44ec9e8fcd34f0efbecf453fb3c8227efc42b88970eb9cb1de10c4fb9b04168587a9bbe13f4c682de60a7aff8481f77c2961218f11c903b372c62
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a9c5ef6c299b6db3d02ec57ec0dc6bce
SHA10cf9a1aa6bfaebb543229369cf26928e3138253b
SHA2564196a5c3d6954111a69976298711389775bb426894e6bb108ad8cef7a0e0d878
SHA51221d4691106135110355ecedd8474670791f2d2a6dc7dbbd3196d3f0af6cdf128684819a04ef6348272b929239dc8e2d21c046cacefbc30a4880e217c46248309
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56be8cd0bdf9dff4330fb14510d6f6722
SHA10e0b21d262e6c6131fe051f523ec5f04845b7091
SHA2567f52926f129e9600b1e7eeea65ccb29dbacd6fd527dfcaa9b629b7337cbaad2e
SHA51286ac644ceec314b963ecb7733834b274e57a9db116d33159cf0b256b54712445f1b126c74862933aa2e836ab87ed16ebf1914d023b6bde111077bceb1662f9f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5299c966876712836337d01436938ebb4
SHA163f21af5557cf7a9cb67643b63f0030e08fcbc36
SHA256dd5dd15420ba4ecb640be17361867038d6686eb7e896cfb2a349b353e0a805e4
SHA512b61870855c39e4a86dde975a07887b31e35afe43290575cb04ca2e655b4d8a1d7a7702ed2d2873b11b5f6010ebda9d09bfc4db98b67e31be0b88a6faa3d72c5c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06