Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27/07/2023, 17:41
Static task
static1
Behavioral task
behavioral1
Sample
newfile.html
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
newfile.html
Resource
win10v2004-20230703-en
General
-
Target
newfile.html
-
Size
315B
-
MD5
a34ac19f4afae63adc5d2f7bc970c07f
-
SHA1
a82190fc530c265aa40a045c21770d967f4767b8
-
SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
-
SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC72AC31-2CA4-11EE-84CF-5A7D25F6EB92} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 302d45a1b1c0d901 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000000bfcf4d9e349d33a626b241b2471dcd2b23b01598caa00ce9143e9b95f3f5590000000000e80000000020000200000007c1c2d8ae99255c564718b144dfa0a1b6f5d1145f2d5a7b203801ae41523a04e90000000226d2afb627d4e9db839f8a773a418403a551209a54a7672a83ba8dc21bb5dc4c55429250938fdd59e2e1a0da386507e64e7f66a519d5d34c8e8b67e9e778feb881c902490798ee51bcf381944e3e93cad1de6667591313c011507c3bf5e8084387d16cb381c7e70cf5556135391e9fe3dc5ea84e932eddba0406bda5d96fa42dc269c313e7f15771fc6b37b42cd81ec400000008b1686f69d602a9d6b90672a8c463c2581a804d8add5bc55b5909a74e0cd9400f57331cd1c67ce71334a688be96d8c657e6b340970006bcc534c7fd104502344 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000e8664bdb653864eb3b20ffc0ad3b021000000000200000000001066000000010000200000000160147a36299b1ef1b197e585121d1b2513433fbf1696eba02ad49612696c73000000000e8000000002000020000000b5cc7e5b7e5cd9fafb37dfe021895c8bf42443d980845e49967f7f70017d7f0f200000003648a9d8673bcbc9d2dcbe0df79f801079be79b646f9d5bf7371be1ef2965a9f400000000f9b44caf0e5b8dcc29059d40cb90550079ee83b16042b0209ed1d6405fb48f2014d0e6060f782d534849ef7537a591ff2060f8097265ca8c0c3e3ff17554241 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "397244655" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2200 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2200 iexplore.exe 2200 iexplore.exe 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE 2852 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2200 wrote to memory of 2852 2200 iexplore.exe 28 PID 2200 wrote to memory of 2852 2200 iexplore.exe 28 PID 2200 wrote to memory of 2852 2200 iexplore.exe 28 PID 2200 wrote to memory of 2852 2200 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\newfile.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2200 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5728a0993d731ab2f3f15547b16a0cd8b
SHA1cbdaa01755c2218f6797769c98de66f4d05c4055
SHA25695cfcda62a6a7cca25728aeba1443069680877286de3116a838828a63dbf44e1
SHA512e3752fa7c5bea5412edaa5eded749cbd03f6eb812a64db191eb162d87eada1f49d460f21d299864f16e47051dec723ab02c5d0671e49f8fc0eee83bb3d9c0b4c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5366e57f7c7787ead25f92fa6f9b1e1e1
SHA123865c1ebd788bf690188195d8c3b0d235170274
SHA25672aa544db4b53b984ada2330512e4984e9e37a49cf629381b0b74624f79eae4c
SHA512f85be78f45ae9641828ad9dfef5dc6c3a34682cd5668bf6ab7269dd0d8392882ab4838d0d2a6e914ca5ccd5d24986238488eee731f694f8f95deaefcf3a86f17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cb6b2ae8abf6fad1fde571db26ac153
SHA130247e5424c6edcca19cf569ca6556fb5027eb8c
SHA256b625bba931a3938adeb29c331d00bbfdb6e7b31504746eb2daa44ee657fcb33b
SHA512aefd8b52d8bb6c6b9baf7bc88f1d7c87f86db10bcfdb9ef4857ea561654ca423049c61c9c611bd37b707ccbae82b09ab26379327738f627868b191c6a86071cf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e6e7abfa82b33ebe8bc203f01f1a6f2
SHA10f29a2a1875f5e04d67661571f7eaf09feaad872
SHA25668863aa8411c55ee61aa8dde6c89376322221fa199d1dfbc2339dc77c76c4274
SHA5122e3c62882e221e9139de95bc62e345bccc627d5ad29b7c6e411b08a8689211fdbe9c94c19e5263f0edcd5f7b1dcf5fd3fd63ae4aa491ea2b5addd977cf2b7c84
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5efb9786bf1d51b245a47d0844e620e3d
SHA1ccd9bcc44a06fba79e90f22f4c42eee6de95b3fb
SHA256e9b5b52f08da46eed57f3f69a619d1f3c103b44fb587d33e560d2e5368f9b9a0
SHA5128f2d0b0d7382ffca000fafab62319143c3b48a280fcf4ee7fd3b7665cc493abeaa94ac96fcc00b9f4d3a21601e8686b59dbb31026667ec5cb9ed42042a6af756
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586de5f5a7640239acbd30b3b8418f8db
SHA1cc3abc7842b055f1397bb62fd10eaf901a86feda
SHA256099bcbb4e94ac0c553dda5e8da85f511512df4965995b38cc21626259fbe8932
SHA512ffa606d30045bd5bb7898b2b4bdfc739c329d3c744c377a5b82e147adab7927c8506ab7472f32346a90d9cf47ac6baceab4b2fbb0a255b7119fff2cf12abc2e0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d92a0438baa5aa6f77da5afeb2820296
SHA1cc44f9806d083a7543d8c83515d16a8afd199092
SHA2563f90cc001ce408d913c2bd632e2aeb0749fc2fb88a52a9e050bca787051699a6
SHA51291d8f0f542340f0a9aeef65e185e3c2a19ed3583e736cfe5386b8492d6596014e1c14e0864f0743e268ddf8d8aa24190cc7a7dc222a91fd8078bf8a118139f73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5481eb491acf5e6174bf8812d06a83a02
SHA1b73b013e9d044a8f3bc701103346ffd50875fe3f
SHA2564760b50ae4ab7fc8c827793011b2246634b7f214fe788665456f2377ba22bc44
SHA512239114801208eff3d4e12fb04fff0a1321a77fb6bb1c86f9d3282e8c430a2416a4f9f44a6901ee9be9158508ecd105cfe855db7f2a3230a7451f5b87575dda42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51d5dff448346ffe4488e6a3421a86767
SHA162ea017a4342601c79abdd623b3b6dc3dd90b84e
SHA2564b80eca9a5458a546d419dfae12bb8d57bbef9a483f7c18d5b954dc518300749
SHA512a9052b4aad8a5c3b85ce84ffc951f4fcccf30aeed01b601283981ed835a5dc3060d5b17ec470b0984197aaaae48f626a1ab3eb9c1a2691a893808eba673049e7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b4d02fe870abc3f2a74abe3721f8b586
SHA1e8b1615bf100df6c68bfe8ec235b5db6c3d14ab5
SHA2567f520544567a392eefebb5e9ca7754a0c44976d558832cda1e3a1c9c3d8931a0
SHA51240dc8222116aef58b2aea66114339eca0bd2582ce4e379f3a0848e046ff6208fcda93f76161a9a5bf8824eebbe037b797b7df054b9b1ef34006fbd7314489e58
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U6AGJ71Z\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
608B
MD5b04b77724ba582b775a0b1368a3e4cc7
SHA1367dc3540ed3a13566f295c5adda2daea4fe75e6
SHA256db14aa4cccae274db159fd0bd3383dc5b4eacba9fe4393fc03c6a75187224e19
SHA51227f99572f9564174ef5a8f08344e834e7c08c47ae6b3c8e20a0a5c0c484fcbf731b4ba478fea3c2ecc2699ac749686b76bd40401afd3e23076461859aa791d17