Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
23/08/2023, 15:48
Static task
static1
Behavioral task
behavioral1
Sample
sign_in.html
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
sign_in.html
Resource
win10v2004-20230703-en
General
-
Target
sign_in.html
-
Size
5KB
-
MD5
12cabce7b03655fae4b89a9346020f95
-
SHA1
1464bd087b9abeac16daabbd6a784109e11b608b
-
SHA256
2a60c8ff721665e3c6ea75d4acf535ae71a5bc247336e69f510ed9b80c56be68
-
SHA512
1203b1eb6ab6745002d070a2dc36cb373bd9b621fbaf604abac428dfebde4f9c093976cb3ecd37762ddb60b067df3b2ea67d14fdb2cb6eb4fa71192e076b833e
-
SSDEEP
96:PNysDsT2f89Ixm/d3sJtTMhL2Sx8ujJnbXJJaHjszSTTr8/zNaYzueh8wtuN:PN1YT2o8oZAG5YARbXXryTr85Hy5N
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{839B8F81-41CC-11EE-A917-76E02A742FF7} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd6900000000020000000000106600000001000020000000a3ae5c5afba3f41cff2634fec772c3ac6cf39b58c61c3ac8683960e46b3eda02000000000e80000000020000200000009983126da27d029ca6092ffd1518e86357f36ebe9e7bf7b0e9880d57f3d5934e9000000097aa4bcbf6e3f053df7ec023e889902afe00cee07540d85c8c9a7fac2743271978f5c309798cf7b17e8b818208a1005c51fb8e264c512f070232acfd5ad10e918facd0f3fd32a55e0b942c61e4b71fe04fcf0177bd0380686994d629b88cb36f4fadff3f69b3180643dbbd20793405f76d49e9927c39559e68b504da835c4067a77f822066dcc6d09b049b985ca6eed540000000389665bd95dc323a2635f0cf57293c1b992297f4182705d4794d89d1070ccbff890f6f5ffbc088405aaf7040db0345bde48541d7a2cdbbbe5d1811f8fc28bdd1 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398967585" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000081fc177b9287ed4a8181eac127bbbd69000000000200000000001066000000010000200000002b2ca337a00a98cc2b897d9529cb9c46a6f3998d401fd5ccc85fc72878c458a6000000000e80000000020000200000000fa2114a9f4d05f0a69a891ded4508cde5561c927350191ba50ea2cd835ef15120000000b44294aa2b97186976f671793e0d5e4009bdd37d392916495ef85581a4a9e98940000000db38135f38c388ba541ad3c62cdabbb44226ace2a5fb1105bf09c65e7505529f1afe9d636ba814783d2e38d14fbbd45c719a1a557f997fa5724a3cd5fd203dc9 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0d16058d9d5d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3004 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3004 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3004 iexplore.exe 3004 iexplore.exe 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE 2916 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3004 wrote to memory of 2916 3004 iexplore.exe 28 PID 3004 wrote to memory of 2916 3004 iexplore.exe 28 PID 3004 wrote to memory of 2916 3004 iexplore.exe 28 PID 3004 wrote to memory of 2916 3004 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sign_in.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e56ec378251cd65923ad88c1e14d0b6e
SHA17f5d986e0a34dd81487f6439fb0446ffa52a712e
SHA25632ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0
SHA5122737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5075ee669b6037a4bd69a114f31eeb902
SHA10abff1c9f1a46a1856b15d3d2bf8807a67538d1b
SHA2565c04e366ec805244eb6efc984f244f3e7e15d718e9fbcc544c26d839b7ab5fe7
SHA5125c8eba2c7940a5cbf8d3f1465c31b1c876d479973fb3de2e6612f6b0e72dfebddb852c77df5becc8e2d3a4000d2c86d14553366af87252e7c1ec6e760b31dc15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513422e242a62461913a486d45701c2ef
SHA1d1d5cdf603a392963a32e0d13759b847e37e455b
SHA256d67f5670bd0c564f54d3a3fa05c350e1a7b61c3fdc2a486afbb0e3544a1454d9
SHA51245713d9d9b9a217bce82b5a5a9e0b9834c854fbe705e3a6d92278039745f744037414ddb72a1c79d05c594f0b86a4657e64ef3b5b3ae1e739cfcfa230ad1df29
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d04491c8220b8efe7555a3afa2d40c64
SHA11c9f0eb7793f33a97a6caa03a9d23c559b875192
SHA2564723780f0fa63350aa2b813a0bdcd9b752498978679409cdb89c26bef21eb6ae
SHA51227f452893abbf193a813ee11e3669a63eee12c1eb193e59637288911a007642f7604c76387eeeb638fa811ef9ee07ed3d76344a48da64fab67154d51559db005
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56bff2316d6ad5ad23ef9736d3e3df23c
SHA119a70080770eee528a779529523769480435fcd7
SHA256a19c91fffb407fee49523a2c1f76f801d7f0f0cc0b28b8f0333ee9f5b814f517
SHA512a20348fd6d011a8a88962523e44bcc4927cb3fbc45b6bff29b3b09efa2139ace6076645844325bb0b9038b07e19ffd6e319d3f15a1568059c670607a730854a5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ad094422c0fa9428087ffdd8df33065
SHA149f350fdfa09928f51096f9811d7cf5cb34790c0
SHA2560ee88928235122ce37dc360179a3229516f6c1c3ae14943da47d438fddf750b9
SHA51273adad2e04aff861bfcf5d4503c8a4b6fd1b711ebca2c682b9e1ba04c790049bba690dc3a9ba7300c7d00db537bb28d5f245744422f1e0b70ca22515628e56a7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580c0f8f3dab5bc4741ad1987d5992308
SHA177e71e605c9498922f2f6b54dcb1f24efe235d23
SHA256abfc390ab156487e47271da7686908c75cab0cf2ad2f6989089ecf37a1b71f59
SHA512773d89f779e9d958ac11fea8074862b4b77502c77eec851d81b7d1391f8103c5ba37aa6e5455120581a640d6b8236e91a5dbe812c3dbb9c519603863b538360a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f78425d5174c4c9c663702e3de0f4e33
SHA1372378046502a2be2671d450739fd9b424667618
SHA256b9d1488d96b6f9bc9675c05ae1816a1e54e983ebf77f256c011b262fe0f03744
SHA512603c518a53bd635405bf835b569bdd8e38486db6a01adfe9bc543986a475e12366ab87099a9d8081e6c1eb26be4ba482f1a238044e59b756b0848d56cafb364a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5636c4ab0cc5991c13a6f99054b1dda18
SHA15a622d5ca71df49e6e138e30dd38f0596c9ef735
SHA256e16701b47bd5df52476c685bf8278c11b8378d52c6a80877eedadfc6d4aee19f
SHA512fc94e5c383f570deed547a73598b97e4e9a7224f4afcb4413960a27297e9b4c84d321d0a0dca0f5cbd4b7f1bfc736810ad3be8b3295a3eefcdaeb4a191684654
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5370116bfb35e835707e1f279a11723a8
SHA121ec26c26a1f45b44d1d140d2bd5c9017a2abc20
SHA2566a66394ae62326104fb9811464d7aaf1b7923b5d94a3eb6900d699f347502d60
SHA512a6e783b1968383d3dfe1c773a1bf53b7e0f89eb7b38aea3f8e0f8318c8ba275357819fc61fa669868fcaf6c17a402816f302cecc38b6a848eb8fc7a4acb9d62b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b38f7cbc0674aa50bc5bf957c5b63ce
SHA10552ff6ffa03fbe6651d10f1b9cf89c633c04686
SHA2568a2a788191e3c6e7775a92ae84ac7fde91dd15bec27f0be62c8ad30d0fae995b
SHA512f97323c903afc09fb45ee359066ecddb793ded7d54f01a0a1afa2b3f43fdaa410f9d2fed81026003cc7a31bce61ca9829479cf44595dc5fb0bf7cd8a979a69e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD544c1632c69da55d931529136c68fb507
SHA18a34470c03f456055c225712c3406390110d338e
SHA256efd05fac68fb28562e67b8d0be5e9ae5f9ee45cad0744761fa563aaeee1e5dab
SHA512712c08124ff7595ced06e6716207408b2ab74599b497b60dd40bf5a382fc8604a418bc02e175db18971bbbc42e1231b53c4b5b96eaeb21b82a6228c717faa63f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c9af2a6ad7d38d491e35537bcdc6958
SHA1d28d02b9a8b32a62ecc9298b1a5315632f837584
SHA256d7738359c1f403d29955a31c3b60da6470d466c9358b65a433ff94c5826ffe83
SHA512552e30d451eda56c7afc8897ff86871fd6c3d3cba4fcdece429e614dce7a3572615db0fa92d7e3c09baea5790818c9790927536f1cff084821425a620575e062
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ad405f65a89ddcd4c0aa45eb695b3ae
SHA13f7ba397789f1b444169145e7a5ec6aaf1e87c03
SHA2568370b3429b2b3391a8016d4156e622c30509243b3ad23733e9c402aea601739f
SHA5126b2eb6e343725ceee80338e5a95fed4e1afb8615e08ef5ae88db1c1a1b43b3c6e782ea53474746bc88900320724e7acd4262b8f8b7edc4b5160cdd07293f9ede
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53e8bcb1ad709370ed06aa14d7d47b0ac
SHA190fdd8c30613b6aaffa27b9bda2b7751edbf656b
SHA256c8d01184189e25a7c47e801033a34eb26b99503a3a2f31d27e8197af8a96da9d
SHA512918913a2f506d44765f353863dec0abc783cb58716ee0f3524e200f21041ba66c16c01dc4ee427a587dcf3255caddef887545d147fa7d56d1d4f244ecbc3f008
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cb20a4d92c480633a209eabbb14e9411
SHA1f5b48afeba3b836c01ec43c73697ef074db07e16
SHA256a19c358a727eed0310070f831bf782c0a47fa68353eb0882e91f0c64417be178
SHA512235d183bb0c6d247fd19ca9c7d333fd93cf8ffc49eb651245be3387449350d99a5bb3dba30ee0207161f1d41477b4729cf950b9b1bee639c165937be7eec9018
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b126ce5f4ddba6c5d90134c6db360f1c
SHA11a4259bf9b7243e8fbc9113f105f465f035302d8
SHA2563504d6d7cb99f2627d52fb59a23260c944d8fe0120c7f7cdaa46b50ffc1ef44a
SHA5123bcb1788bf0045bbc5ae73253df34d75dd4d81b8369085b3170a08738545abfed0d1611f332cf86b418713f9be13fe88fec64e440ab0049e4fd1e5bffe2589d3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e419211c985982c280e8cef167c3afeb
SHA1aeff18a6f35341058e6bb9a7c7fbe9edf58bb002
SHA256a1b2938b99e34ed5d71b8f3583a4bab9b5d6f853f69e617e9c981ef60de6d532
SHA51264da8f5f1ba477ce76ca390192408751990aaff11f84c5310bea0d7cbf88c30b71ee071f867e1f865077e0fcddc13f8a7c6f9e50e23c0493f5a34fd92e51f146
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eea0b9847e31e06b8049187b06a970b6
SHA16e708f8a959b3944dd893229bec6faea7d785b03
SHA2563e2a2794b06342aa02b858505232e5d5340713f9be56770897a32b50b08d4303
SHA5124a971b538bcea759696ee2a458ab1af7a184434e48c37010561f4c725d4168535c8b51bb956f8b09399f798a7ba19c20052dbd70d0bbe43e819d5f9196138d87
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
163KB
MD519399ab248018076e27957e772bcfbab
SHA1faef897e02d9501146beb49f75da1caf12967b88
SHA256326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9
SHA5126d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103