Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
21/09/2023, 07:23
Static task
static1
Behavioral task
behavioral1
Sample
warning.html
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
warning.html
Resource
win10v2004-20230915-en
General
-
Target
warning.html
-
Size
2KB
-
MD5
a61e2a0530bec9b307c1075f9162f549
-
SHA1
267f3fabdf909f341d2e4c57eb17f9226771b61d
-
SHA256
c0c8affd1c31a341db91246ee7f281199568d8ba6ab8e3e25bbc0b791276f351
-
SHA512
c5f3d0f2f3bbcbe9893beca5177a343d43904eb4dda350c45ea6fd71b8779cc2e033f72ca77209746dc41dfdfe8d3d3df906cb617be2054db022fd60f32389f8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0e289985cecd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C398B651-584F-11EE-8E0A-7AA063A69366} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "401442878" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000c6f084e42e0e219dcd788136744c57e3edcd3611a1841247e10c288463d8607b000000000e80000000020000200000000084ac3d691d749cecf496cfbb668fb44e5b6ea67519e4536cb6836f7645c86920000000d1a23179dc49ea63c5b2e08ab928717cea477dcb49a7f71f6951850c53777cc540000000dea6aac2c346f3fb37ddd82e3ca00e2235d11025d341a7bb03253abeac70b4025eef5329b7b5b0044a9894c891df4b85aee37a01aabe48650311ab725c42163f iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003916b9f19191c547a3cd833648cc0b6b00000000020000000000106600000001000020000000c18500efa6f9531f4bc2089622744f543bcfd49066356cf81da060eb80dd36ce000000000e800000000200002000000071fe9b2f46eebf4f730eb8dc140c5549f1641ca5a111063d0c880758f371be1890000000b71015e5f29c307caa3fb04ea78019c80eddfb819d8fc3d7591d31530c0a3fe873ccf5e5fd1ea37c75fa96f934f706e7b178003ce8b6190af93004448a7bc73c2591e2ec3c9c9ea7ea686c529a60b88c2be22f8e8c191575e8815b9b2e461cfdd640d326dac5a17857ce00bd5a4a06a3e95505fb35f8a006ac39a851e2d399a76d04c00beb7fb00b5abf799ad71a6a754000000032ab0f7b38390341029ca62825dd03eac4a0fbd6cb52f53f490feebc7ab3dd8b73ef4c2e4034c40fe6b10dd99da7a202b863ec7fb56e7a46c4eb72fb2c243189 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE 2704 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2704 2236 iexplore.exe 28 PID 2236 wrote to memory of 2704 2236 iexplore.exe 28 PID 2236 wrote to memory of 2704 2236 iexplore.exe 28 PID 2236 wrote to memory of 2704 2236 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\warning.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD53ad34a32e29c7b47b83ce65d13dfe734
SHA1d4e1191c18a89d26ba36d21bcb670e6a88a99cc5
SHA25603b791fff88db30e49797b952d18a9402cbb4f07967ee148a4e5fef9466fb0cc
SHA5123edf3b8e3e9b72193b5c1052a32079bb0005d262e9f69ae1a76d521867e2fe85666c70b5606b6996473a6e26b18a7d868025758e8272c9185f0d03601fc846bb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50463146c39405a446aa7e673643721f2
SHA13f4028443986cef87f74bcbc63afb05b718bd4d5
SHA2569aff84156719e9c891f7a76502ac852b378c887c5d38653a25fbc1a35912a977
SHA512f0a63c693e0b89d7f89600ee15085d9a1fd109b7c1638d9a0faf5968b92e80e5010688ff4430a703d839c572d34581fc0b637d6e594c4ca333b18c690f367343
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d4603ec05aeb35c2f350c55796a29f16
SHA1e39471b14f03249f85e69c119b4eacdc60020dab
SHA25648bbccff6901f57793ada1408871235b0ae1473ec660be7db1c1d45c229592f7
SHA51263a93fec4fce4158381455ad6624c4bb46fe390e1069426f4fdaca667b68b8d60d7af39ac70c25b96a79385d866e712e1ed1e45c28e33fea21691734e87da883
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5354b43d2edeb26e3fd58c0ad3ae5e10b
SHA1403e05b6518176e1b9c772baa10862c356d880e9
SHA25616c3063a7c7aa17d8bee883b1cf73536629e05a65fdc5a357fe7c94df3f69e82
SHA512ab17c0d0245a9e10d16346ebc5c38824afe40c68e495fcb019a6d877d5336189357ea390000a225bb1a8bd99c7cb1330738c0bf8ade0b8f785a9329f8db4857b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5dbe23edeb9b3fa3854b9d340eb3d221f
SHA1d0ece33cf07a75300c9a041fa452006f4b65722c
SHA256701051c5f5a7672c0f27407e44e5ee7df33575766eda2ca9afecc8af04b8af40
SHA512a4380bede4352e2c4f074b8e1467329227f2d80ea5dcc12ce38ffe13a5cc9aab7f0fa7a6dbf0818fe818905a45c46a9fbcfef3cfcb0c04684fefad93e827c845
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD591997f981438fcc443854ddc6dcc3d75
SHA120f82dde038f05f8bb65c43185631631effef29b
SHA25620e4dbc861307560a8a296c91663bba55480ae77807f35432a1672ea8c7f9c81
SHA512bd49eb1e0ed9afd813aca5e975c295329d609e3184002fe5504f20c8e7b54f93f36954802197e84528333be170b560db2f16363fb1e23cecd0a7f302fd0b4c1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ace2ba9b56aab72e30f05690d7771f7b
SHA10cd9da07dd37972c357ce087fdaead7c1b777261
SHA25698fcc2e0d44dc9278959d3ca85e439e368acb4f3da63c2b898a35b0cf3899695
SHA5122e1335fe59e897544f5a07144b2837989cb2aa064318b5eab850e4646f555388e85dc20ce6d5b57928051f4266776cfe04c6dd283ada48c8919802ca3d5599b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a3857decb40d07d7fb158b471846d159
SHA147eeadbc49518184c1b61185665dcb1e891517ad
SHA2561352c168308a495570cc05f3b840dd1ab09f7b3c7878e1744060ca582daa04bd
SHA51251e85af7dca900c15ab48ca3f888dc152ae874e3df9f7162ec849dadfb0dd081a3d6e68f7b62b800009f2fb58fa806ce826cd1c85687c0e3154ca2a1c283277e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f7e07343f6628418166ca3d73860564d
SHA1e8f9e39480fa8d970f0515d9b0f86b00f4d4647e
SHA256928ce51cdada6c8f20ff9629e32758b4ccd49463d8cc576b8af07831bc5df455
SHA512e87c40e40b441cc4203859550d605cf7d308856a1806bc2350f0805e0a61e8e67f3e732fa0cfa7889f6591368813bcadb584e7db6c6a76e90911e278e4a7c1cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5e3875bf5a085c970ded0d0c43a439dd2
SHA1e7be18266ff88c4af5cbd35052e95505182f8ea5
SHA256e2d941a6ac93b0721b2df01398ed1886d5eb29a4b641e6516aec0585198e1da9
SHA51275025123c94020f35b1e4dcb0d52100940aeab8b7a5cd316c6e6ebbef22a847cc398b74847692b4dec02fde0fd7f75347cac61a22ed7ca02cc8f401226f6faf5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD513a1af8d2109d0e3ca035c878dc0cc34
SHA14da582d18ee9f0a79902bb8433e07e2bbd9442f8
SHA256c632dc2c6acda5880ed6e7bac9f29344a3735222465fd1bec39e652e069107eb
SHA512094052439434e4fc104a28f146d5923bcfbfb3d76da76bfd2444bf1814a1bfb45de7cf8799fea3f0ee00ec333a06bb242c6b5adc67a74a5e194e7e33d17a0e65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50f93d2b5224e0a747276034330adc4fd
SHA170b76ae74ef476ad7dd3c9582401a3d0c04438b7
SHA2564a4e0f46e852b1a8a4f37a1811c4246ab44f03d86826fa02716eec689f0188c0
SHA512e7d04e457b4e2407f766df2f59628a6d1870bbd51ee8ac87d60a612248663b0f33464f14b6a6339bfac6d726d629a1e0792fc6543aae3028d7b3d2a634ea3006
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5fe7171dba6f3db97b2f140ad252ee184
SHA146c638ca5b0b01512e2f915d8e0aa718a4ab18ae
SHA256a715b3360f4f7d63259e1fda2cee97a0943986a612353c87612cc837c5bbe011
SHA512b6412368127b2dd1dd5b5060d164cceac5f84274fc971aecf18a938081a22bf97ed4849a4044c4192e80d136e5489c725ef4303959db512c27bfc6e45210e6cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD592f438e7726b26a468b2303fa630a295
SHA1a5e7d40bc172c356ddb30989f082b62cdb0f32f7
SHA256b5276bd0398533556e5a7d18cf7ec202589271717c8ec45c8b75b5fb62b85848
SHA51256fa632c22e8c25da484d76ec8b042dced7b3e08369a65277d9600daaf4e33094f1cbea6ad0b849f7456821cdc98b227776fc3b1bf9a9f66e80299d380ff71e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f0c48a5dfd056f059773feee20fac74d
SHA1fec9521b7f1db5411d4863527ce7863b5daaf61f
SHA25679aae4f622b7cb401f92f06d67b24d84019ddaab86702759a97a5a5b3ab950df
SHA512b33d15f012f1e38639c879c03d5495e21242aa096b89fc3cd2ef27a7a3335446ad3f670baa1c55bb0d424922ae691fa902e5314ae2c4b55ee0f3142213e74478
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d0b8be7eb8f091d73c5346805a6a6430
SHA1f61503b727fa1ce29cb02a1ac6988eee2903d1d5
SHA256f8a31a14570b9769cdc2aa0b6a8112c9f2202af5061151e24b803fb2e37255a8
SHA512dd87e061240c0cb106ae0b9466b5f8255ed81e0d9b340140eb2688b7f9e93dce30b86763e979c552f39199e1a2b6a895886c399ca54596fb650c8704cb7e235a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5171e913cdf6f61e3c00e7df44b3b6ec0
SHA117d12b2cc115a065d436376015b649b6c939febb
SHA2568ff1889265726a0f6896d5355fa1342a6f55f4c9fb85c4bc6d9b39ca5e0708a7
SHA512b7363ef5721b81c9dfd17084e3cd51c6faaea837272964d9c8222370f0a7fb3af3f85d18de3f71196693e27cc9b70acd532a099ff05ec9dc2aad3924616ccc88
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf