Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 21:35
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20231215-en
General
-
Target
sample.html
-
Size
16KB
-
MD5
8daf0306bcbad45507516890db5419a4
-
SHA1
22f135e87c5092e7da99ebb23b54c934bffbe6e8
-
SHA256
623d0b9bf8e836323367570a5405b72d26229d0022f6a82c5273fc9a9a2f4028
-
SHA512
118c2c60be1badf9154c79be6658af38bb5e5dfddd512d8058917459aa4c479f44beca25c931060f870ca7d81982bbe3a43c021652970e082d1ec4546b4bff7c
-
SSDEEP
192:Bpaz7JvSpFpQgsYgMikcMbGTtu87//1+mFUmUsTQLkp0cdvuijGhl:aSFpvsYukzCZD7/1RFXvMotdvu3hl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7073b23aeb3ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000a427032319775ec63171e4216113cc789b51751a1b6bcdc54094db4a3ca5031e000000000e800000000200002000000046ecb10fdd63b39d2882ca8e323fe5885c5bf7b34542ec920ce1e33e0f376336900000008399bd1f410c5b94a43a339957cf8afa7575f2a997a8d3fbae587d4293d23a0c01e6bbf9c49aba6839f426b9a8afd71cd9a0a4619909ecce3186a7512d3ba51f9b8b44e42b4ac1d01970fd10b8278743d3717eb42d478a3ff25ff1739e94b0b603ee8acd87a1cd66cb458ba4b99b971e50bb455ce3569551d867c14982f799e1f56498a7e79ffa0c6b7f14d644a4c94140000000c4d59d4f135174534207d4876c75692f70a811d54a708d800ddf62a86a167987c90c68eeaf83c275edd65c0a7607edf6abec1898790365c708b3b134e688761e iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5B8509A1-A6DE-11EE-AFC4-6E556AB52A45} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410080313" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000b94727f5f560d31412bbd3b6c5995697007e085f2820142b732991a93970a239000000000e80000000020000200000005f6dbc9f71c0cabead025de8bc34f970b0dfdd1b6fbf07c30d071dae6098a414200000008fea1657137eb8da6f6bf8243123f0c1973ac5f7a63f8566af4366f84e7ff302400000000320178fa6e29a31dac7a295e61cf87919985f37330b49568e59dd64d54de1c6d204ddee9db90af8108a1164e64b2e86147f34409a6782c06aee66317435f074 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2000 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2000 iexplore.exe 2000 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2000 wrote to memory of 2700 2000 iexplore.exe 15 PID 2000 wrote to memory of 2700 2000 iexplore.exe 15 PID 2000 wrote to memory of 2700 2000 iexplore.exe 15 PID 2000 wrote to memory of 2700 2000 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD561b146d96dc41e221b9a8f3e7d361d8a
SHA1e69e9e5136e8f8c2a8bbc87d81e2f5e4b5d02cc4
SHA256641147be01def0d6d779268212a17bac7de9ebe34401afebb00e6e82392bfc32
SHA512db0e96810c8fce9d3fed0e7c03af2a9fe0d174e07d0ca5bd10ba441ae4e5fae7c909bf3f2b3aee53fa7ef26841874a183411b31edd787cb53ed1706b20dd8fef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c09e90c660e7e5e078dcd4acf47257d7
SHA197623d4ebed23ce792d0f9a8037a3e1505728d44
SHA25639020c3a3decbaaa644d5313f973d6d8d2d3c8242bc2940e03a21e89ccb2ec1d
SHA5129429fe3d66f90080c69ce6e06c2925d3a8067671882b609c90b9936d810c32b71de252bb11a7cf318bd8db0872aa44ad396c21ce0ace7e810007ad3e97e09b19
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c9bc10a8ab7a269abaa764d6c8492975
SHA1c78265b6c2796469792e74109c99709ce0990deb
SHA25683cdc98cac0ce97170d324a97f49b314e3dce0711426a7fe29952b117de21268
SHA512b9a0538284a729a9231696f099bf8b881e34bf2cec78517b9e625a97d180f12dde66767dfc9a4e6f319f19c62b3bca21b66e4f1f40aef9729463d77ffd392fda
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f214b5d053588e4d8e5c36f3cd1654c5
SHA19d9837025b91fe8d85fd9ee252c8b9cd2c856545
SHA256a600a861e93927d8719fb7ab65fca59b1b33ee68ee7fa01648cb86dca698a855
SHA5124ffb033987517d5771dda47f94a479585b45b9b71482cda037ce87cdea53939ebea1b9b5614e1b51c6748ded5c36af3336e25bb5193024e99aaaa78abe2e2cae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547556e21e1d4d7f957112f608b2cf30e
SHA1613dcc0952b3748d59a2d23062140add3465d1a6
SHA2565647f2b88eef534af1e241b64e6681f2b6a4d94545f744b5a16cec4a191be64e
SHA512ab4a12e04bcf9e6a3e6cb253b25d8fc9c84fd6ae22b8e8f1d8c3bfef643f8aced215678f78c6169a341211187e4b5287300f19e228146bd92a4929ce29ec7611
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD543dbe01cbb63ad920dfd88bc832f7d74
SHA1795325552aa68e16047f94924c804289009c0646
SHA256c007f108249f5669c04557b73e1748c70a3156a85d7d61492e1cdb706979bfbc
SHA5123382cb50a944f2467c6a4839a1798dd41e217faa60215bfef5a52d5322160601cba4f8c57c77ba648a304cd4b46a72cb51efc80fdedfe5f50d74331d7dcca8c6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06