Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 07:11
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20231215-en
General
-
Target
sample.html
-
Size
22KB
-
MD5
48efb846684eee5ea715a8884ceb46f3
-
SHA1
0a54699e6ca543a8453f4eacdb022697a6c0a58f
-
SHA256
64d3fe039a451222f6303741f8c263579403e685a11814507415a419988ac119
-
SHA512
68e44494d8488e6ce7e0f368875dc8159f4a40b498096a794134a9fafab02b3b4bf7236ec9c8f2b8fc961725169cdd4f86245cf4605878adafc99f2b02272f49
-
SSDEEP
384:oSFpvshhGOGCQLrwRM9OcgQw1CvSN5Hx/1RFavMotdvu3hl:oo9cN/QLrwRM9OH51CvSN5HYM+dvahl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000799590b844af965c3dbdc48027d2f0e6579d883e4cebc4f2bbecde52cf82fa6c000000000e8000000002000020000000057b5e60585588eda45fec52f49fd63c2411066d5dac5d4d3d1d69165b9e85b720000000a848ef8756f6c32da00b164d87fe14a60d3b55ae8bf9ed8d1e942dcd1dd9e41d40000000b28852b29dd9996807dc2c7938aa48c723a83ec039b276c506b0c6e1f8c41acb2e06bf2852a21cd5d16d0049f452d898160b97096bcdbe0330db333479d985ea iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d05f9bca883cda01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000749519f6fb042a767ace21dc93e1ec53c9a735b6b507285d5943f84388582242000000000e8000000002000020000000b600bf822133d347817cef89bf53a8fb5566c3a2800958107b81a9a78b61518d90000000d20039698e23e6ab4ac8f459bc5a815c650a9e5bfcaceb99a6428553858cdf25b530411034b321c7810c8719dbd2a9015174be65a9a41ea08626fbcda43739388915ccf82a0d55d1e93c653c28f78fe0b9a05b043b75b72bf610460abd255f2511af65769017189daa35114d1b60cc92aa105c0c5a454545f64a528f968d01d8dfe418b22cbd86332c25f560465c241340000000c5e3b70b94393a7bec28e0644df88eebb96ac60a9e9cc9c1af2f74711bc1318fbcf1b5441260298855df0d0afb1ac1856bdeefef6309817ed503c08e779a6242 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E51B2FC1-A87B-11EE-B9A1-EE87AAC3DDB6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410257955" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2232 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2232 iexplore.exe 2232 iexplore.exe 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE 3004 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2232 wrote to memory of 3004 2232 iexplore.exe 28 PID 2232 wrote to memory of 3004 2232 iexplore.exe 28 PID 2232 wrote to memory of 3004 2232 iexplore.exe 28 PID 2232 wrote to memory of 3004 2232 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2232 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5e2145ffcc90b0de07d11572dc2bc8160
SHA1f2c803be97f119b1d1edb7e9fd244752d38871f1
SHA2560f493d17315d416b35e57e111218ca84a0da744652288005becb037b01ea77d4
SHA512c04a9405c503cc7b5bee8149ee90b2852184905b55de241c69d64cade6d7213dd5cc215d9347a098bfa4e58f746bef89715037adfa114efa7e67700c29ac0483
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a9c5f9f016d84e61b0b2f51eb476594
SHA18c6319fcb49ce3abf0f9aa63890a74d539878b15
SHA256039236b6288cb05ab7f12e38eb0dbbc2f77d2d40987175bad26872468edfed66
SHA51293aadc2b0f571b1489d6cbd0afbf5b39ecf0d003aa16854c9f647fd4e8b034d9004c0615a2a2ec5eb7b241543293b9439965a78dc9f005b08a9f1740ed84d245
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa75966b32c5d5878552e94773f2b9e2
SHA19a6adf59fb5fd1f5232ebb45b757fee9e430b7c6
SHA2567650371a8b2d8bbeafd08e73a39894068a7ca264ff3f3e6562a32e86f1fbe2c0
SHA512f38deb8638dc40a5f0ed5a52c4ff03c73cb17506ca47eb2868bfee5fc385119093c028687bdbd6f488a5f2cd68e026eb80ddf2f3439a5a37d4e15c0fdd46c1c0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ca456cb79b6e59358071c972006eaae
SHA112bb3077b8d3d43d0dc033c177b7bbadc5dc0226
SHA256c3428c1969096e7a1e2987eedd456bf2cfda9c0b0af5caa244d2eef8c3dc9c48
SHA512e34bdef617488fca544dfe03c569717b3040cc10342dd1eb79fa0bb7b7a0cfd614a24a961905e2c969eca18cf287c3f8be240bf07da9c9c542414a913cce0a2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568536876d0958648dbaf18c6f35b59b8
SHA12d8f1c3bbdb9efc5f26b231fb9d4006a75c4e748
SHA25614fe3058be9540dfc0ce4f7331ba11446e3ee3f55d2a44d1db8dfd3f3231677f
SHA5126edba80c112d21cfc9ce512e11f144210a1c1d8d0038c10e5651d94b78684955f28f2d33ba60efd350c7735749d6034f45e41641df97066396755a55e9f8540c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57ef66cf7891e3a0b60ef213e0edb2344
SHA143709c705487d129a3bc2ddc63d8e822475a44e0
SHA256c591b519b3ad34ad40496b108f7b04691a5cf045355db8a4e1e3ba12946aacf5
SHA51215740418ac27e23bc3b38390bcad74fc3b67566825e013053961d52f1e93dd92e0bbf802072dcede9fee8925cd8d01113acce78a85223d96ad497f32180edd03
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54c6fcf97001a40ab7a2fc83f6230fd80
SHA105250792fb67c6959427b57a0ef889d2784a1743
SHA2565efe6568bc94134d6632f58617491c36f29b1c753c7ad878f80f60dec5dd352b
SHA51249dc57aaf72542b83842d9177445115dc842987b60ce9f2405ca3f57fc558d0fdb09bcfa4e3a2f1b4ee59d5f152adfbe1282b99a8eba023e1b8bffb4596f0b1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD568723848f0814701b0ea7069fa3c464b
SHA1da065319d4193e8c8f819b5b49bdcbe80f39a624
SHA256707247e0096a68033870934ef8bdeca9e4dc2e183eabbf0671a7dda6624984b0
SHA512f02d07cf0483dbcfc9d590a3f4ab9021122fd58ace5f62c04e2cf75ff9ceaaaa1b9a2a4c1d97f2c7a5b2bc6325f82af1a0b8663b885e21a7d54a159f33e7b8be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50578dafc55db81337af43aa513ad37a1
SHA17f42f3df571e0d70c85cb2d0be2bf63994983efa
SHA2564381807f17252eb5360d226a6ae6352bb5d8c82daa37e9d79fb2d021c4129d7f
SHA5120a160a397ee0c1903ac13c476d72050b92743975fe1dd02ec56c71c7d0d8d71d95d230621919ace8eab9fef58b4b7c24518a67cec66959144d63cd0798b084bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fa2e12e98b890702ad443a74017a606
SHA1866352c13cc7231f25bdb1738f6026cf101e0722
SHA2563114efe1c09d1c1d3335e9214a5b39c49802319f346515bc194973104b70141b
SHA512d0bce49d9a5ee025b2c1175de0018042e3190d36cf88e8f1d61f9f800754399652defbeff84faae0e3840be8ac5142cc34f2826edc3f5490119ee5922916bbc3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD584d6b9bf5b20d2b65b3ac071df6036e1
SHA1aa5f261bd9ab8fb66187d83d17a1838f9cd9b3f2
SHA256034eacd364778eb984df1f028be8d83a0d06a9488706b9a07e264fbaa9e34d32
SHA512f686e6b691033820ea845e5ac1784c6e02a671439797ededf35c3edce5a14cf5b698957beb55d1b3fcb2501c9f0af0405572b2cab5df69a1a93c92d34d59ae5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD548f2596e6eec2380403ab983a0cbbef3
SHA1ce0773f7d7f59aaf1e20638b7ad1d4f9c07f261e
SHA256e1afe818d75650078499bff56c54bb044f35d9c506f9b84a80146790c771ff7c
SHA512fd2334d5b873a0c8d066514e74b4b85506e9dfca3f84398f64d87b6c53c89da9e8542daf9d7a730daaaf6785968dea7d0ea7321fc40ffb211c0e89d414e66843
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5dbcf29dc6027950cf1cde9eebed57882
SHA16d24dba0a42bec49bba404ca2a41fbf7c319bdf2
SHA256b54fd1e03bc6f3b6a9be3a9fd8b08ed6c43ed149e352800602d2b5c841df59ae
SHA512ac9d32b6edca440066bed6f879d467cdc0ff61caa42d0391980bda219db5b915af73bcce2258dacb0f1218fd78a02f9b4d405b0e5ea2130780b2d5a6c6b60d57
-
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Filesize4KB
MD5da597791be3b6e732f0bc8b20e38ee62
SHA11125c45d285c360542027d7554a5c442288974de
SHA2565b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
SHA512d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06