Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:24
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20231215-en
General
-
Target
sample.html
-
Size
23KB
-
MD5
f8bd9cff28b3ce6cb0045367980bcb81
-
SHA1
b8e72cabfa88a97e71603954e8d480820b707c3f
-
SHA256
d71bd1695ba6f27ef64cf0d446df9f2b563c7f2057299e0cf8cabc0c9fd0be2b
-
SHA512
8453cff8e716b295349c03e872beb06c55a31c472fed17cba908c95dcc7935a40021cbd3f3704dd01590530c2df202241d0dcd754edba83defda8b82cc73460d
-
SSDEEP
384:4SFpvsBh4o4VJNC4IL+1pqSb0AeTGR/1RFtvMotdvu3hl:4o9ueLVJQ4IL+1pqSb0AeTG9M+dvahl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4926B41-A943-11EE-A7EB-CE9B5D0C5DE4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000b9f862ce676a921842626da755e8cfa91bf7f81f276dd5c9f51835103e776a3e000000000e80000000020000200000008f034415618408f1b825b4f2de4711578a201ca7b085f020191ff11e7346278a2000000003a7a8f6b45da53fbc0878aa2a216c13ba808ed2b5e7a74cdbfba219006a97a940000000de93f16f3be3aaa2bf8e0e9c060ddb0af930d9aac3fba5582888a77e834466286d8bb4d191d22e06ac258d5f89ae09b76bc84ed1e0e619a660b660b07a7c6254 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410343833" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000580e1c8c6faee54b80ab28599b83677c00000000020000000000106600000001000020000000d619cb8d0ca8facc4731e9a6ecaaffc70b54d075825f6118f2a974cbb3650d24000000000e8000000002000020000000fb7763861d9c87ae940c6ec506c451bc5c778b7cfbb9dc2db2370400b5d9b5d3900000007485cd50c5e311e49dba1838d9bdf5f530fdd75a5a6cca64b724e6f5bfc05e6d04d685e446f08935b5d29911316a321110781a8d63bdc0862dc7acd6fadb5452ce6c73d61d2dde96b9b70ad6552906657c80a1535c9e5a4b39dc8bdb5e0d10c152753ad57d30319c22de0510c5004e7104e6537235c98d693e22643e2013e1c289ffa3b8103ff2fe84b1cb44eb221d8c400000000b628753940c95b5ca56f398dc8526d6f5dea0e0a24c752e07ed630316f1bb8105a13e14c5a6795d7a714159b8bb1044801de9c46ac34bd4200d5f4305cc8d6f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d8fac5503dda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1856 iexplore.exe 1856 iexplore.exe 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE 2684 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2684 1856 iexplore.exe 28 PID 1856 wrote to memory of 2684 1856 iexplore.exe 28 PID 1856 wrote to memory of 2684 1856 iexplore.exe 28 PID 1856 wrote to memory of 2684 1856 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2684
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5804f49bc40964731c7797c9d911e628b
SHA130cf0039297875a75f771ff8dd1acca1a7ebcb58
SHA2561dcfec7985ccee9c255af79767536cb2d80931be4335af58d81b5dba4fbfcd1b
SHA512f1fe6b1096b25b5165827ef226daa3981c261507f2bcaebe9ac1ab3f96c403c3149752121de79af30c4eedd94d0d849a667d123dc74e20c89cba6244272eea90
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55fa24135ae7b5309cf6b34cdad9972e8
SHA1e4d08a3a31b32f44794f7072ac3e7bb8ed65e2ba
SHA2566ce983c944eeeb05260b8125ba121027b3ddcde9b6eed52c3d1efe77456839c1
SHA512e07211169062c166a1a0922b0cb664f399db66c0bfc072f4f52744a4e036a5cc2033e5e7c15fcc7f75f5d1d1365339683b3e29fe1cc4236cca05a4d27c99811c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56456584713bfadc14576d78e29dba5f2
SHA1c1eb4b7d2ed8862dc461966312c73ed82cedbff6
SHA256570f03ed3a1b30eb3c6450e9f883c87804ab99daa44c2de71260830008b09482
SHA512daef874c4a02f70678aad3c2ab52c3587e5feeb15bedc446ce67beb694dbe5fc71cb3a8b21284885b9da84e9b48a02e19c46c3eb7ec196e579494e1e9be7ce04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542b07a2c5ba6a83c037ad117dd7280a0
SHA19b956436237baac050b64af72edc40d5f79ba3de
SHA256d58d115d52bfec29fdc3b8982d7208e4a66231d19531ffef7e0d910fd3543204
SHA512e372f9d4c80212dc9e4f15b6eda6c0b769e87daadea619b78d98ee0809e6c5cacc0350ba96d13a02e41f0903f8f8f4b13d10f36bbaddfe6d22eceedec4451550
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574431ae330582bc517d004c45f3d345e
SHA19c399da90be1c0835f4821506805ce270d580c72
SHA2564e9c5a31267e93e9866ed6c08afcfcb6e13fc040d81770779cc700d98c0ada3a
SHA5128fdc97c1c6723aa457e7b051b107089386cebb1f35d42538d7f1fa692530d876183faca2b557d9bbd2d5effb38e3a785e8f4fd8bc55619977f9c7653c2c7fe9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD592837d677dd1ac38e0ac3108821188da
SHA109e1693b52dde5aab970a1b4880841e8d1b5f50d
SHA25664f5ad636d3e671a9956c7ad7438635a6d1c6c05574ccf9a4bffb28f1e853fc9
SHA51250b7f5eae9c7768e1673198851d722c345066f9b572a35dd4c24cef7d37aaa181a91b4d0666d07b835e8e10fc0502f0d976a2af19f41a9ff51392a0d14077d0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD574bdff631fa141a74b83776216ce2d63
SHA18b66d85272ee23a1305aa12267b8621a1c184e4a
SHA256e6b45465f83d47040de5acf31aedacf2f9673dd85c76934f86a770ae9e3c6e01
SHA5127ba66c4af08bb76a6c6b7b08e7721188c90ee48f47b0430fa7f6fb7b1391c9809e41ffb3117c18370d0659a7ce92701dc452517506c5f1e1abfea40527aef247
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5887bfa41ddced8395ac945b30f116af9
SHA1bf7c7108360c5c9ea668ec5542ee810bd8b3eecd
SHA2562c54809554c09fc498c4ee5da3001a455e7669cd99080fffdba4f8c545379e32
SHA512c470382a5f766e67d2fcb60e6762bd8ff065f41d91993669f74db9c6a2238af2b0f6214553114874719e727296defa36db41a3739b11e278c7ce97e21d6051f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e8a34ef12ddb0a3ea6f24697610ecc68
SHA14ecebb1c33900e40b4b908e543bae51bcb866ec9
SHA256d30a280890170f6aa1cba9066e184a2f715fb35c3418fc8137943b7f23f3de66
SHA5121146cbeb6e939f45891b7da108b89aafe1b7d2d076d2cb2037a4eefbd9c6c53029e2942e19d26757b3e88222d59f2fd29a611c3e717e64d4da40e0c964322184
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51fcc5a0dcff2530fa05a258d4e7f9744
SHA1852cc2a870845772cba2c330582b4099f50a475a
SHA256f580ce3cbf6490959765e42fa5653e5fc1605e0935675a7f285a3830849586f3
SHA512eaf73ed7a2bf167b4296a04706691926673179de5684b7130b9232b95e5e7f662ccd36abdf8daecde0f25d32555cd5fe44bace89eb389461744d991f10e0863a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD538a4ca18d18ffe46503fd9ff1e773e7e
SHA1c6fd8b5ae31407a76f099f5a9ff37f0818154925
SHA256a1996a8376122cffd8e88d3dca4d11a895d7993230d1609096db16852538236f
SHA5122cf39feb8d006098eca6f998b9d0323a13a1c79ab0e7ac667bba24f5606e3134217d43532040b3c61a211b3b81a49d3d4a665ab39d658a3c328b43a3bf88f3f3
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06