Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
8s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
25/02/2024, 08:46
Static task
static1
Behavioral task
behavioral1
Sample
watch.html
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
watch.html
Resource
win10v2004-20240221-en
General
-
Target
watch.html
-
Size
17KB
-
MD5
55369f0ee551391c7f2b54cb9f2493c8
-
SHA1
222efee81b7cacbcc7cb4c4018927d76b1797863
-
SHA256
8d8e61a7d0542b8ec257a1de4ee33db026d1e28a9ab28d9133c6592befe26d32
-
SHA512
885f25d59e8d9dff64e15350a5225ae41df5568f39d20595d40e7efc9e33cea72da9f24b117cc4eb0709f02063723828e0d3211a94a814020512144f31fda330
-
SSDEEP
384:5Ssl9qYoJkN0dMQ6VNG7BoWw5F9SQOanJVDggk:BoJkmMZVNG7I5IWVDggk
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68F0A821-D3BA-11EE-BE0C-E2E647A5CFB6} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2932 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2932 iexplore.exe 2932 iexplore.exe 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE 3048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2932 wrote to memory of 3048 2932 iexplore.exe 28 PID 2932 wrote to memory of 3048 2932 iexplore.exe 28 PID 2932 wrote to memory of 3048 2932 iexplore.exe 28 PID 2932 wrote to memory of 3048 2932 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\watch.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2932 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3048
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5138b12704a632a6dd80b8f4ccb951d2c
SHA1bf18d311a8292ce83034c0372a0f5a017fa8fc89
SHA256595c7ae748f71bb7790bdc395923f8a15037eb0f9b4bae983b3adf29e0423fe8
SHA5123c88a272f529efe18e61c25617750109f39e4b22d07933b041e52981e221345735ba43c1fa803f3a1751f94ece3e93274131548ceca8d87fbe1d396f58a3ed4e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faa554a4c7e3f1cd520a3edebc95637e
SHA19d2cf71767ff723dd7ccdd4535812f155ca2de3c
SHA256b4c358c1415ee8b60b3c53e69070db8ead7f243bcbbe469adb0aa5ffc534f1b7
SHA512641f0a996aba043e0458b9f4038a5bd74acca8edb0d73919265969fdae0aa8a96b815b85933632bf9ebc01eccf4878725bb87d92685ea31f69005befa9632497
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD580df6e1819e3667062dd37256ffd162d
SHA17750286dbb20e124cce48b0acd7154279b0790f8
SHA256be159ada8804fcd539b95b55ebdd80854b494bda31235aa9d0952b3a028e3773
SHA512cfc8aa87079366b1597784c4cf6e509e8f16daefff6a271d39962886b4ab78cab1cc7bf9e8b5e58516f5799dc4d755bd99195c13a384bef1b18c585b8f1df97f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52539b3b65f0c1368ea8d9622fb0b171d
SHA153bfe6f1d82168d278e7b21df81ef6008378616b
SHA256ca6d3ccf977007a70001bd6c8d78c05fe23c2d16c8585b1a9e5ec2aff24c3c53
SHA5123b985b415261295c6ed848472d30ac60ab80238e1c9cddcda756864e956157f21d0fa24634cde5891b414cf1d0db33f1de84042163b92c9420765341703d93aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e742f05070df8bbd8ba682629a6cee7c
SHA12241ef1261319a7701ea8e46c62b8738840c51eb
SHA256209d0a0648a98787eee4cb56cb05a4a31604409d6ef6cbc7422071bdfe87d050
SHA51290b1f866ab6838ad7208020349d626191d0875166d0a9b045d1e878e06a07fcee1ef074ba2163cc18362254c2255004711505358ab2c3b78979d7b7c1fe266be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD590533a310635c7a79fdd384fb8c3662b
SHA113459c94eb4afd165fee5040724b4d29c0110fea
SHA256b45d66d47086cf92c22606cd7dffdafdebc68ff6fc9f30c329d242b5b6f2d50d
SHA5122871135f3984365b785e31b9b732bd4f98ea1a08053dacb4a489471f39403bb4e272e672a83010909a6b1b45aadb7d79a55fa7ecd26cb59b95d380300f7c2347
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5faaf072fa277873602a9c36160e59737
SHA1499b58a48dab15eff5d9295b13c68c76ea94a1a4
SHA256696bc1092f8bcc66ef128bf739619a1167ca5f274bc3e090951998c2f6437b14
SHA512296ddd09af0826355d3b2b5792e53589a725f4098940a9bde24f51316fa8f5f1911f08a274b6398b0695a7775b1727c42c46f2c04c73839a98999f225716f757
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563574b9a3a39588c702fccc3515bb4b6
SHA1534d25ceb846511c26fbc6024b4bd7aeeda0d4ab
SHA256ef10897c26c3c9f903c9fbbcd4cd077a2ba2668158a5007abfa749896aeb96fc
SHA512547461a97bea7926e02017355162685acc27f69ed483ec86df89fa2762fc5af13901ff098cf7a2cba431f38a6115a901fb581fc4e531aa224c54b04d762d8c1c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06