Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1557s -
max time network
1560s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
12/03/2024, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
17KB
-
MD5
7aff26d8e279b6f8c75560946a82700d
-
SHA1
d1abec503da368d4b80f964ba8597b48a338fc17
-
SHA256
f18d34e18c094bdb7688f0f1e81f9ace862470e3c383ab0d081853f1fa707bf2
-
SHA512
859b88b0d6006b50045f270478a63c47350571bf3c3ad77be3def15e5fa17eb0f4d2a812f0709d460ecc760a10b934a87d0f0169607ccbcb57f6b9a7c308f07d
-
SSDEEP
384:rkHqDpmReVoOs4FN9ylKeGMUU8Hhhbkdu7lo2pGvMgVJCBXQL:reqBVoOs4FryI1M+BhbsggNJQQL
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "416434279" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000f9ec219f4a0436508b1323e5bc8ea0c63f8eb5d165b50732cedf84283bda0296000000000e80000000020000200000006b6eb5e3cc664578e1c605815163ff3a5aad51eb9fc18c034cc9a9bd97e81c139000000046a58d23bdcd698720f8615a25b64fe207ef0d48bf7764a8e08892aaa2e208e8ee5960ede8b5f83ea448026d280208387ada09d9d6b079ffd52b24217a0e999605c3418007e4e2ae772abb397ef4ccd64277da0b0c69153d188eadaf50f329c8ddb8dd79cede25694528e98bf767400a95042ffb5f4c520dc1faa888b28a54e4d54e2199e8523e3e46422c878d57e60a400000000aeaa94528ca0f08af7a71a801c20d9261b2389c5e868f136608279f490b95a16420d8a4c1a510300c520046c346a8363138c52ad275b43e2c0d2e73f4d0993c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007823eddbcee3e149bc4db86b21295af600000000020000000000106600000001000020000000f362eabb56b1d5e9dbb170dc63612433a3af7115450ee2d5b24e3aa96080f7c1000000000e8000000002000020000000979aed2627f55c229dd25fbb552c600f1ece69d444b60464112bdfad6281d1c0200000007ca9b74e777b3fe84f46dd2290b7b059629ec8abb4f8d4e73013170635a493824000000072ebe8adbcfe3e3bc25b23b68168433622e17b057b74e0459dbcf6446cca31205ebc56eecbe4777195d29ff53232cf2e65a463a3ed16525b6bae07fb9ddd6392 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{55113271-E0A8-11EE-ADFB-52C7B7C5B073} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203ed629b574da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2840 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2840 iexplore.exe 2840 iexplore.exe 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE 2780 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2780 2840 iexplore.exe 28 PID 2840 wrote to memory of 2780 2840 iexplore.exe 28 PID 2840 wrote to memory of 2780 2840 iexplore.exe 28 PID 2840 wrote to memory of 2780 2840 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2780
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54314adb34a8435c1204a79fbaeca6984
SHA1e0dc3a903e9814eab72b7b2e75b2fe895171efda
SHA2562db7654b7e399dfd18c8ee7b490e4f25ce46c068b585a474d3fc926d924a1bb9
SHA51251ab0636cfd8363313dba70275913f105390dcd4a8e8b5bd8b421fe44e65b1c1c360e70b7b374b0f10f60f8afba02f63bc0ec2d9728887feac1574b82b262583
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550505e6986a095eaa1569bcbe91e0035
SHA1ade2dcd581418ab7dac01af740447756dd4b11e1
SHA256689fce68e8f8b3ce1dede0d94cf8339400bf940b158dfe9d10f124ea691ce751
SHA512e72d545cf3f02ad1eef08a855a130cd6913b5a9b8561f52ab0ffb3ad04fdb43e3e1940cd159a064312a2b34ac5cb559b737faa70acc7dc2ce4542475493a3e66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f5039868014c5070ae3479e9b1a0280a
SHA112287e899a5e4a078677203c966eefc64ad9fe17
SHA256fa0ceca6da48eb29311ada731acac497238ca0e18fe940826d53eafbe065db80
SHA5128f973a04db99da67905dbfc7412d1ed5dceb20b4f4600b306d5fe862e5a386c2d841645f6d1bfe77119cde393ff8e4e0c23ceb9e8c80b1692de8e4208eb20370
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556921a1f6ce86a86e5f1f25919c0ddc7
SHA1339d9dbce996316756fba93ccce86de22aaff2d7
SHA2569e2b5b2c3954866df74a2343a3ba792b14d3823d579aaade86df9556bca8faa2
SHA51238872778c73a4215c1b72e607360632078e321f2246c0b4795f33f4f2c44dcba919069eca2455ca0f505d32735205fb2cbf0d002fe9d6caf5abe812a95797723
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5198d85b1bb09670c6d537324ee5040dc
SHA1d6b77df9116d4d34490d5f41effea20beb827e90
SHA25686c5ea0188fbe8fb1db40bd9cfe58b39a5392f88038c14583b785a0de8dfb882
SHA512fb7935cd59108f41cb8ae5a47dc3c9f470cf5dfff4016854a51b9e95bdfa478600a6825c90334e72c28eaa0ef7062fa8e9545f76900a699d74a7abb3cdfe8aab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51a9c046358225f43fff4adbcc1184ad7
SHA1dd50559f9588b2dc76f328865bb5b33bbbcdc9da
SHA256425566403285104b728a25b47fe2c858feb8f4b82a20618b07c7dd343d010482
SHA51201ff7f262267fff3f3d98835185a6f1325f3cb09944c807209c1073dc50deea6d9afea43a69b97f36f60f7a10868da9555ee3e62cf788f5f79dd8da9f238cd3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598e6cf6db0c50ab6c9610fdc810d6a08
SHA131b85d639fbbff9bb4e10cc1cebccbdc944e9b01
SHA256b94d1a4768f270577b9ce0e7c7df6fe8e82025d7d9f1551462f4e7de9cb817d9
SHA512de33dfea2dadca40d8f4a0e6bc3b12f43985f7fe5b9d4260cf531fe860d5c3016d5f914cd4d3067d8c5dc405a7fecf8340d49374f34f8fb45a695e4cddd9eeca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c95bf342cb70fe84f79eb9c1ff1d30ee
SHA1ff9d87068c049447d32fe41d343dae85918d8b69
SHA2563374f872665f9045f6419156c1304a62869e1a3bd850ffd5cd56457fd76a4250
SHA5128ade8ec3adc604d15acded89c754b2953f3f3c46a4c4499d7ed767b56bc526ef7d0dd5a69644bf3435aa7e878b1009844ae615e91b780696054e5f6e0e6e1db4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5814d88dacfb6c3765ddd4f4bfeb6e4d2
SHA1e70b51050d598481f005d99e4496e8fe795fb03e
SHA256ec20d79284a09e7e33ef81604baac66692276dd0b1d138042a1e5c7922fd012b
SHA5129293141579f8ac12a2c12c32451a58027ebd22612d6d14e62eaa2ec3c1f9355ac6ef8465a84e368936228b7f36207dc602dbea81ef5568aaa6dc4ffb5e8edcbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5932659ef07b7d0356db16c8199b5c2c8
SHA1a918024d4ab00257b27a575775496fd8c0676eaa
SHA256342f646f3fadbf6f97386e9370e49c897d26385246e55fb427d38b5ff37ca7bc
SHA512cfe52f157bb65de39e95c70e65d4cb0dc15ff8ef0fe4d42a6ca135bf39de9b74edf8765376a9ea045512165ba0a1e7f2dad64dcacb37e027584db3f7b499a193
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5619742995669dc9866c106f807774ec4
SHA1afef73c6f31f2852effdccc258a4ef3e9e4f8501
SHA2565b66c1118b04f9ab342e56cc9d192ce311c196d653c2a187d3ce4c3f6735dd0a
SHA5122ecebe8036635fd35e035225ebf94121a6c531d780ab6f83eba28f24535ac9d05dac6f819c9611219abfd488d1419fb9e191bade7673cd21a62f55217ef0423e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e38fa6e4c013e699e1495e35116392f5
SHA1e57ec13101b990549dda8c5bc1f3abadfa1f8aac
SHA2569943f75207438345c9791c7d210ce6027bd8e26ad4d3a8a31f800f355f4636e0
SHA5125a00de972907b66a643f76da70106c49d8a02f669c13846e9d64c5ba7eb9094382d880b8ebd6bd836e215f94c741440db6a2a40f0612ba86feb6af354528d9fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD573a081bcc512283975b737ca07941562
SHA11b39474cccd52fcb246431ec45a4304682a063c7
SHA256f391fe88f4770053d4618905fc2e9fd5898512d7fe3ebcd9e1c46d25855343fb
SHA512eb4f02b15b440bf98f01d9270db2d013db24d6572fe6e0ceb859fc06c26af28c3e6287c8bb9391c48db22f55b3ecaec28b1efe4c6956d8f8ae5b6b96c717a8e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ec47046aca295297a420e7ba86534105
SHA172ed3fc8863722daca371ae73d0990dd133c329d
SHA256918fe62ae55142dae04ba265715b08656ea36568d3c68aee022743842699dcc7
SHA512d609da687b0306a0a3d72e35c919f818c0164baf018e27d9858baf965ccda12d27483878bc5c7eeb4a5fb6521dc5f0e0c694c9bf8b8755c70c46e43b02fc2d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD596f5117ff44154e2db2e72a0d4cc5de6
SHA18541b4a0bbf73570799b07930042f67aa42d2478
SHA256f5ee37f90a0330f1cfd64db1e2504104aeb602df02047db7fff559f65ae00a8a
SHA512630813189d6e5edc4a81b60c6ff2bb6c4ba3f4eb9b153dfb6275b19944b1da006e5175a8afcb0aeca8a9eeedc1cd9088647376f7b2a1cf5dde7a4eb773122f41
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c1d682e1987780c8282ad113568faf4
SHA11bbcfa8497f888d488a7989eb6173a96c350de33
SHA25637b55e979b95c45a71c297d2aeb397270bd657688be9d50248bbda0489ed4a05
SHA5120084cfc2dcb7e4e092afe08c50fb7b4c950880605ff54c9acc62c2bfdb3e820bd740a573583d2021c1e004178e70bce285f81ef6c0520f268165418134495141
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59968edeb5126aa3835aa8eb0e2437f51
SHA12a7fc1175311954e96c12fecf190aa7d9511cf94
SHA2566d2b42601425e7f06f07b47f64117e031e629794269ab35a7b8cbf7ecd9f621a
SHA512f09e91d6e52e9208b1f28f1a769f1386529ed0ed2f44dbfa168f30fc79b50b0cea8d18fe6625194aa2e79cf27105532dd52618ae4db79b887d7e1dcc806f2eaf
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63