Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25/03/2024, 12:20
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
22KB
-
MD5
d0ce4ad7a59a548bf12727ebeb5b06e0
-
SHA1
ec0b246eac8af02420735231f930714af76c3eda
-
SHA256
ebddf9a867af8fc6cfc5727b694a7582931651fa018b642d1c22fb804f290dc0
-
SHA512
873205818f8ddf391bb18971e0ab5c3652370204d391a06106cba59fd1c302ae698e1ddea3a29121a41c3ca84263bd4a15844379c90a461478e90a835593d67d
-
SSDEEP
384:ESFpvsjhxIzCk71E0I0NnpqSL6Y/1RFnvMotdvu3hl:Eo9+4Wk71E0I0NnpqSL60M+dvahl
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b0000000002000000000010660000000100002000000041d7e17f60e5a8226892963972a0d1cc6cee96d9d66bdc6ede283cff2acbd868000000000e800000000200002000000007c1986d97b2d7408d8644521efa325f623ff9571f95908a0025fe315aea09a7900000000face9dbaf90f1a53d50951ef7348ce32faa8db2219ddd69f930148bdb352f81fc209381d7db430f257e6da661fc409578af8bfe23d9407f825e487238c0b7b8603804a657b84d0d3483d7922ca891008b1f176c194eacfb0db1f2cc81fa6faffc71ae21998c78108ad4b6a55bd1ae5f923190e3af24d8107a341feeb1843bb98966995e65974bdfad11bc3b6a66a89840000000e4776e381a20fa7b5c6e3a3fee4baa3f26156b38295bb955d0fc5bb215feaed88a3cfb3c42f1ac76b3c9f5e10aee83a32e2ea36941450df9b8ec051575b826b4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F144E11-EAA2-11EE-8D50-4A4F109F65B0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417531129" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000adb908baf7d01735fa983cea76808b77e19ff8acb926d17623624bf38b38925b000000000e80000000020000200000008172e157a9b86014fd2ee017ab4518a48091263b74beac2f680bc7e8ecc6636d200000005e073d5dbcc6b77e8a6bd8c15c6d68167463d3c397133635bb2c8a30af7ce10540000000c8bf0664949a932784a408c0627a7a5a10b4926b5e65aebaedd2324cbe2dd85fe8fb166b94ba66a77ee1b63ebdbf6ca7d5555e872c470dfc0c7bed9916452091 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50dbdaf9ae7eda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2236 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2236 iexplore.exe 2236 iexplore.exe 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE 2392 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2392 2236 iexplore.exe 30 PID 2236 wrote to memory of 2392 2236 iexplore.exe 30 PID 2236 wrote to memory of 2392 2236 iexplore.exe 30 PID 2236 wrote to memory of 2392 2236 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2236 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2392
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5a906f44e47c46765015a052dd5688d61
SHA1690d376dc78fa5ca06bb330cd7a981af77774c5f
SHA2565ad6dd67ecaf74a82f2b2b2df3c43e908e31ac47b6f2a6e9132a3ae2126e4d09
SHA51219eeb6242c7b055092cd2d29e46f3e51d9a6b4348b3e57f6b33eb67386bd5ecda134cdb5addaaeaab460677807b18cba29ab8660b763828e41212502ee2a2d10
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD54413fc4ccbe7b5a5fcf9341e6546f577
SHA1fb6eb5ba81d4e022f8ee274f0c7ba35c09eb2454
SHA256724ad4731413f4010c4e9636b44e34a1ff816deb94560c2d8ffd447a41e887fd
SHA512857f7216fa360dd50ed52bc066d54583072540755059a6a829071f92baba213680074b61d8eef66aec3544d149950df534317ec450453a4d91925f0ccdc1fedc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD563d6ec6108b5ec181a20daf603a21388
SHA174fad3f9b021f9800f6ebc50d3aae985ef08ad68
SHA256e032e654638b5bd4e7a5c1249d777510bc8ea50b4b7de3af9fc251dd343211bb
SHA5127f5ffe6661593dcbeede12c0c7db87c958fe5a4ad2d8a2e5304809269517d4596e94dd04e1cf4b5f09aff1368508e1b94fe416dd9ddbcd4ff2fdb115211e2305
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50a9800ad31ceccfd38e3eb0dba99a79a
SHA193190be9be77207241c2b0f19170bab825e9fd9a
SHA25644aae00f5001a4c8fd3370e9d117a7b201a9f3ea4353c369c50baa9980dc78f6
SHA51279efbde993516792b779d596d93914b41bd8da595746354174cbef93e0a276dd3a82ed3c93d918b724ba69f885f1f7d40d8d0c75fa7b9122bf42f2b8bf7267be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ccfdf8e532adfb56259e8eb390bd3a48
SHA10eb146a0cb206461332f2b3ed59fab6bfa1c5edf
SHA25626527927baefb28aae117c95be88480de0442935ba4bcb3620e60b73606d3d2b
SHA51223454536be0547141b85e586b72154ea3d815fa4fd205750b6bbecfef64f68c697f3f2f2aa086b57856b73b29624877a3d36a78fe05986d1cef299abba99c949
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5d74f614e3fbcf450f5ec43a2cd93c2f4
SHA1e17de8f746882109b28db70f078168e43ccdd8d7
SHA256ac74bba6b9c73fadce68414bcc16d4b7af417d814b4c00d9775fb6144f572edf
SHA51280b6ed6425e9872cc608f37055d5827041cc70afa3c89f4891ba332b637441a6881eefbd5e3205c7b961211ddadc1ef846e0b1bad9930cb9e9e8df3a8ea89de1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD55b8bbbe98babc27b2b38690bf02e2e59
SHA1b96743703f33553f88082b9ed1b4c36a00f405e6
SHA25682c48cce096d772031973d1b2d329f9774a940186f93904ecfdde0611c7368b8
SHA51288892de6c2056b74184dc765fe5020c64ac6ceac49c41456282cd0d8e0282765afab43f8bcb1a2226d3762f0e8b14a190197b56ccf78988136841315e001b33b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5cd479db4c110c7da1c574f87f7cb6120
SHA1056800ff80d339d5fffb30f2ce76d5e482c373e8
SHA25681a9733e73bdc54d998ae561ba2a324168aa610d1099571007466e4174da32ec
SHA5123c630b58d43060cff6ce339708c89fb6891d989e479a8288ed7c1db93e0947cc8664231c07646f3dd1ab9e5a0390147cc9017ce0bd81c336900fea51ff0bd522
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5ca6bebe26541d69ae928bd00dae6607b
SHA1869a3ccf3f299ad50435093d12c8be43e31f2132
SHA256519cee341b05dff2ef867ca36cb84ade8b381177de1c10e00b0a42994227281e
SHA512507224f560adabef0cfa7892e4851b4a5a43f4208b3d3d5c36bcc2eed9c135d5d01f4d3aa9e31d985587f99fd3cd0fcfdfe905e5e0082e3e47f609e8e42df051
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5a36d5c6006c5f0c56dab808141f79944
SHA169b09e84e09adaebe9b14295ce1b480d29824819
SHA256bc610a4423c16e18cb4813343d7ea0e36759e79a0b59c4902115729b86b9ec82
SHA5124c3d80773bbf1e0b29d749000615f266667cc289605008b992fbfc1b9e059471d4c7bbe5454eacf667a31cfd3dca0a137ff4a4ed8ff331dd38a83f0025536e3a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD50c60909ac288ca374039255809e29bad
SHA1cb8b7bd6c123375cabf7e16e4bb50ffa82866620
SHA2563d1978b495749192d6626c5bb302ad6f377bbe6c2232a92fa7ada90707fab1af
SHA5124585126df313ad41ba42869f520dbcd4dc52f61c51f83ef0f6051ddf8ca9ad27e0dd01e036a765b2f45ebe08544b321bd3b710e73b54dd0eb433f2afc874a190
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5b4ca57c273943702e97b156caaba67a5
SHA1e6266d842a13ad2edcbb3b77d357bf2245888bd8
SHA256d464a87b8ad1508daf9601de04547d61d9561c39aafa9f6abad2a4c5bad734bc
SHA51237b399e73a7828481c6e886a64a523b758b93f4d10887c686b3cce83753ea9c6f1c27ee2adcf8561f8c5224deaf7f98063d9fcf3d8d32b416a83e637d91abedb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f7c63d051141f4963683bf0d101191c6
SHA10d368749851580e669e560cb7ab73c46480c0974
SHA2569d3fa18374510c957e23e3c9a2540fdfcc8358ee55dd1726b5d50686cde6bfb0
SHA5121795fe160bd1dc20cc4e478c44dbd3b5ffb8f7cb5f35f4777f47771dcd4cc07a21b1842f3fde328f65261e559ae4db97b3e9b0f2167dd1f70f03cadf34635906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5caec17737ca655a67eb9f67bc1ad1f7c
SHA1daa0d4f6f88c13a9045f0556377cb15399d52b19
SHA2567da2833015fd92c1b419300b70ec24ddfa619a87e90f43f5b62fd98b99d3346d
SHA5126caaf709dc0be43c0672a819cef82684e8d56c4adaa744899db0adf9ee25ed601eaf6f11138bfe661742634b21ed695df705b81da1547b7bfe5122aac3f21adf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD5c2d39964cdb06691dfd465a071464da6
SHA17be8d11e5de3faefb75af9d29c26b141f8f992a8
SHA25622a9f89bd3e881634d4bb65027bd619c2d69ef7bc90e4905c824df1514fa6a22
SHA51203a56bb9ff332168ac4821f05d64f9a4e22cb7a7c58af4501e492cf0cfa5798e845a6f87fef5df9e8dec082f7d63c661c4a2e326e60cd365f7450fc2606c1747
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63