Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
9s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/05/2024, 01:23
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
41KB
-
MD5
f873ab45d3c2f94b91c0902ed401c9a6
-
SHA1
f91d869bb27111dbdc0949c9c1ff66cdfc5891f9
-
SHA256
e8e350c2476f187d80de266cbccc5df2d77f6ec495574fb318d6f0a4de4a6746
-
SHA512
4876937b7614bf9e42b0ad70d0cbb0844d7bd54eb56e634bd9d7e8d4339212bc448adede8a6ac2d5c09eefd4488aee5d6c8932cdee5c2672e49f9668350ed4f0
-
SSDEEP
384:zT62SsZeTfpchFYNp8s91UYTyxsjKjnm2EEB42EEBbod2laHYz7u5rjOTFY0ccMv:P6RsCxchONhUbNoJpuZQimVA72TEu
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{465B97B1-0B47-11EF-86DB-FA8378BF1C4A} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2080 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2080 iexplore.exe 2080 iexplore.exe 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE 2544 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2080 wrote to memory of 2544 2080 iexplore.exe 28 PID 2080 wrote to memory of 2544 2080 iexplore.exe 28 PID 2080 wrote to memory of 2544 2080 iexplore.exe 28 PID 2080 wrote to memory of 2544 2080 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2080 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2544
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
503B
MD5c6930abdea0570806905299a16d71cea
SHA1082cac2866af90f9392e0ad4b7334457f6178d7a
SHA25646462d970f49f841cf544ab108e4e22e2ed97a84fe1a6a70ba00c78f9c42ed8b
SHA51247dc050cfa661bea34342a191a921b98d52d65da300fbe0d024940dd781c679a9681711990ac2afcbe36f04457b6e0af6df5d26e21b923a324f71b08cc15086c
-
Filesize
1KB
MD5e829e65d7c4307d6fbc13c179e037a36
SHA1a053375bfe84e8b748782c7cee15827a6af5a405
SHA25667add1166b020ae61b8f5fc96813c04c2aa589960796865572a3c7e737613dfd
SHA51296c5793b2b57d8df5891c94015720960e0da4c2cf8ce1fc5707a0b46e5db8ce3761fb5fdb430f619d1579f13e80fbdd973ef6a024129ed039aa193273158fcad
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1C4782FBF2F5B27E917A9BCF8A0BB82F
Filesize548B
MD5723fc549fc3fe064419d11b885681851
SHA15b984adfd5f377e724ff416e74f3f3282fe41a02
SHA2564e134d6f7e1980861f2e5d9cfd11edfb8913ef06e7b8663e6f8c037374bc49ac
SHA512c75e849f309822254cb6cc6399ac467b744efc2b44b765e0a41af101a44bc859b793f0e0611232033aafe4b006f3e0b8fd0665599e1c5040eafa4aa275b66a7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e492317db2d01318f43126a7d5c0748
SHA136328596bc23af50fc3ab2442247592d20919792
SHA256fc11d45402d0ad1d70b120b8230d0ea7dc56b9088788b25ff69178eec79bbaa9
SHA512aa4e664a79d9e062f58957134d544d540204ef17f08e266e39f976a64c8af8e536588bf248e461f549389be06e46da0e1b56ae81b87a7472a50470d048098b65
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD563d86630658d71e9ef726846d6687491
SHA125b9679929990f30998d0a7e965c4156f0123ba9
SHA2565d4a5e3f8033e203e909ef5da3341e7262cb6810ba847782428af49e08f5abe6
SHA5123556452103ef97efa9fb6d04c0f15470c8e0de4b8be1eb851424e5e6f71d0d2dcf1aeca2f62353e25b089a2677085f1b758b59452b54625ff14b1afb9c090638
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f10469097b4970ab2e79e73848353ad3
SHA16771580a3b5b24eb5e052eaea650dfd2d48bd0c7
SHA2568ded5113ffe210e36d2a2f1b4388640907fe936ed7ffa0d5e4cc8b7533c740fb
SHA512e34170ca23ebbeb5fbbfc9e72bbe418ef271682408aefc87724bfcf5d6faf45347a82a7113343573b7706f6da6ed649348c05327fe2a30336e4b1e93b9306bf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5da2ae4f81732487e51864f174c024d3a
SHA1cfbef6c732eefd2144e38eac04aa5e1ea1e2057b
SHA2568c8e0726eb7f8fbbb42320874d0cdec2437d2cd24d25ddd75d29c02af5b6ef53
SHA51244961987d4ae513985fcbe07d085c73d5d50b4c021aa450c3d3dbc97527283e9fdd80eaf651e91a4d4544abbe7b4a1d69e59d30264c658efa3033bbd741bed2e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5502a5ea0d6f7e7e2b75e83db9d224201
SHA1778ca6ee97ae0ad7aa43a9c1d73ae92d7343fa86
SHA25642c79cece997938d03f421ab37eccd8d19943edc3699782f35c6e468bad28edc
SHA512b595022d627f0b1ead67a873a3a28b2ecc39fd0dd5a038925e4644edbc41ce7240e7be4aa07e0bb4c4a270b2a82c914c621b6cac43f11f5d0f25bc3a584e10d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fb51b4d7950611674b8a6068d661e1bf
SHA1b77cdfeba5430ca807ebbb12d0b282a8d6bfab99
SHA256a5e8db75908c34df574169681507e9c6b445fc929a3913892c51a6a9ccfd05dc
SHA51214b253019cc564ce85c23f7e8c611440632074480ac23e2f18fcb4cb567ffea3fb9e67d4b3f011a5cb14a0f732d1755cd1798a5715cb0fd4738325e533d84ec2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cdbbe373fa3a8aab46bfa30064409545
SHA100df69884ab2c5b652b564f7ff1a5b98a5db3e76
SHA25622900815f6df749e03a53a75e75f145224f045fca4e78b122fb0da2b6fd2cb21
SHA5122887e653ca4dacd007f809b8ceecc1bc8648f0cac344811642130ebea64e90154ec9a22d9b0cead410ff113963592ef03d7cd685e54533cd01478fe1ee3b3ad9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD593e163f71b4ca4bb9ea6aa7cfa5c2f26
SHA147fd9cde53cd7f6be1fe6fa5785340fd86b142f4
SHA256b7967853c24df7a155e2626f646975fdf7225f740f8d2c803c2d7f005d0360e0
SHA512bbbb086a2951a3cba6e5502955025fcec61e9fd32736af0ab151c4eca0615ce4ca0161d8bf51b7d34fd47d4fe43df2b4afe0854f38984dd814dd7c914dbbe414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cf44d020240b52fd295babcb009dd2e7
SHA1510e1aeab8e14d14d0e13a21e55a0eb943ff778a
SHA2562316070792570d3d667b4e3220973bb3b572aa2cd0ca7390ba4b103a0a4e6140
SHA512a15081e0dc56525e40a142a68b1bf1711d87352b8e1dfea6983fa7fc61755f141e0cc86da7772a08c98e7fecc94b9c313ea4848f569c8b68c207e4862c1ccd40
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50975437ccd3af189d87c5fc516746681
SHA1236ca26144428aa0a77fd31532acd1f9ed7038f1
SHA256d2bd05471cfce107a0d3c77575fde08a59f659241c59fc5bd291b4472dbabebb
SHA5122848c56ee7a6b43a83d42252682fe9449eb4ddd877637c6b1321bf30d8c12839b84d0d8bdca12b4bd14f7221e70cca2ac8f97f4e2acb82689d3db79396760dfd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD546b9ec54d02dd02478a0d1d3070e8a72
SHA1945f1329ccbd0f7fe181d6345ccd6f3e93945df1
SHA256de047483149410a8583590d69bb503214636335ac35e56b1777ee099cc16503c
SHA512b8e61dd5ca259e1fd879ab25b47177151a3300bb1165263fce36f35984dbc6b7c3af764777e08bb8e96612dd05f61ffb646721249a1d32e5e229c872e8b61726
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccd85445d6e4760d1473a2380c633393
SHA1051f5456ace104770edf5721491692c547779a51
SHA2566d0f6b6de5685682841a13c4bc0e33e16aee86f49eb4a7da757e52ba43f6e17f
SHA512323bb1b26fdb56faf8c980209a21219793416823dd5af09fc273f534ed3a43d11aca9de5c88f60b0d91fa6f40c0c40ce11a6ccf012046f3fbd5e95953e6de42c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5910dc9d82898ab4aeef611e196ae8852
SHA1c4112e1e8dfcc8d050e47cba7ecd71414feb57c9
SHA256f9bff354f2d82119d67ab024f6c5589178fb64f10990afa7ae4b282d6d1a71ed
SHA512971eceaaaa72f7477e139801ed5d10469b73cb23aa9e3ff8bbc98a5674ab43ff268ca81dcf28d13f0ab57541635e3c17b359c3b1a5cbbd706dea14ce93048b08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ada9396ead54a7564b13938d0cb4bdde
SHA1bd4e0fd7c7cafdd65d3d2a8a1382233887dbf451
SHA256c44619e4bcb76b66149d7d447e2c494eddf7b4effdc65395251ef9bbd4bf134c
SHA512daeed8edff269cc723387564d7d3b29ed3857b12219e19e7e74afd2370d9104e91cee1cabb9f5a416acee05fd0bb2f1e5f773cfee29545317f4b4f1d89ba713c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50216a44b2acdafde85d42685b9517a7c
SHA13bb464517a6ecdcdccea7dda6cc6add014c6b500
SHA256154bf7b681c77baa6de31fbc4e1f6b30f4f1d109e3d47d89153c175df8c3b327
SHA512d2f07535ccf2e513eb4504dcd9df0167afb909550638c2c273b75e312dd913d30b78bfbe35f0020df713c6279ed976aee46acb4823c4caa9a3a17f8feb3f8d61
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f6884746cdaacc87981941f85b88fa3b
SHA16bbd3371ff9cf3149dbb0bbe911742ee9d65d5d0
SHA2563e6ea92c81bf9ae3f166024a99628d0d8b18455ccdb3e3090acacd514a9ce919
SHA512536f6b2fd02b9bad2eb51c7dd2d278d00b19759d05299a0a8b9529e834c541ee24b9e10b2d782766f6c6947b11f3e136c8da9d031ed6c027396184f3320af569
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD512075233ae62ba8060919e6bb92ac8c9
SHA19d3a63561380ebe77a8b7a9390a72fc9de6acd90
SHA256a1f4937089e9ec91c7c07fc0e15ada7db7c90f327cac4ffd60df8c757593420f
SHA51287346ebc342c0fd6035398193c1e08fc29391893e79a7ba55d7524c24300f2af21a5acf143afad7c2f69e961a49b5c11317c7c30fc37569844bafaeeed7374d5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57a6ac29cbe068e22feb6004992cd3643
SHA183d4a7c148fb566924f49333f8ef6b098f659338
SHA2560d89452a01a349c4b1b37eb5e95bcc8db71f1d51dcdbb6d23f26a380fecc27e2
SHA5121e56e06d5151b290b7f475ad4c31da8a6bb6fc65411594562f9399b7522fab76f6aa62de35a3db5e005760836d7e247220fdcd4ce3df367d6584a0ec262c105a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e818c20201b5aec3cf1cc3eb28a054fe
SHA1c95d9e55d73c90f48b5f57248e25728b15f9c67b
SHA256a0762970d744f1141d6fab4294f20bce6b72e0b7f5c79f40ed10b16c2b01b4d7
SHA512bb72077e0d093dbac524927ac99f0c0ac2c7a3c82d3957a62bad764a02d60ae7f8068bb55e71df4a2a564b87d2e40802c983910b3759b3ef6e100023c1daef1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8408FE5CA4467EE4DA84A76EF238FE3
Filesize192B
MD582407c2077eb63205f45e346f7cd2322
SHA104e9d46e389711a68f3bc298aac6be9dedddb7ef
SHA2565e8759523cfc2a4408c78534d244d41c92e84617b5cbfdd30ed803ca9277f7bd
SHA5128932db8b30868ab69acc1183f3918b94233334e020699823a22e209191fc0db5f2851d94c5927192899807d14857708a19976b4a3b07779efcac80428d2817c1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA
Filesize392B
MD5ab6409eef402111baee64cec5f2b8b42
SHA1584f1dd1fb373db5f57a20591f0b99f5d62edeec
SHA2568a0ed2404a8df76ed6fefa2cde4dff2c00caf88b723d753fa183822f7fed146d
SHA512298e015054659dd5adb9972a6140df10f4993a3358ed1ed3b8237704e8f86255da7fdd4b76784657beb9fc94dfe88bc5996a5d11e0b70f9c8e0304a2b6bfe2c1
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a