Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/05/2024, 10:51
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
89abb3c84b7c80f720270a8552fd47f7
-
SHA1
899183cf9ac190541ba50a3d22c1ecc36c34d0c1
-
SHA256
944e32de1dbfd4b89ad5469c693a086a0c712b20ee231101153e905f40b0785c
-
SHA512
179d3c6c2bce0449446e5ed2c33f74980caed56920f3f920797cb32387ada929d00ca1b131f1361bbcc5606e50fa71f3ff5028c68de7678d4e2f4891c22f35eb
-
SSDEEP
3072:ScF7Qj5/POaqIhIAmbWyfkMY+BES09JXAnyrZalI+YQ:ScaUXsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421413758" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17BEA701-0DF2-11EF-8AAC-6EAD7206CC74} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2324 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2324 iexplore.exe 2324 iexplore.exe 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE 2736 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2324 wrote to memory of 2736 2324 iexplore.exe 28 PID 2324 wrote to memory of 2736 2324 iexplore.exe 28 PID 2324 wrote to memory of 2736 2324 iexplore.exe 28 PID 2324 wrote to memory of 2736 2324 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2324 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2736
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53936bd0ae7d237196d50f687ee8c3aab
SHA172033d3ffd15d00ef6d44686275bf34f35eb881d
SHA256517de1c85f2e694d078a440000b1ff58cdc5c3f282bb4b1327b3d08e78f534a4
SHA512d21c5445d7717714b961df2027033ab8da180c26b19154c4b3422574c4894729566819d7e6273e180baa5cde9e5c7cd3d560418df1f8bd4c2c1e950c6473472c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5598dbac590b2b867b68055e9e75e1e42
SHA1b033f07365475da82e95d4d4cd27bcfa2c38ed95
SHA256d09ba16522ff79f0a5111e009c785a5d795df3658fbcd62ff3d18460c543e167
SHA512c6e9ac011d37764f9e09a3e32f802a39491fa0d556b2f2bb1235c17ceb404db20887447d0fa199627c854f06606a3f5de134452850ac7a8721111f5b241a7d74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58ced32e4d9b818917ba5b5138201fdfd
SHA1472dd7ab48c67e85803cc0c08cc4fd5e230869e6
SHA256eb980e5550c98b779ff8295f67f2b4afd8ef52a3597a75706bd83dae359310b3
SHA5123fdde6c2c3f779f2b785248e5df0a88401e2c54d726e3451fed2310c58abf6f4449a5d34b8c5ffd0d98326fdd1960940481724918084f185411e1e667da4acd5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e2d5feb3839279811a6ec7d27e0b1f5
SHA100cf4d124d9a6cd588b59bb92dc16a04834330e7
SHA256108dcc79614bb2d3796ce5311c9404d5e55cba15ce56a314a5a57557bca19fe2
SHA5128d6105e3de0ed54d15a47a110fad3415c9a670e918c1959be28cc0b0df6a3139a6f5d525b499d8fcda86ab1c79d4a6c24993795299d14df86df201368a026999
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cedd474ec96a10437dbcd8572a506799
SHA15f0e0169b5ac91f84c337e088f4974041123dd2c
SHA2560f5f4026c8a1a56a25e7476e64ec0028744d398912ed57d6c15ef11987de42b2
SHA512af78a3e5ca23c5dd57d3a447facf852446ab184330c73b844cb4776d2e956d09ac2855d103f309f6ceefe4717472cff261ed1145fac6825e7333d831270f7abc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD525c6c6b5bf5a318ba428c1cf74ff3fd6
SHA1640a3dd95fa89989e646cab8ee1732bb6b419ad6
SHA2564609aba45aaf5269f86bfd348d4727df8a7ffb32cff843322665ca5b0c89f9a3
SHA5127054412581c435fbdc833d8b53c29bf233fe987456bd8173730a39b647c720668196edcacba78310644dda96bf57f3c8fcc1b763fb23e0241aaad2d694813da5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e92bcfccd8393abb717a47725e449a33
SHA1508b8c02bc9c71dc3429d9352ffe8bf439bcd882
SHA25657afcbb229c7b107e147a0560d246d177e5b6ef8b14e459b7516e7338ef6cc3e
SHA512e565afb3662fca8e5fae86c1184d2bdc924b47ba67f9f27574f1799cf25e9787d9760e6c5db79cab6b3d506ab49290c1e7db4fff9b054e148d4c4528cc19eace
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56be03d43b45881b1c2130ccfa9c6bd61
SHA1503855ace7ff8f6ed1ff832d72a7bb53e07436ed
SHA256759b26d1e6ab707df5b58abb61713c84e79c483f0fbb4dc5faea3935d34a33bf
SHA512082bdc68fdbb99b3d5079ff4a481e861da86ee3eebc3bec9b43b19042d2d1130df9fe1b4c2631637c3fb20fdb8460f42f9d005449d36931c57ac38a968ee0f1f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9571b17a0d8cf761e57e80a1db41c49
SHA118db82c7be4e3f3cf4fa2a38d7ebd019111b49be
SHA256d7d751517c7c4edbb269c75d3020847c167d64fded10f74cdfcb536ca687a74f
SHA512d89877d069b5a178a438334fa630e417fe8556bd7d9bff6f78addb3204d5eec17c90cf2a524e463931d46d96e06eb174acb2755768347561cebd5ae2d4a2b90f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a40e93dea6aafec19f32dcd7f665e827
SHA11393c9ac49b36b0c6a532eacb626b2d75ee4d258
SHA256b19a307a6f1974eea752b1ed3dc46ebaffe3b6df61e39efbfa1fa31e462798fb
SHA5124712d140aa676ea948eb371d0594bd82fc6f98bfbf6e3d22d8b1124b03658b5ea72ca2b48d352e7b9cd49037bd957fd662e933c36f5fb12ac9d6e21da6bb0963
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b50ad2871b458b6ea111794af2dcd8d6
SHA1688469dc0c690bfd205ce6f97c71bf12157788bd
SHA25622e7a86bc8497339b83c9040f1756ffcc4a235c6b8159b3bf99cfd070efd3d8c
SHA512845f1af390ee4c3ef37e6de94194b9f57af31b491b3d1bec1658031eb346718f828dc5446fcfb81884656a2b6257deea3dae21d88077a434e91e657fb28b7231
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fd7af7fdf57f367154fc446721656450
SHA10447162a189b8dd4baf7eb1a112b368277eb9651
SHA256437f6a90c25433f1fe531d733ff67e27b486a7149e0f657a563c461cdea0491a
SHA512f25fee3d273e9d74e3182872a825d708ed6612ec979cc95a4628d822f85b784405dbb65732425a4a7d2051dce23b59fa9ff1a4d7362433e2622cd0575b9454b1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547459954e84ded40910cfd42163cb237
SHA1bb6d48fef69715682fbefda1bcac42b567b58590
SHA256e24d7b9ee07a8294e76dc995637d41b5e1c78ccd1cffd4e4c7333b2ecd959c01
SHA5121385ff9fd6bf6c2ea368f38c76c015e62a79662641363d251da747ddae848e25648f8d97a820dc0879720a3f244199beac1b932fe1df99553ee4f98a1a56bde1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD597f062c03d76f76663c29d98379e0724
SHA1e0a81317693578ce9691946f843f1044e03a2028
SHA256944ad41b421edf51fb78cea550f421dbfaa3ba505bb7e94c8c8bdf15cad819d3
SHA51202294752f1cbcf8426a0268e39ceccf25c9a81d034250d26d561618e582bb6c928f3f81a4a15f0b820ef15e3669b25799e5c173543fceb6bd5bee2482b51a4e5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f39f469d5e0d7407321a934ec5c9fad8
SHA1cd2f5298b619e8715d1f1083b566857cd3c38a63
SHA2567070ba652986d10d61d8cc037f730ee7415c1781871cd782b2ea96c6075e34de
SHA512ee7a4f140f2e3fe040b86230c03a0860ec97d7569b1cfd8a94c3498876aebed3272da3ab08fb2033a21b907d2b1f4536b916ed5a8951f6efdea6065a324e233e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5534f18d72a3ea37193d2c14527b63b1b
SHA1142de931af7f448a82b73b2cb1a89561dd24b070
SHA256dee0ce4c44773c6b11fb8135cff503ff25ecc083ffe27970b92b3126cbdac015
SHA512248210aa524b3b2fc0a23001bd183ca69415030e7ef7c574095054facd8a16940bebcb3a0a16b435f7e2355fc03d86caadfca035969e9c1acf46744d08b09a42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ccbe3b8e8a6ebc93cbf2dd304a856b3e
SHA17658cde55befe5e795428e770384aafef2e44e3d
SHA256ee9ea6ac5ea6f48a29dc003755fd75d64e2bdf2a17a14b0feca68203e405442e
SHA5129dd5980db378f206e313d4bb9eb240b44a4f9d7db4b6d6ea9d9c94b63e1ab7149c6a939f19a8c29db1f0a5c9303f1e108468589d66ee4f5b7ff47aa11c0b6c23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59bac4ece38b6648cdfa8e4aa6a47ab7c
SHA1057b51938d17e48e35507413291fb05b352e7733
SHA256a6e5f00364670bf269a6330f9bd2be0fb602ae1a654f01afd74dd53743e3c216
SHA512de5fab84128f0218b0673f943daf0573dc4e3b9597148fddb2b310507bea971d953f7ae2c2fd3bd7e4ada1a41a823aa48f04dfb2532b13c752e421e3bc1fe1c6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD532376e44f4a9b882a024a01cb3f96b98
SHA13b830191bfdf848e9adc59794baa730029febea0
SHA2562d13bac7ca86c7c3ce6b735c59264ad2059ccae001e03c43bea63303dce2f41e
SHA512aa9c76283c23d68be87e5695ecd435e27e006ca6796e89d7d5e6fa0cbf3eb473acd6629262f68391e0a2907e057a8e8a6106fc5c2a57fd156615a002d41cde19
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a