Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
14/05/2024, 02:49
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
1a1a0392c016ae52559f7329df14b531
-
SHA1
3504ed136d698f640e408033f4c892c83d9c7241
-
SHA256
c8b8973a54c2e8955b8616b53ff25ff178ec6851f1a59515fdd5aaca6d4b6def
-
SHA512
66402a92dc41c588d2f0a820d4263a510f974daa188ae5438a7547a3bd89fb7de28b14e34ca61cb2c004b24e41d23a7d39bc4558bda32c744d66489fbd36c4a3
-
SSDEEP
3072:ShiuXJ7g3gqsuyfkMY+BES09JXAnyrZalI+YQ:Sh/xlLsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421816827" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8EF62891-119C-11EF-9F01-52C7B7C5B073} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2804 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2804 iexplore.exe 2804 iexplore.exe 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE 3064 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2804 wrote to memory of 3064 2804 iexplore.exe 28 PID 2804 wrote to memory of 3064 2804 iexplore.exe 28 PID 2804 wrote to memory of 3064 2804 iexplore.exe 28 PID 2804 wrote to memory of 3064 2804 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3064
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5050f9e03aa348fd24ca973c49cec83b6
SHA19364b5643c85afbe238f8a7ff98c1b8eee9c1051
SHA2563f30dae40db7168abed62f57da8ef4d5ac62afedded2f066f677f77684e0bca1
SHA5125419305399349052fade9ad3a7e676dd1c39a729a8599d7c09a8a1aa9902429f1f8f360eca6854dc31b8f5837ea1530332176efb066a9d55ce089c7ff4b18586
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509d0c082a7a9724e3d59b1a62e46621f
SHA15b25dc824f04d54cea75fa3da9a2e40ba4bfaa92
SHA2563a33a9bf50ceaa110b4a411a3754ca812b397f29826b6dab4aa6a29436ab355f
SHA512a1693cba5537983f4b740136a47514d48f8eaeadd62803151201e677de0314a9def1157c1d23c8909bd939bbf441b92b6558d10d812f43ab4242bd5ffa48fa97
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bd75de69118b6b854bd56dcf2192256
SHA12493edfa61fb7c108243f743d99ce7e04e7008eb
SHA25669030470bf1144d8e9812d209e06574149d286733b9edc7371fc13c576b50acb
SHA5125795b90dbb837fd5d1646102fd93747ac53dd49f0c3a75dc95ca387108736d014da0598b97f3b3c530eb3ce4a7eb238e39dc244dd4e74a77e031bb0ee8d49dcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55091923228156c6ea99b2cc5331f4b01
SHA143b87a1d97b579860dcc4cc401822172039084e1
SHA256d96cbaa89c4d6bac18bdc5d5dd33243b1e0f7ab9dba9774efc156acfc02f6251
SHA512ec802296b77f5c6ed5c5fd7b10ab61397cfbe4f4932c9b124d7fe4016e2b5dff4c38dc38a6fd83d8c0998b317bb18c27b9444e09e1661f771a5e8590322481f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5322f8b02255777b683c18d64073ff0c4
SHA1f47ab7d6f361492fb332382dd2fe44808b5875d8
SHA2563d901381a6ce4d79c5dadb83f8e4dc20351f6b0e8accdb2b46c7ae686364a849
SHA512cedad54232fd58749fbbcd02e1110df27c57233dbe891c8f274bd177bf3c1188ef8d117c1707dd36420d3c7ce8e03eb0e65e82f43075300fcd20bf6f70e6411e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5958fc690a797b8830c0a7de34d2f0c92
SHA108d4b648ad6c2146deffca5b8d7f60650f50dda4
SHA256931226ad05103f69190a9ac6c81079c111488de935ec7fd028c31b26ce6a5b77
SHA512bd227fa0852e85c31876d13345d58124d915ebc664390948f228001375b01bddf18b65b6fa02aad53b452d865bbce2f069d628d2736a01e2d05ce83fdf635829
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55952090a3d1e315cf7e89732c9fea359
SHA16f43e99cca4f0ce5797f83075bfdc0ba2c0d10ab
SHA2566462570b0295c94417054e189283d942071395e445a4572ed931fffe82e09513
SHA51221bbe9ce2a41526ee3faac5eea7cfb66bb9b547d74bbdabcf08461a3301d2bf27f66abcebcc9f85d087e99b1db92d95c3308339d1a7e48542656848ff8fa694f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51cb2b53ea3b445ec98596149a7d0f99c
SHA164302250a4495f5b5495c243f9883212f6ca4c3c
SHA256087c9d8ce71dc9dc7f3ae70c0f159e73dd2d9a2add51e96efaa7d022484830e2
SHA5123e2265295a8812cbcc99ec70f4f28545238b17b7f52d39cb1a553b1a41177977f9a1d2a7b5fa4d718eec7f537ccd343ae081874c9f7ceedab4540a5b7e4c9650
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5aac7f194bd35d3f42fde20e201830918
SHA1a10fb01625a84ad66f47a0b2f2c6a436ae4af8b8
SHA25609bbe595800c564b0cf689d26bce6d055cb70747968de637a28a9fb5e2d23814
SHA5127cd844ab7e8e52003e57526cdfc8744054c592883f23e249555adee34f51edde2601fe99aa3269202c9f20006f7b8b3b218e04e0618a0aa0c256f86a061f14fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a04cc41e9e8aab3d60378ef94640a2d4
SHA11cc6f9d331b56bd35ca2a56201613b2aee79cf9f
SHA2568d071be050e31bf21e37fc8841d2cb65d24b2b0831b506af264a5524cef13ca7
SHA5127df52ea79312a423b34a4b7a2faeec34753b3f069ba0280a3de349598ab211f4a62d85a691f93c9d2899dbb40c546388ad8fed2b68a7de3c3a14dde4e1b77f7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5805af201f9ffbd86893818e0fb30fc6d
SHA11daad230f2eac81f7a7353908a9b0480a2bdfe72
SHA2561d0cee1a2d676a52094daf6e2a71f3d8f61dc2abf18a81c831a8328fd3a7348b
SHA512009e1af30f27d5eb153b5ad95410c78500a803d9d8fbab289b9fdf973c4e986e0cc00456803ac38584bf85c204150fc0088baa197bb5094bfcff4eb6712af418
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cec7aacf0f0e7d848965473b69c7ed0d
SHA18bc92871180675313d9e880fda2f27dac4415cfe
SHA25679a3f3af501cc880a4957407b059087ceeafbf01bd8dfd0e073cb7a70baff790
SHA5121eb8e84c879ea41ef76f63fe2f2788114c5a03cf1dbf9f77d400b9f6b46cc757d3640f021cc0e86e7829c1fb6ed603ab576785512fe61538e58ca06eb88bc731
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5117c873ca67e2b26b50b4e7aa3a449d6
SHA13a77ee9d775da8d081afbf72dd1ed21c5a715bc6
SHA256ce7bdb2a18bed071c2ff8c98537a6aacc1ee8d1617a5cb913be144fe68c90a67
SHA512fd84561b652dd48e829a9bcbd41b1420a490a28c560f8255329f8ee95be1a98bfceab1393ded8cae975b659f928c1655737cefca979d980da7deea006ae796cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57e639ae806b60b3a089710db0360e7e2
SHA149f2055469cd59b72a10d86023acd4df2e81f6f4
SHA2563c0b67e66104c88ae81d6c9ef27438f8662047d7f2ab6e3f47807ed716bf9b26
SHA5128b2575c8109822e8feaea5a1f4526f81812862effd2030aeb5768e7080061b92230618e98ea71d41ef8cbe0a3a914c33c0287e89d4fe6de3d391d058115f0426
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58a7e1c2bf89e715aac215e6364d728e2
SHA199b9edb063f1e8c33f9e7df263140f50573ea44d
SHA256d8a2fab9cbb23809dcc2b413c96805a47d4356855039a6e237938737931b0c33
SHA5124d8e0557a890e83eb920ea3ed879cc0dc459a3ec4ef457579d994ebc050d3053c3b3c2b2da856510e21e64a1160b9533b5c2caa564a5c6d07bf66156c75bd390
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f492150d6f721d84c9abb16eb7dedd06
SHA1df5d575d32f0b93bcccf79bf86dd1f26cbc19b1f
SHA256dd4285fbde6d4a8a6562766f71b6a7ae4108c41bb4c889d4b77847ff775d50af
SHA512274baa8f4bcc1d197f1e6c5bd77f7f32347ab156326d443801f99cd683d8fcc0381ec079248773b129d2e52e3d02d989764b54ee3584945379b9156664a1a9ae
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD513dfd9f5a4d1e0bc83c3bda8b99393d9
SHA101971ffe59f938f56010110fe11034eb7de54873
SHA2562c9fcfc81dca0842472fe4d132b4c4741a75bc94a15fab29896a9a4814bf025d
SHA5127e255685c4cfa50696bd3f277c289d070268105ff773af40e6f61e18f5b3a0d2d01b7179343539db5f14ad3dc0943bc48e3fc48e630fc2076f894d6d5a814bba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ddcf871b5e6dbac60a91f1ca345da0e3
SHA1369bd28377f5db718d73a7b0ec4b0081d388ac96
SHA256c80de2593d43433ce9169c365521097950edf335fe0819f5dad8311252d34175
SHA512d4d18cf0ca86cc2b1ee029127572e29763f6ac4eb1707d477e51cf35d5d0f002629fe02d2b438555716e89772b7f61af1856d676a6e1147d3eb3bdf4f30e8f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51683a39247e56c66387c6ce119c21ddc
SHA11c28ec5c7d933671c40ff471adb4bd00bcc99e02
SHA2561e4aae8b8b5b8ae9f35eeb17f3d0956346873cd4a0352a54770de2d84c2acc8a
SHA512440f6002f05c2633416f3cbf94fb4ca8c9e0b7ce2d7a2954341d1c7fa0da56bc7322eddc3fa6da66c5c96a0c7e03fb10d3d6d1543e3155b5e1acf914d582d42e
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a