Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 03:22
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240226-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
f8a0c3303be1aa80cb86c2e99bb7ed7d
-
SHA1
3797baa7484a9ea965bc278342304ba568b4ba54
-
SHA256
9fcdb43310bda1f4372f50aadc0f73fdca65fa05dbb8bd6ef19e4bc0e87ad0f7
-
SHA512
7e09d4b68b09616521a0bba75736fe1f06082c9785f42fcaed880e383bf7703565d8c8606070be6838d0e87a1a0f343bd4bd9ef183ccefd4759b631403948b6f
-
SSDEEP
3072:SHtIAEfh9Shte7CTNPyfkMY+BES09JXAnyrZalI+YQ:SHtIjub7asMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "421905223" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5FAEC7D1-126A-11EF-972F-E61A8C993A67} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2384 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2384 iexplore.exe 2384 iexplore.exe 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2384 wrote to memory of 2964 2384 iexplore.exe 28 PID 2384 wrote to memory of 2964 2384 iexplore.exe 28 PID 2384 wrote to memory of 2964 2384 iexplore.exe 28 PID 2384 wrote to memory of 2964 2384 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d4bd46983bcabf76a54b7cd48a95a13
SHA159c1d817d723c6459da22b43f2b4e3afd7ff6260
SHA256ccd0dcbac1030572ce685d46c05f28163afe503af52c220ccb9d999bc1adc520
SHA512baed74008f1b45ccd8bb56d62e868ca67b96b45b8b3359c5b99a7926561dd6221855229400127caa41b475479af73478230b794a1c4adb801d8cf08f2da6b992
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59ee7c3254a91c66e881635a07d0773fb
SHA1aaf394cb41a50f29a7e3695e1b00b31b707bc1b0
SHA256b265c5a49dcd186168269d5af72919dbbe59039fd9fd488c5b9b16d7b875c636
SHA51223d1d9fb2732bc85e1a9ef7de3cfbb24361ec7185465b83abd4eff2efacddb99cffd544b1d6cdf4629c0d42332bbfaa4a56734baadaae5237af0e31281ea8584
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5028f708369b9177213c084d9b16759dd
SHA1f9817e9d309cf8fe17f7eaff5fb963ddecbba887
SHA256679186668f2f0aa17ad41d95d9839ad0df631942449b1435e4c6d4f1555f78f1
SHA512bab516f0029ee39be11bb7af51372b5a2d8e2fe7d7840cc6aa4586a78f80fa5fa89e2bef663dee822cf2a556a144218556b465e3b89555450422f5451d32e359
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51ebd1ba2ea2b2305f8254b7d0cbe8ff1
SHA1a820d19dd27274977d65a41107293cbbe267b7aa
SHA256364bf78c14ab63525080f42e7aa86f99cb323ef19ffaa57085ade009e455c561
SHA5123749bb6a2f00c52e610729bcbec80c849188f7f70862ca7c87166ea0628c5ba9c2dd356846354365e38c98b2623223e33b0d6a8d954d85e0f4598c942752fce0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5772ffc08c74da6cd4597a584ac398b4c
SHA1cd8df6c146e21c158fc50ece76f7599cd93e5dae
SHA2569c06776e59df34d6a47eb0f412d760a78b12f2a414602432c57e2f9cd75f9a3e
SHA512c66a9e7f33b0db291146e98425bbb81fce463c3f50ceb5de1b2254c8b5e936064f5cdf50b78067fae9f77254b2471f8e36254d3b9a1876497d2111e0b4734414
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD533e0d415f5a9462f8131419401bfb3a3
SHA1e92dee7ac9862deda3d3702cbb1cea912d5166a1
SHA2565eed767edb27cce233d4f206e386f6a9c57de273ab59111602b412dd2faf7634
SHA512c0e7b4464c801fa2631cc0f300fa417bdbe58cedc7a45179b82d80da51143ab9067558b8e1a9b042409ed7c377a79a24749da1ca7955b75316fed35bf1203a69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53ba4c8980f8a1413065e5b9340e5885b
SHA173c1ae13a7f03c98e4e625351dda8b9c210e8b37
SHA256cea282415a4f7c61ef21ceecf76e714784161ecfb92a86540683cdbf3829077b
SHA512123e740a0059d24a1e4795614475510e7d73416b6d2449efc11cf2fb893443dc57a642afa7616d6a04d2b4f44048b37a819154e6e730f96c5ddabf0539380f66
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5921836e7310a8cdcefde8b2807235e8f
SHA1cde45d6f42e53590d6b3b540f5a208acba4113fe
SHA25609bbe25ea26dd4a4c46011b2106189ac5ec81989e49d420409cfd613465c6da4
SHA5129f57cf2fe8b45900e21c0d5f9d88686e41d2d9c072efe095714031e572c620ddbd427ac3d4b37a00e63252d4bc7cc4627d0b1cc6da266fb3c5dfcd7527f05635
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56cba741b2e47fe85ed798c623582676e
SHA17bd17b4e58d71d197c7b00e5953a8290587ed448
SHA256c59ec7db270648a3b3ea51eb6daf8031c261a693b15c2e1e5c5f11772b5d796d
SHA512a4516d8f900ab68318712613bc64aec6b0eb6898d94d93835a2dc0828e10a81ee86633b9fb2e527b68dc16667b998848ce8e1e03256fb6040d1b58a4e4f105e9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5fa4bf51b4a19df04e2fd388e8fbc0529
SHA1c6a5f7981616c58f2107db94ab8ab45430bbf9d8
SHA2561f2ea5d4108563b02dcd4c6ebd15a6cbe7322c58dd0bf54d0d5b4120ba889a90
SHA512d713dbc5dfa7d026ef36fd41de52338dea59dbd3df09ee37555e25ba3da42b32ae4df91e41eac69a60e6891cbcce886126834383d3cf52e5a743d8e4e94f43f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b912c0c08b88d4c2d853b24dd99fa178
SHA155a1545d3c7fa743806d92e9b90a023ee739d2df
SHA2561c943f54af08c5bf87295670ba87420a851fe6408fad79be2e5d1279e2c978b5
SHA5129d7573ff25b38fd804a6b5fcc33f6ce6a32b84d85c66aa6eabce71d545b45aa2f8ea7e2466b2ce38556347b6f5656d0ecb08439895703410c6be4ba6ed05f6aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f0e99c11c2e8da0e8d19a483d165f75c
SHA167567e72340da611155df1c26df065ef7a49a115
SHA256ce781c49f36852fe5a1102f8971bcba3fbbe79df3308474f4e7e30d31beecc7a
SHA5121e19a32b2f5fb211d0c52124d3cb764c02ae2d4d82d7e11e316ca47e9e2298ca191906ea32eda29e542c1b1a97f7a377483511a462a5e1cbc175fff7c02290df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f1af3bf88e085fba8b4e67af843e8ed4
SHA10086f9bf2b8e47bb2a958df7940886a0f3809bc1
SHA2569c9539008a4324f8fabfb9d857923a32bcac8afb52f813557133ceb64baeda76
SHA512354c7c9ffca62de196663a86f8c9ea8dde114595aac255f0596a666158f179dcfab3974b4182dcb934f3bc1c86edf806f43fd9b43bf4776fdab891a145eafbea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a48f9c96eea5ea5faecfaeb1ff1aa29d
SHA1df4fe54185707d173cebb55272537ab45e95e5d8
SHA2566951e5bbab82a1e21782ad69095b5ed2d439a3184bb706d69760f5f223b0a433
SHA5125cc18cbd61cb384d2869b08aad06892763a93f358421057854dade7046b899925c0645d2c6ae7fcd8db88d42355dbaec50e4374eb3d074348cea76e9cbb3a040
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD587894d1501610d7c6ea69cc5a7a57d47
SHA1dba23a6ac0fbcabd5e9aef91a14ba7a9d801a340
SHA256a9861e7da272db5f7038a69a97910d5e48dcf7f483108a503efff4c150a9d65c
SHA5126da92f96cc18b14a70ecbcebe03baf3da2e3d893df2bd5833578687b8e2817279ee338fcf4fc5ec9d7093eaade7e56bf4bc4efa64991d37567ff9a631a6a5c17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5c7d1cb0cabcfb74fdfc58ce606cdac3c
SHA1a1df370605ad5ec8ebe83cb66341308deb5c9721
SHA2561efd0cdafc6054d45484bd3d39b3e5c3394446b7f0009370bc1fd5a4bd14c8f6
SHA51228a391e5105dd908a5482d46afa13e014755dd45272d9ecd9bffb0446da794203f66bdd1893dae5f7d4d6ef7446e48af417c9be8f7a36344ad62edcaf3132c06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e53d773b5a9f6ab1423681a77535724
SHA15712c3b7ea83c2d05c0a190239c966727e764825
SHA2568e7d5c430790c99ade2c30b97abff0c3943d02b4e08aee5060b2e61df19fca61
SHA512c79f6d7ed7cfb7c8df1effaa487a749899159d6d725fa403b67bf87f5a1f8f46ca913dd7cbc15777361421bb820e3a6e32e5ec4d2b7e541a0a01d42e4957e75b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD521f888bff489d77d118a8dfcecb26273
SHA15763f1daf0904873445749325b593ead424a71bf
SHA2568d10afbb64364ab3f0ced686c64720271fd36787a409ca17ed77e50f31bd6f3d
SHA512a91472d17b20345be46bb63d629d3f4ed5f6ac968bf81b8381aec3614abfa568ee31347a9d844b4d6ae2e84b36c1534dfc0d9f73f18c248953f90bcc603d73fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a282dcb4e5ddb1d72673c3d48875bf4c
SHA158e486d3592b0f3959f41e921d8217d8c7756c33
SHA2564019c1261fcc74637a90ca463980a1d2315fa2583ea23557d78e239458d29297
SHA512dcb3678376417f8c496bb1a7cb8777dcc7315765f5eee09d6cec17efbd4651c524d54a73dfaa39ba6ea74a82c2bba3d2264deeb56eca0cb293be7a7fc9eb3a2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b759ee64d0bcd371a0b1d7b6e95ee8e
SHA1d9d7a57e59979042f4b0a001134932b4a52e9164
SHA256e843780e91277288fa4c37870467ab9ce3b1d25059587d18a180929567df66a1
SHA5122c5332c3ad6967286f8ae9c78f3ae8283d4508a260d4b956d23bedd2ff0924af181b9c9a440d951ac154ef48944ea630b0aa3d4b26854f34d92fc4b075add1e4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f02063847d1a1df4bde8200294cf81a3
SHA1c008b2ab62b4469bedaade3a61299385888f0e6f
SHA256f28103285f9cf4ecc171acd0549f6943db5b3b10b18cc92aae449b79e1e35bbe
SHA512dbca5e9da350a8bd0091d61bb040dff915d38851fa77b5fee712f8d036e1d2948558eee57044c6a3f333292f5ecbd47ed472670d0f9d421e2f410edcdd27a3cb
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a