Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
41KB
-
MD5
7e724cab344e97de370a94659808cb8d
-
SHA1
f6ae09a1125a68c5199ad40c30695a788d7b3c52
-
SHA256
9d133cce5b665705d80702833329d1b7c078c066e5874473932f772f79aef631
-
SHA512
1abfe1124b845830db4dc4300992cd5c3bb35f57e1fe863c2015f0ca47c5024d3a177a19a45f2ca8a5aa4edf2aac8c032719895761bdcd19d87ba5e8c65eb724
-
SSDEEP
768:SUmh0O6I8kg/yFzKszoW9Df2Bc3Z8vf6r+f74hqAJ+HSsDD/0+oY0EWLj+a9kInu:SUmSxIz0yFz5zo0Df2Bc3Z8vf6r+f74y
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{527349A1-13F1-11EF-917C-6A2211F10352} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0071fb65fea7da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000015e64bc318111d49296f62f4db8c6eed15873883900b86190109fe1db6f7edf2000000000e80000000020000200000000aae4f4ba7b1cbc9451eaa0c8499d97aa73dcb43fb05304b1c06bd8c8c30378020000000520850a0d705a46bde15fa45fc8b709e568db90d991789b9d58aab59550df3a64000000044c327afe6917d4051bdc1b4147b132b3e85d946f50516f732a2f8bab0563f92c784e04a666cc3d2fe0a24b0d57020068610c9341ecdd9c0b9b07d55f6b3a3f4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422073134" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e93610000000002000000000010660000000100002000000000ebea4dbe657b7aa1984f6f8ffc125daefccb1a73fb757dcea18b31f0cf9cf5000000000e80000000020000200000003f61bdf3c4690af296f48855d51da65319ab03b5b2b15cab306d92222e2922559000000029440f83618d067b17aa3bc5b805785499c7451ceb5e8730b671a5729b61d02ef0afa636d48d0844ccf278707e0c3bd7cf3b697927b482f0dd4d227092846f287dcce3fab0811094a015318a9374de818541f07e1c98ff24104c01b3289d63b00b988b3e1c4196a271ad53b79c54f14f371c292c21283cfb5066241dbe352874f769cdbd9ea0b17d0044130d5eab4f87400000001518393b4a6b69930afa18b95a9f7ac010739dbfbf4095119ca2163cec34b06c7c4dfe2e76f532dad1bacb889563b2aa1dd411d3df99dc4a223570e0b1174b94 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 308 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 308 iexplore.exe 308 iexplore.exe 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE 2360 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 308 wrote to memory of 2360 308 iexplore.exe 28 PID 308 wrote to memory of 2360 308 iexplore.exe 28 PID 308 wrote to memory of 2360 308 iexplore.exe 28 PID 308 wrote to memory of 2360 308 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:308 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:308 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2360
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd326ae49ec4987e2450fd5546d28668
SHA1d0488e7b88399f1e648b19e66734f3dcee318ed4
SHA256cfaaacdf3d524322d7bc8fda653e231188521139c9e1f5af53ba14068263c4a0
SHA512fa3e376887c7157582e646172e9a63ca3c428e25719011ae1ac39261f8c26262106d5c19c0a7b4b56427768abd7e1c7fa627f5451399250cb1f2fd7d62f25c37
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54897be9eb1d07a12056436f72a4b8375
SHA13f1c13876b2f9a295c5f77d434a7f9f4c8ce6882
SHA2566dd6bc9d3a5d088c7e0a7a28848ed187c90c9293079eced318b72eac4acab575
SHA5125d7e51341f8aa19c2b071982e46703b87278d4464bfbbaecf2a03f17b4373f2631fbcd0b8505f670554ba6321f3c1cdf5e015c549fbc96954b9fdc9809d4a08a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5be38c99ae1c7c15b7cbc47d2a5e9034f
SHA1cbd8619739d2e6cf33c6fa48a821c60775c90d83
SHA256d53a3da13d883e7b4f89bdb5275a3801d4726961cae23d70f2062391151e8f39
SHA512c8c821cedb2ea62719a867dc3f144ca78aac7bbde76ec5ab140cf7b8ad1b3b5d3fa0db58fbc1ba44af7ddcd61cb3e672ab7fa70b4c566586bb02c5c8eb66db63
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ab7cc9ef9f993e9df53e00bc3f3ec24c
SHA1bbdd466ef858b5a5078215495d4e9bf1afc08814
SHA256f085b402f8cf992e57f0138b07989e132cfdb00fb7598daff999e82c128381b1
SHA512c9b6a71da8ff55a49a99e11948b5c3f7d0a569d85e7bc650fe980b4021c6eba409f9aa6d000b1e8aa3c6fe677334c4b8d1776a084f45a20d78645fef9f05dfe5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f80fdf4f0599b4e60b7212077cddac48
SHA1d7ddd9ca3cdb863c7f8a218f234bfa46a4d47579
SHA2560be24b135c952a025bb78d86eded394c3480ffd19c2da62b784572dc63853b4e
SHA5126488e56b0d73ca476a91f36668eafc5f0b6dfb9d458b110bae4b7d7dae2589b71888d12c72816fb91698c9e6ebbed469c367fe37b89140016315376d5ddfc7c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d424424cf15c72b5475b3bd4ab2b14b2
SHA1791f8b3f4fbe40e26d19ac5c780661de107083c7
SHA256e8e1cde34eece276e329045e82aa42c126c90f40a32e284dbbbdebd8df0ceb12
SHA512eb6d51f7e7769fba04f556bebb4062aa5fa77d45c26dcb3a520bc334d17d66c95691a144e174ef11bb4ae6e9622aa49a3224303eecc1927e1f44bca09aaf9597
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD576b27edbc46af4a53b042372bc9aa191
SHA1fb0b855b62729ad2c9e0cbfe912fdfae621586cc
SHA25667044a0bc0ba75915929060e5d65b809c188246e9ed97f248663e3624260dc99
SHA512d0139202172cba0ad94cc2ddaf51c2c62fe6e4d35802e5036f435adfb26c9af2db661c9f609187f550afe5c82c619c0fc1d2b43523bc2c8390baca66ac93aca1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b3d041b8fe9d1fed7ba819c268b7e0b
SHA1be31aa2af7caae89fc3567811b9bac8fcb6d98b4
SHA25627cd7fee87dc89cfed48afcb3ba96c7381e8e32dd8b4124fd57f35789100d0b0
SHA5128a62d14791804d629bf834be4b4fb4d001a6ba6677b37012b5fbdda935e12ef9d17be38a73bf2ad24ce03b6f87400b6ac5eb68215d9d40b7d88d4721485c4624
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52976589b058f813a6aacf7b47b328971
SHA1d0075bf44e0cda8ffce68358c704f3a4651a07a0
SHA25693e1be751371f361c6126905e733a5b1a452c41bed77bdb9cf9652eed36bf711
SHA5123d4b532ba9e54dd4ff4ffaac94426db32987f64724a1ed352dffdb33619cf13f770a04dbe9a66061bc72d7980a45da22b816c4fc001eb3364633336aacb8212b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51b081dd24c3724db91d36299c4dbe5ae
SHA178bbfbd05dbf52cf84dce4e39c79ce82f5d8c912
SHA256aaa258a18a9a027e32ec38c59aa7a65332f19491ec0a3c0fe6e488a2a863c612
SHA51219b0b229a806d129b8cf75162056c436e5e60f60fdc6c269307d30e2abf4a11feb0a6d6ef8cffcc9dd3639b6b7db34d796d1080ab1b35c9ab66474a5bd237e7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5271dc6cf23f78f4870a9b8950c627635
SHA10df78f9a72e04b82666f67559debabc22f204032
SHA2566f69eee26ec64c3559bf9fb2d76775d80a3f32579b05555fa10e6cf803e7bcb5
SHA512071eb81d67204d2cb1a0083437527588176b49491c5bba7f1d7884209bdd930bba9e4718a3ae93e749a78b72d2916db6af2340d2fcb1966cab55053ca6d30b0e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bc461ceb81712c70c0a7746f22961790
SHA1046a0ee9ae953b0ee9462fa56f94714042932477
SHA2568ade5d620c6594d4d41b6415b5e3e05d63e9dbb527d8838c03e0dbe98deec271
SHA5120f58a7d584bf090414452cddd27aa282055bafd45363e6fcbc97ce69dcf63d962d903f1320b3980d84bc5e2267a923229b682c660892b64ba3f0d3cac6dfc1f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53490bac3b0bc3b15319c29bda1206718
SHA19585f773a679c29c41c785031e5db6f3e0d5e368
SHA2568d1551e8fa1834838a4d2513963fabb4b5a6ef902e867189ced549bc5fd429c4
SHA512ac5c3a2145d157afa37c66abe861d570389da189c82e41818ba5400e165c263f62cb89a4afe1ba3055f59f0cb48470d72e40779e5629d184637da7666c7d9ebd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b33b720cc0f4cc94d16ffb19293c4e1
SHA1a1ea445d1ba6047602319512c7c216deed961c14
SHA25612e628bad039ed68597fcceba8a727dc81dd7217bbe6aaaed0393705477a76e8
SHA51298f8e89e4727becc3ead808c1ada5a1d0dcc98b6c1a377e1937f2196c8bbd99255023c664a8c2185c6e33aecec6909ad5ea35b7edf51cfa7faaefaaeac48fdf4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51f171f8cd4225f3785adf995d19c7a73
SHA1779dce747ff3a6057ed41d407476dcd11fe67724
SHA256fa5a06ae84ea22ac7d4dfcd28c55ecb1057c0259d94e24ed2ef883a17faf74be
SHA5124ba93dbe3e94a257a7db0b664106fb2349ea422dcda7813eac716abddd084b122ec227c4086062f6f8cff1b3ee314ae2377d4e7af58ea95f5f1596f48f3db0e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5609e0d8de967e92425c7c00fb6a1f722
SHA1593d58c7e4567683762adfd36e0eedef2957adbe
SHA256547db1b34c9e41fad9823f1c499b2b672cdf0a5e5162de40190ed1f0cefaea73
SHA512d5de380a644853f8402ffeeb1d9ae17d7c6b5c22c4ff819f84ec13171d8fe31af7b1f59e8b6ea701b3450e3cd77ac673a5069af309721edb132659236c0b4469
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5627a7ff5389d9c631e32fc6e46e17602
SHA13e9a3f98739add7e017d152b3796845094b5caa6
SHA256d5571eb9554760a80df683ba33dfe1fee98cd4741bf62c9b1f2c5bb30a70ca28
SHA512b18878c6f9375e70f5c029a68b6d066ca579b1b92b9baf36d9962f6e336b5cc003670ff6f42c890109ee5066a8503d6fd8cc80ed80e4b570117ee310a0d6275d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a