Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 19:13
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
220KB
-
MD5
6587bec62e3dc85d111ef49337876274
-
SHA1
26a445562389524f2c702c93fea368864b0a6e5a
-
SHA256
b5fef4581c85307e2e4a03935444c4faec3676d0d77e2b734d917248086fefca
-
SHA512
8bd6bfbcce74dedf2e64b331d357c574272544cb56e3a07a2dbf049002d86a44c7f17231f405fe6fe3a8087ccaeaf3f1a9c4fab16d3e95ef379b7125ba7ad039
-
SSDEEP
3072:Sb/BSBTJBj9scFyfkMY+BES09JXAnyrZalI+YQ:Sb/YHSNsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8A723C21-1938-11EF-9CE2-EAAAC4CFEF2E} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422653478" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2492 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2492 iexplore.exe 2492 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2492 wrote to memory of 2284 2492 iexplore.exe 28 PID 2492 wrote to memory of 2284 2492 iexplore.exe 28 PID 2492 wrote to memory of 2284 2492 iexplore.exe 28 PID 2492 wrote to memory of 2284 2492 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5cd98238e17056e5b2aa4df5d689e4a3f
SHA134110f0ed17f6b930808519b5f6e2057ccbbbc6f
SHA256490e8e770a1786f298982cf059d3664809a43a7d125b2ae756a1cef40da03bbe
SHA512f5e1bbb663987ae4357f15ba2d0a9b3d27a01a53a1b09bd022fa9c8f9280c5822deff54f69a8cbf8acef8264b38a0273a83c008b686a6ec2b3baf57d2d1e2e95
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54ca184ba41ea38e71c80688162f80599
SHA18307baaf18e35d9a08279d3b050c62cda45ce17c
SHA2568313a2b103474cba7e04949bcd3205dc73a47e90b711675c2b0fffcace4b29aa
SHA51216c135a6037d3b39e5bbd4ab699996f5438b30d99d8448e83d75bc9c2cb137e6b7756dc16810e719d28f303177cef31f664485f57156001a40d0cf0c39329844
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD501a4417a44a4c97b58c569148bc409b0
SHA188b072e27cfa657bdea33dad99fc9ff1dbc89033
SHA256f3b02d0c7a7a16a39f67661b61f51ca0513d0c25e2f0dd9797e7ca3523c8b14b
SHA512540fbdb636ec5ece6d025a94c46a6689a4cde47373ef51bb2a4aa35c8b7c9243f953dbec58fe9d2dbc7c401b09710d9489d9eb5333c6508d132a354e4eb5ccf3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ffe3d92728f60aa68955010a86094e01
SHA17a3ab7dae28c2cd6d19e4336e6a4323aad8c496e
SHA256fb68cafd4de7199a22c736d956598f9ad400b8960b3894ea5870479b186c741c
SHA512888c71485a4ab62226b1a7c24f446f5656a75cf02e4a6a31afdcf3f11d908fb15fac80a26ef7a654d7fb411504cb9b3563f9432d7691bf9f957d34517a2b65fc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5249829c32e7c1c4bb9913d8045006adf
SHA16d18c3bcd10d48ce3de9406b4124c3461d43c7bf
SHA256c70d0643488aab608009acaa0341100e4b6735d50758bf3b27f8097d7d863165
SHA512129312ee311ba6233086476a918e0bf94bb0978790222ff90d1bdc0b118536edc94bb6b5b532a11a876344be15de5dcbb45db390b40c5a6b1f702c6884cf416b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a59d40970626f01ae8cc2aa1ee9a705b
SHA12113a5cf75097628b2c80ce0543d3b68a661cc46
SHA25670bd656b84da7bef3ff49a72b9b91be5114c4af9e8b3ab2f1476f7236737d002
SHA5123c09f23e8de71f75fdafae51f0d40a56cd4c6baf3ca25221cee8b2c668b5f432423b51531c1593360f7c07479188160d538f79a1e0f445d5e77e9892abf0b94a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56c78bc5eb4b74f23a8cd31042bcbc77f
SHA1089f917233f7e14ae41fb438357ea1db7d66da2d
SHA256556dd5160428bfbbd28c8e7f47a81e9d2b8b463ce137cb89c8f96f1dcc11ac41
SHA512906a7874a511034bcd24d1701eff06df483c118fbbfd8b7bcb3654e1f197965ade1618b3781eef13c00083376e6d4f0ea7ff3755572c9982903c4b6b27273d69
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f4eab47ecd7adeac62f33ecb9c6ad635
SHA16b45cab490028b212b7102a2b881c5085d42f4ec
SHA25657c606bc0b867b99a3a47507f918bcce881a3e37cd06b2663c21737de1e1afa6
SHA512e708f3637d2d83574ab653deed4dcc4e40862c89e583c3633787d795f12380c9351cb22455a1a812a70a09cc2f468f8f6b75f30731d35e7d754a26b9789fb009
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ad08e98e854798f1d2d1505dcd2109a0
SHA16ad534cef265ca2ea70a2b098969b6d97df6f6dd
SHA25632adb2bf6c4a70883af7b434334115f28ab0a060e588982f4dcc60158db99d57
SHA5126925c23b35c5873da61b3d5af052990f49f5fe366a549c23c4ba565adf0db4856fc366b6dfbe1c6ec7cbaa33e3e917fd57ed4255df5c46ff8fd2bbd32c9aa718
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55720f3a30b4ed719930307f4eabb7eeb
SHA1fca8813aee0a0e1964d38a2353592bc3e7537940
SHA25686cfb59f61e1ee20d6c55fa2570a4cd2ba0e100291afa1085d1028d9dde9be9b
SHA5124b7ecdc9fd4e647251880473d79d705f64a17992402d4ba660e3c006d3e6df0af4cc292c1cf5505349c0d6deac365a906016ebfef8fccfc70b10788495fd1ab8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52e53d5a2d78b385a6c4f3c1fc0482a49
SHA19fb9e191efbee8d7a9a5796f6c326a9e50007eb7
SHA256ac09b50f8a7727b52da095dda7f5f1958779a2112ed330a93fd132d85303c916
SHA512b6db512c32a455410436c44a9d24b1c8cae217e5c9d9454e26d60553508653c2285162493c119fc5cde0cf0b1bc0802055583762628355f90bee2f0db9248e81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58fcbaaa55eeb83760c202b335d9af212
SHA16b4ee362cb28ce0d821105826e3c52d233af04c7
SHA2563da558ac7ffe1498a3942f5bb390006e2bff6bf843073ad5801748a564442c06
SHA51228454518b678f36f4ce1321a222a6ea1e2f04c329fd6efff93eafbfc9f589eaf89f401523f45d8c02c8ff225f201dfd6f9fc71b42c374c49a1447ba92c55d4cb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f25343d93a7a93ab89832329b1b65d11
SHA14e96f4c7034e2a0d8ab74d4dfef599499a3d2fdb
SHA256b53438b92e90465e9df5b8e0ef61cf61ac627ab26524ef1b16b037fcfff73d0d
SHA512c1c7bcbca08717a023a589c47f4d4d8badb2c31fc136b4aa3442a7b1851ebacadf472f316c123695ea12e9e2adc2304041f235d8a8af69a78305f8940f91f5c2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD586ac2a7149fdbd01c41d1f3f21834366
SHA106d016f5dea9abc772345471e6b8d6f1572b0ded
SHA256c8b001a0910ee9f958e00f2e99d6ff9dbe811683921d84fe4f43a25fbe62a340
SHA5127e04dfdcdde15af9cd92d1df0fa547a6de81262c57f1c53df557c206d066a3ea5eb99e5a42e17176d59f600a167a62e67a2c32e200e9932ec86abf7645ef23b6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5189ffb0d08d83d52886ea2f6357b30d0
SHA1c4b7baec08b22f8de6bbb151345703410ed1a861
SHA256fe61353dc3ec3120ba03a987fe8a2831df250cbd632b7eab5a4611da560508bd
SHA5125a154cb9d6ec424ef81b6d337e649a8323eb2e29a8ede829ca04c019a1ce3af66d7d53542b2ba74e037a522b527930081ac77c2a529aaec4e0bf5f10b72dd539
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5072806c5a4e0459d6ccd165ee4a69065
SHA1a66cb079cc08e6d9ded6468d1b9ef66ce1219316
SHA2561509a17c34bfea3aaedb5d30ab7b44cce8796bad0c23e092f6a2e398f759fd49
SHA512c31d8ae4765c46112b836630f7f26bf2d1e0729848567e694d6bd159a5cca7e1dc9a8f50d04d4acbee76cf5d73753e88ea62609c735bb4866fb53ba62a0fb70c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5254626b43a62c831794adfe71de81b1d
SHA1d7fa7a249161314740eccca9cfcf28ae0794c7d2
SHA256ca8e6be7c6aca55cba6446fc0279dbdba4e0c7c189245f22a1205d26db14b913
SHA5125719e9c4f42651bb91795bcedf37ad828c519aaa6073c387d60c90db6098c4195695cf93d955295c35d24123483e6f0f900466aa7835bfdb3bd5472a17b7a529
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD556f84b2cf80b3c45927ec19058ca23b5
SHA10b992ffc809f51daeaf38e12115c4711607384a3
SHA256a385363a7cfbbcd65716161735829d6a9cec14bdbad82fb0fff3bdccb7094f29
SHA51270d3fac9954ed978ed3843676553f4b6b8b3b94f45ea41be190adf1e0d2198732156226288b3afade0c28874305a6c719a0f5913db42df03d9126cb03c5517da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5dde5d2d5034d7c4054ab3ee55c374270
SHA1b855d9672950a553d283ab2fe0386e90e4526683
SHA25678fd3cde8afaf3843878869ed29f7553ca01d88fd08ac234e5eaad889ef7cb26
SHA5122dad523f0d890780b4423cc6e028c39914d2bbf3923d7ffb4949bba4b96ff21412fbbe42192b0b4fc4010a37da5fb01421a05158ff040478e8e3ab7472739bef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e9db5bd9a4193eeac83d36b412948347
SHA12340a7afde8d7c363b6a0bce4d6dafa91daaafb0
SHA256b11d697905c850e180e73d8b4bbd725e408fd33564a83c6315de41b7db3405b3
SHA512cda720a05e9a363fa3c5b3da808c1e6cd5cb4459a040314b661acba2e2522e535ff4fee269128c9b6fb46da1243006318372ac9bd997e399f7f9396e4a2a1def
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD503aa280f8e003f6aeeda51b95fa26a5e
SHA1182efdd0cf2837c36c15ff6a2c5fabde7f519be1
SHA2565466d478088a037f8a3ebeaa3fc51c436c108b701430e46ac2a69b40fd1a56bb
SHA512cd6813ce37a6ad26a434e41733080fd67ddb0df7ef13139de284a319abe14ae0b32d5867e7c5dedeacf32d7c2567c28b65a0cb8f23bb23437c368eb71466a84c
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a