Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/05/2024, 09:44
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
41KB
-
MD5
dd08d7401437acdb8360c836a1ffe142
-
SHA1
03315f27cc5e7cff48c5c284da63348527fd1157
-
SHA256
77c2c958ee51050d4dc6c430da4374e6337f67a3aee190fda73377454b4e18b7
-
SHA512
9bf7877ab6333fc29e0a883c24220d0bc824f9a85c3576e884502afec1e847ba039066e0441ea294ff14d0436fee5f5b5237ab9c86a102fa81484c379a5d52c5
-
SSDEEP
768:Samh0OG0m+JfoNeV+5RDpSBc3Z8vfyT+PcFUCnJ+pqP5AVg+LGvqMDj+JN/OhNgW:SamSyboNec5RpSBc3Z8vfyT+PcFUCnJR
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F5D4FC91-1CD6-11EF-84CA-6E6327E9C5D7} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423051373" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a9ebc194fe4c44b84069762173ceba300000000020000000000106600000001000020000000b8a3b433c2b004d0bd62fdedb35087053a5ccaf6195fba6fc51070355973d97a000000000e800000000200002000000080f66ca0112c226484d1e284c2f12b9e51fdb452a6fa1c8aaf9865f0b2d339c6200000001bc985c9a163dbeb85acf71396d41040356fbe0be06ae94b7d55bfaede28f31f40000000a31d7b15c6f34436a2fd1bda1c32dbea1fceca917995280df48a70fea2433b21a383c62994d00cdab0a043a2369e30a677e34d5a9e4cc162510ea9b540683a74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 104ab709e4b0da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005a9ebc194fe4c44b84069762173ceba300000000020000000000106600000001000020000000f4f23e79944cdf04308e1f77ac2f7d763e74666c544f46416def1562cac317a8000000000e8000000002000020000000ca7934904a077d589d6af98fd9ef2f76f1558696dee52e9f74fdf162c5fb64af90000000a3ae4500bba6e34edf0893b6063c5ababf5a7fc36bca58495048ae1975d98ffb2bfd33f77f6130960f212f390bf4a3378b2bb110ce0ffd4637ecbb2e81a8b69e826387099cc93d848d0805026aa636dba7789e3577f9f9cc199ee7e4294dc4190797afc7ddf26921e627a38c7a447e426cce7f829bebbe02daa40a4d09bea7877f076883944825b83faf65744682f74040000000c31db9f7111e4dd0afc0bc3683644ac088efdb075e4d66af842cfbe5f17e7fbe5187cf7d9bf59b224640c106bedd14fdf8dd462aed94ba0facd5328758177b66 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1336 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1336 iexplore.exe 1336 iexplore.exe 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE 2700 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28 PID 1336 wrote to memory of 2700 1336 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1336 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD553a30e5292a3e3871770a548aabcd5d8
SHA1fd5af828460237694c69c692d13f79a96b2665a6
SHA2561f388021009c1e512899133e41d0ca609138d3e56cef660d8fa900a5a89c6ce6
SHA51229d7d06277f5cb7786876dfb686b0985f91559b9fc3280b085620e2887163b038619b168c601b4d5a7d0c0f2f74f105f50c21f233c89b09e2c84fe72c584e346
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f19c0617344df0760ffe1256d9c22ef5
SHA1c1e0aa2272c15831ae29fd41ca822d761f0bbe39
SHA256a9664840c7e79483edb1ac19121f371d084863ec952ae869f0dad2c72e583ef1
SHA51252fc2322b52fc71dfb38e9842a108c3f8051c811789cb23fbea8f4440cb4914a32f708a14f3d872d51c900fafd76046e956a193217a6d54a131718aca6a07451
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df5d47c7363c78b5c27e5dacae677fb9
SHA1aa6c24d3df11a0f83442865bac3733f58cab8fd7
SHA2563cb233744cd7d1653df65b23fba8b3909fd0eec20b1c6b8ac6d8175cd6d7c499
SHA512901c7d547755dac7da935c61445766909b0f8165c94523afb0bbf5d7a1ea90624422c955661393d84480c571335f2b01feb2995b1176cce8143f2f8970625ad4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e6b8181a9d0cb9680e925cafd67dafc5
SHA19c1ba3a3862bab2e5677a041b98a05b41b5da98a
SHA256e62fe11eb0820caa8ab64a417a0e3ee461f9de84328272bcd1466ee8ea3355cd
SHA51292ba72a031930b0e0fb3921174ba4aa361659abc7c5e4a182a790457676ef8f0bea5938aaeecab2284f02d87e017a2bdf54aa3cb54e36252ca4bfe03170472bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD58e3fbbb4bea5c85f6edcc079db0cca83
SHA152974521551045a77acaf4d49fa4ca293b35b11c
SHA256d39d54dfaf8cdb99a87a745b878142881f8e7dd55c6d6a35205929b492002c8f
SHA512af3a2132f25e78822a1fa2e9a0736dac16e5dbc13741830b75bc22b24676d086bfae2033e33102c0d56d776324bee2fc749b60c86a48c8ce5ed8a65c107c3232
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5882aeef82df14fd64769aac80dac3126
SHA1cd4d3edd75be6cebb018d699f0bee66642080634
SHA256ba9c5fa0e36135729898dd4db2cf5935b71bbdc16b3207ee91ea9186ff0a3126
SHA512ce641e084765ace80243fbd53e498c8998c8adbaddaa5cfe9aca21f8a18bce1c4d5242cf0e56d236681cfabd77e2dd905d696f1b435f88f0a262bcf4a561b40b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51e73ed4df7ece60cbfdbc954a2c777f9
SHA11fb327aad295a866964746d1834e35f7b8af6abb
SHA2568cd534895645b42b6b649433a43a4424839c9c5a2c4368586ef53a06ccc5e37d
SHA512c212366e8a1794ea653c0343af629b46c40c21b451490683b8c7a58527ea0473622678d721bec75829379520b8f2ed151b83f33ab30fdee675ab87cda3c1efe0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD531198d825843b70625f6cce25b3581b0
SHA1650365bc4e9cce2a1392de85715b25f59df96f4c
SHA256d06a172c2e544077c2f42771d352c82e33d6eeeb23cb1d938f4aab099f03e3df
SHA5125ca7a256ce85cb3ea9e881e0ee51996ad49e30648638b93f53a8735af486b86e2adc7d08114dd06e2b79426cb7ee6fff4f1bcdcb4fb2da4fab97d56615bb950e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55c5d896bd9f6444e6c8299b1cb42a8b3
SHA1a44c6829a0d82a2997388a99d1c034df8b06ece9
SHA2569ca69acce4e670953c7935c5cd4174a8c50847bc5d682c69c21b5640f1f5fd9c
SHA5121bd145ddcf479f2af52e7ebc5708d6cba51523c592edcd2f98081c11cc9cd70dfa2336800b323d3dcc08a70a3d9808bb29b4933133dba4c6b39c018500c5fbbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e869e542d1d8aa2d6d78598d2d46212c
SHA1f795e6bb5995f522d80f49b99f654ce7afac732e
SHA25660bfe8cc64f525a09e240a5ea419c2205b52cf2d53feb69e6e2ff9b303611ebc
SHA5122b1c778cc2d343ae69c3e9eb8b21050281ad7ac95a80258598760fd90f48cc8b06708a141954c6e3d201b41cd40e6d5ceba0e714c40f4d0455081600c0ade5da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50084173a89cd33b0a158b1a983ad2954
SHA199f34fed5eac6997080971706d940890d91f3b56
SHA256d1f555f19e5a87b29fd3da1ea2e333a0f558283295031f4acceaf1816d64106d
SHA51207a49516a01a354ae653ef12f2f103395dc82f41d816328bab98d4eef1fbf87e310364ab9144d67da7f0e541b6b18f36fa2eab158e74a58eede79624c3394c23
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e4bc19994254e9d48b8a746dbcf6ac47
SHA13507b37783a7a7cab7c0b28aa80f48b9999178fb
SHA256b4ff1e40da43b7441eca1272a7ce2a29060957444779bb92e630379159a88daa
SHA512dbc77c92df11dd7b69fde58b89b255ec068495e181493855500d755630369bd6f12070247dd3c18d9c295dbf006e3836dd3e2587ab6444a7e683b9a5da6bc419
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5699a0e1d1031e017bcbad87c146ca20e
SHA1a480dc71733e1a30fe00e725640a67dbb16d8d83
SHA2560f2b7149b47ea24c18392ca5053a47d64e84462881a4402d314ac038ff399412
SHA5123a33407e7c057e01041c54790bd2469f7770a370906f77ad2bd3d5df35251c45d219edec0f1fc4b8608c8f2c46d1bbca802fe5feca48c44e2e686d7e2684540e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d0a20199e40c8399b73d4e6053c0382b
SHA14afbc61dd613f8c9cf4f33a56aed158fb6ba2515
SHA256c0d4522c0a5e381e39d2929531b09586a06dddb888cc02ea58d9cc94928c2c32
SHA512298c13476c5bd8d99a445ef066fdf92a6055e95aca019945f08a6ee99b02edf48914043b5d11ee22b283225b26776f27180a5ae15c809d700473cc44a5c2fc5e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542c65ca2a494a1d69e9892ec1e5ef6f2
SHA11fdf601c48ca4240ca8c4828cd7bb1c52bf090a4
SHA25664f57fc5352417ac5744f58e7fe3a9e292f70e659d13f6b5646c81f079a194f3
SHA5121c28ee11736ce59b8522031791815c5216d37b85ae23b81987f3dd65ea44e497d4bf7afacd0ccec9e804c4b03adc33403bfe90efb7be5754a6641759e8bee025
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d93e209eb3603663e168f8b85f9e5a46
SHA187b85b2ac73526202577657db20ea9d1201fb696
SHA256d8de220edf83104dddcd278f4ebefcc33864bf2cd7bdbdd2133b72db77b5698b
SHA512d9952cfcd61407a1ed39b298dcb1ea44decd2c9a6802f42f618c81ae992b37a91a0e4b13da41b90a38ac5de9aa7507be693ccca2141b68212bac143411e4eecc
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a