Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
134s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
30/05/2024, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
4c712241058eb2b8871616f048825301
-
SHA1
cf30f094286fa9db47244a8f6f9207b29649b6d6
-
SHA256
5c7654e146fbaa06354566e33b1647adf2c368c13156c6e83dba119852695cb7
-
SHA512
437b9cf576b29c0657219532fdf96995ba9c9893201c970f7cb01bcbf9db7db9a60513835a276611b6c941d91322d58db0302aab14328a493f6b00618fc57c91
-
SSDEEP
3072:S1NDYCkOr1mD1yfkMY+BES09JXAnyrZalI+YQ:S1yFEsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{27F147D1-1E47-11EF-BC3A-56D57A935C49} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423209511" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1956 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1956 iexplore.exe 1956 iexplore.exe 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE 2964 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1956 wrote to memory of 2964 1956 iexplore.exe 28 PID 1956 wrote to memory of 2964 1956 iexplore.exe 28 PID 1956 wrote to memory of 2964 1956 iexplore.exe 28 PID 1956 wrote to memory of 2964 1956 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2964
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c79187306c019b5d3bd30753b46cd860
SHA1a8ee805b4683f8340769c716f87ce6f3d0be06cc
SHA256111319e960189ac36c16344fe09f57febd8fc0a0e283ecd5948129eb788feedc
SHA51256d8c44f2a1515a6c16f14524392870633ece0343c6a7e98d2fa16759f76be97b333722aa90b5ae6dce3e6ca58200cc07769921b24b2a733b64c76e043991e04
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5cc6e7c0523cd8e2b9daf5de7437a4e53
SHA197e1aa6ed090cbaf0862c95b5df77e8f42248286
SHA256fd43a0c5ef519ff946df8e0a7b494b1f00e64eb48154d29a6d31c99a8de8994b
SHA5123c8bda2dcf5c5ddb90d6ea04e74b951d412724df9441fec93cccfc3b2f6fa03ac195ee86c185764c3c1553ff801f23795fcbe4c22b17b3afe182be3b886d9858
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5191e54d948652d577e41c29f6ce7d984
SHA1bdf2b39836de61a36729a4a7bd8a98a6891fae12
SHA2565170e39b5dd09eaa6d22ba53781a17e8e2cd7f16d9a584147ddc66ac5853ec29
SHA512446b6823d6f54de18a7a3399de008948973db697a18ba4bad5919e42525b71c4fcb328aa461bf34a136c49e06d48914d43a5c01ea482d4d3e018b0310c090c44
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55d745adecda113df637ab9b9b7644367
SHA15f7ed4c8f0b68c838815b07e629b5cb9ace0e499
SHA25620df68fe4074c39f0ce610579fb169d5a9fd236b80c82610f7e3fed761c40b28
SHA5129218c8932dd40e828a01d3491977484f037c757ae957d65cdf1e876b6362e7ae8ee51406d9d6e632808779ceefcc8aa2b1f101fb251602b42e32e16015b39136
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD564eda0c0a01082d286f6398c780121d6
SHA129f75acbb5fab56d7ccaf76d8e51a871b22014fd
SHA256fd579707ce107df9546423dfdc9b8bc410d367f3404a5e9a41fa6686857b575a
SHA512b2c6af67cae7923409e21df159e88a3b09251f1569bb1395d69510e48cbc28169470772895eac49f58e6d35442c376882daafcd5db4b847579e88c26204163a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD537091d9ae00240ea1ed37070b12351f4
SHA1311e4ac9ef1f5d478155d9b3cd19cc47e9b36cbc
SHA256a5eb790070ff4fb3677a55727f42cac3520b38c24f837075c32f51b59d7f29c3
SHA5129936905a3c1640c0bb1fc7583c55f22b50076b31fbcb8cf06a9ff5db03b75331f89f739bad17d406b663caec028b0ff0069ad23d4dfea434db73270f0c8943fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD538b3d4bc079fead6adf88ce811081631
SHA13e42a64e3845bfa6c3a28f1fe133817d11892e14
SHA256ffe6b545feb4a7954a22fb009c81710a6f396aefedc0ff0d5d34b07ac1c8a2d3
SHA512fc8e11093becb9610bd75ad3e2e719e8885c6a1df9902c98a4046cc7962c89ac80545631e67466e2ef0010ac7ee6f2c3c6b9dcde63524873dc9585dd3cb565fd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d18403cba1d3fda95a5c143142bde339
SHA18db3fa9dc576912747500057bb4f4f282cbc75ec
SHA256b2714046834ad353f370e1981d8c8bf5b181b8b6a7b2641fdc21050d4225d0d8
SHA5120dda346999b94b4c79de36871d8a3fde3577c5d745a5eb3ac7a458f4eed3242fc1830511087b56514a601f585695cd58c9735e5709b7a6dec7e68b406aca3cff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5dbbf7041c7afa77f39884a3641ca9e51
SHA1c447bd4b56288976fccd3dc174c4442a5d2ce71f
SHA2562eb6838fcf1aebce3550fdfc872bb4cd2702be52fe8d483588b37e2e24faac51
SHA512f69350e3efa5ce680ec98ccaad9183201e14842c98efb2b1f8f703f9239e3ea8191c7602c0fd13475bea97362e6e06728339f9181af2c49b8628c64fa34a11a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58a7c7278614b76e79818bcd4dba88489
SHA16b3ca27a6e2ffe54d7a92d1c3f62b86c416b0f58
SHA256f1e206fc8d97aab2e25dee7c137cb3bc8c0645faab050ad58e566ecf54d9022f
SHA51243de8155dd12d4c858c35f26b4abd7970fd1aefeb4405a317bf16798801a0a018cccfce52dc0b517260be3a88c587a812056c2c7b9d59a6433b12460b2931326
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD549579a5289bf3baa0eab59dd4206e5d0
SHA109e415fb4a54dbdc22a3f97032f26431ddbf87c0
SHA2562886fcd430797f6da48260acf32cd45dd0c661cb4fcdc6f98a37449e0ffe2a2f
SHA5120b840d4d11941c1586ad9514d6086a0b0508730b552419966ae90950ddac8fe3a7531b0af9869824a978e836b0490d60e591e0d224ff20ea83ee3bc478d8a58a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD57ceaadfbeff69711b2ae8c0c64ed972a
SHA1bfbc474a2add7f0eebfb6a85f3fcc2ee18d8a40b
SHA25664517af1f8c3ae5149dd3acc7124fd3f6b784c4454ace88cdbf66b6f9e5aebd2
SHA5128770acb07319a227d718e514464f935930380403a96680fdcce7858f6b8e36ea2eea754f5d849d1238178c352010c4827c2d96d125361344cf859da571ac178f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598ed95091194776c090ea9656c806e8e
SHA10d77a486068d5093334d80f6a721c9ecbf2dd76a
SHA256e89a482e02b5136406fbd4886a3079b36bb77e8b9f3826d1c4feee6e8d2ad661
SHA51242a37e85277becc69c6f6d81ed9efc2d91ec884f73a31fa84e5f0d6aa15ccc639f863977d485ff97bce503ad411ac78189397ce48606861499abcf9f8367a8c4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58adc62071c3988af2d2f6d55c71ce5ff
SHA1bda43524f8ab9682260ce8a088bc87c73d2e0818
SHA2560e590c30c42bb589653edd5afa8206e2c45bf076bc52d723d684870716b85651
SHA512cef9100d269fba8db7f144968d3628fcd68b7a3661a3cfe7ab8f290a834aeb208eed25f4d2fbba6313f08dc660e774b142ae7273e75485dedd1f981372cf9cbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50569d770228580732fffc4485dfe85c8
SHA1e5be324960c88493e6731f9596f8dcc39f3dd370
SHA256ea391022ab9f110a2d528e6f649ed5e47d52dd8a4f3f497bc6c17c8208fdf4c9
SHA512f8dcb2e5bdbf8036465e093380541fa8cb7fc4a38a05a2be65adc5296efffe2155958709acbc0392aad8819a19a4ab2b306c1ef5a19b0ffa8571e4b08a535f51
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53bed5f3bfc70e7e769ad23e4d12897e1
SHA104c5af2ef198929a16721895ac68d3414e902902
SHA25632b2799f116daee0443ef5f25927f1f2cf126389e98456ae8d5f38714fc8a52f
SHA512e75763fce2002924e3158fc62763ae10e34c5f5247d4fed516c4f3a6e99bbc9143d2225d25ad30a4277ee4893aa481ef5b9fa4b27dbf63c5b31db7f2480d57dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563d8d40b9df5777945836e84c3ebf19d
SHA16a1fb8834e4193f58ae7cd41239a9008c60fc676
SHA2562cff562da6c2c7899a1d4d52e6569b5823047ad5fc5d1e5831d23640398a6a98
SHA51210dc708583f09a0b9d7802c54de360f4147038de32bacc241b5dada38f43d342d30f054208b43cece023567b3a877cc32e5f2d69db52dc86d608fcd531cce6f4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59431f984ca71b755a016d94f82389f30
SHA18dec79cddc94a81c6a53ef3cb2618de7c5758550
SHA256a153c64906f9f2993c6ee12a13983d795f589a8069036059d06d45b307b5d55d
SHA51276cb30cd5e0704300c663ec3c85b81e85d04ea096278e87ebbb15a829892b04e00fdf91f80fa2b7c97fc4a230cbd07b137079d4d05e5d393fce49d52d9151d39
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56ab6b4ea8b06d4abd55de904a0fd31c3
SHA1b5429083b48a18d01fd966706327bca4b58a1e09
SHA25692f8f64d3ebb498528429d88e449e5963e810d784721374448bb7b8353f52d51
SHA51296106848118ffb165aa942064047b483f422b21b9430d485072c6982204e98b00b6bf6f96fb907f50d23799ada669368c3c66ee4a333fc91da371a2c20dc1eb6
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b