Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 21:33
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240426-en
General
-
Target
sample.html
-
Size
218KB
-
MD5
6b3981569954f6f7fdd3be239227cc8e
-
SHA1
1722dcccd5895395504bde40cc850c772bf3fe81
-
SHA256
2a03a8715bb742ff6deeb7a65b7bea8799a54e57588468a84b5308f11775b4b9
-
SHA512
dc21f2d4a220d0d546d2164874195be33e438d71e44e6fb56de9c231cb0e086c001506694b5158de85931780622579eda7398fc81a06d6eccb45d9907c8e966d
-
SSDEEP
3072:SuzmG+Jt9YoyfkMY+BES09JXAnyrZalI+YQ:S6m3tClsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000699e684b3e0a24e0d4947a87ea06104abe8e93b6d602a1aa9eb8038a6da7b4fd000000000e8000000002000020000000c820a1fd2ca63a4ec6d3d001c896722f817d7caf6d563aae734958b19ee865a120000000db647c7e2b2480f99848c42f272926f7e2626cb8eaca51c228b250b2ff81a919400000001d7d669f8eaeed51d89eb9ae71eb487c1af7c8293fbd82307d01f5e74cbb8978d0f56c484926e44bbf6140fdb81f6487a67beff40fd34a31b931ef2b44eb8c76 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "423525896" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bba6e434b5da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC1499B1-2127-11EF-A04B-4EB079F7C2BA} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000760f6fb6d7365248881a38bcea68cf8b00000000020000000000106600000001000020000000eb36a8427510ce9ec66b6266222d6dea9ec653c99e451ab0cb03618648fb2dca000000000e8000000002000020000000565f13ab382d22011f9a74632c7997d7792c0f13b96b955e7d6dc110f18f1f2690000000fd01a7dc95bcf671988f5951464593ca0174069e5fbd331e1537ac740a86add69dfd98b771528505b4f186cc1a4debea3b71d02f47c8234da0ccf1b0a9bbda6dcce2fe4e685dad63efcac31fbe4cb05079e17e606242cc588452bdbaf37e62dd4ce3bef0b5f41ad9f03b94ef88522a63c710a133e8585d53832899a8b1758f47da73633a9da9e49849680125d912e47140000000d104e1199fbe0b181cae276b514ad9f587b66a875983608295c357840b6b94e5712cd5481a7442d3750d5059833ccc3c6766ce14f780a45f1a79b3e7fb6bb8a7 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1988 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1988 iexplore.exe 1988 iexplore.exe 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE 2632 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1988 wrote to memory of 2632 1988 iexplore.exe 28 PID 1988 wrote to memory of 2632 1988 iexplore.exe 28 PID 1988 wrote to memory of 2632 1988 iexplore.exe 28 PID 1988 wrote to memory of 2632 1988 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1988 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5516d2f10ad2e73e3af12664fafc284f1
SHA1891f7bfa225e8c0fa208d8b8426d8c7011267301
SHA256643f534004771ab88988c47a8457b355090a3257035968a13caebcafe4061c6d
SHA512e6e7bd6fb4525ba3be3c74f1a2696cac899141407acf49520e4853633db7f6ab173cba526548f6e1ad4975ed0f4d988513ba5afb93f2cab60456867682ae0db9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da03d92678949e7fc82b8c0421f911bf
SHA1ba6b6ccc327d84c06e48c28fdca910ff7eee5265
SHA256ecf837e064b20359211ed0aa69e4f60cd9e1eb5adc2c589d514d80e389c4e070
SHA512b4ca9c533219917900f03b4bf9248d670b69597a8f2de28875cb81ed7275cfd67334d2e187a6ded629e07c72d55a6d113763df954cf6224b2ed8208e42d0b00d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5feaae838ed121a731159d57bf4814ca8
SHA1cd680c03bc19be7c4532d31a23125bdad6a0c843
SHA256fd2f5f317da6397f9430e841dfc8229be337ccd6cf804bb7ac16b5185d7d7c8e
SHA512dfb0994c5856dd49479361994a77b38688f8b9aa3da3258dcb5241c848f4cf5965eaea0a75980c91825908923a2760230b5b2de09a01efb4ec37a5b0f1729484
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ed2c4ce232887e36d84f64cb33d71630
SHA16f6fe5eff9f4e70d3e29032a0c0ca2d260b90545
SHA25607aea4e3324ab735f155f1e4b01ad59be9c801a0bfb16f1ad7df2967cb175264
SHA5127c7597169f2c8982bffa97b7b7134a72ae9efed9c4419bcd3a0f00c21917292449d08eb455a33487b437157d4c7045580d93c235291fc98a97928a131c3937a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54736483053ec5787cbe2c32d13e01b88
SHA1d667d4f5644da2366c2afca9122e6a4df3d627e2
SHA25624eb79c5a8d274777f8097478b254b08b7fd3c04bf9aec1869c02267a1ae208c
SHA512b9ae5d2ad3de69c945fff789b61b9e6e7aec6373d422f15034a4897a7b5503bfd5a557047357e74e1216b1eafcd7eef400b9ad9f652bd8dded708cab3eac035f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5beab6de50eace1fd843782dfab270751
SHA12a72c3eeb8d22337e0425720ccde27ae0a1b450d
SHA2561f12fab981079fbcdb994569920bd86511ed64e3fb04c8cf6a2cb6052e38c876
SHA512b3af88627e701b0597dbd4f430c008ce908025ed7ec4ad6b31e42ace7002d15e4c9d057b8c4bc9cc76ef00a7c185a672cda4b137dfb47c1707b46f13818e5f7f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5375dcb35a50bafde915c42d54b714606
SHA112335ddad19cc6b1855eaf22d6cd822530e6a51d
SHA25621a6254f0d2d2921d8106435b162544f22894b81a25d326cbf89c8a0e3c925ed
SHA5128bbb8b6f39739cb871210c4a04ab05231484469c6fd5299de691c8002aef96a3e648fcb03252752d50f0392a38d9d62054b025af0449b609434a4a311881c9a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5839a2ba382e5244fa085c141835dd494
SHA1fb3d269a7308d873ef48c8ad76565b9d90ee4292
SHA256b5c2e542c6a62c73b657bf931b46e39955bb6b0221f0813d2efd5fb8c419d9c1
SHA512f10c389be3e15b0682075bfef9185f858cccdc5b5e33aefb6797bc8f6fdb29acb21f24b8cdf71ea90a1606b9a49fc95585984b37a3ad248e167eff00f77e8933
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f81fe48e143409ee900c1511bf9ebb1f
SHA1dab4942c5c68d68c124156cc3a5e3ee1a96f661f
SHA256ee17340fe03afe022732121f2749f4e81c9d00a91c6592e0724ad1f9091054f4
SHA512338b7da9fa619f36baab08a9f587d8dd20f7f69bdc6427cee9eaa3fde2a4c4335008404e7d5c410a3c828e7322d1479d74d5b40ed0e0ec0c87709aa9c9be0d7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f1089a5c073a7f461395e653915d1028
SHA136db9bd7128056b473e1e7dcb1ee0533a99d14f0
SHA25680071d3460cb90f6ea7a6e1a5b1a69a64b5164acf87270182111d109f427266a
SHA512e44d157b877668683c001ec7ca5278d1b852c012eda74f2428c0aef73321cfe238a68cb37845b1de7d4cf329caeee172a957ae1cbfe1abff31c2a1d65efb5958
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD531dfa2885b8b874a6a7096aa873745b8
SHA14eecc069fce568fbf4813e4c7e0b133974e0c9e0
SHA25641377ce9d7dc92c82b4b7ada3c2f9c7725eaaed58c9b7de6ebac8222b983f262
SHA512a3bc96526d68270b292fccb991ca5bbe0eaee537536251cdbde6c125e1d373bf9c4cf56a4ad82554a3d2982e076a58ecea405c793183127958250e41cdec2e17
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d87e992053db5944f7b9b38acef7b948
SHA1b4ed93cec2950cef164212fe13d5b3063a26b6b3
SHA25637490a5ed515326f0d5d2b16ddc1873243f03eb986075e4bf429b01734f4ce42
SHA512c7d73a436399cd65b82f68833fb4dc3bfc76944c77e9ae0064c124316415b18cffc9074476b30c6c90a04fe69cc9bf01a101221ac1dc942ab3abe6ddf2c3359d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d0b57c574e5bf3bcfd162e26c506d704
SHA17d80d9decf742ea2374ff60e4cdbe2e7b538aa02
SHA256eba816b0a3a7697aace29dacd23763df515e9b946be9c2c1d9b43dab8c387787
SHA512ba231ad5106614021b251960d9dec43f798b54c05a633d5b7d398976189c214c46bdc1691347ce7c81f4da17600ade3dd5a761e59fd8703c1aeff452e7898bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e9ad94afaef6f7bca33d1976c2a7593b
SHA10140983185f9f02d4bc5198d748c37725951c1e8
SHA256c187903329d59e1fa3310c787c99423084ca4e831b093f0cedb7c9e91b76fe5f
SHA512c758ba6c1b09c55b4366bc6e9eb28d0979bb8895b384bdd735247e4e8a4065e5e79c76fff17986dcec10745eb629eae1d687644c19518110abd503c42b946d4d
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b