Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/06/2024, 00:00
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240508-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
f4eabad512d89fcbec0864620dc4ef1f
-
SHA1
eea6186fc8f0c0d62ac35296f624ef854ee24a4c
-
SHA256
1f8691e8bd8f0246784bced50f0b11635a4de45493153ea2f2f0c52e06ae22a3
-
SHA512
8b3fa304d4e380b700b6dc6d09a79e4b6c225ef5f9ef1cb95eb01bd831cc52199ab11478e7255fa0fc210c18beb6dc9ce9ac477fa5308ad1f89a573103af00c7
-
SSDEEP
3072:SKWi9/mjPpmmyfkMY+BES09JXAnyrZalI+YQ:SKjdjsMYod+X3oI+YQ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9DC0DA11-2785-11EF-A140-5ABF6C2465D5} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "424225898" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2360 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2360 iexplore.exe 2360 iexplore.exe 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE 3056 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3056 2360 iexplore.exe 28 PID 2360 wrote to memory of 3056 2360 iexplore.exe 28 PID 2360 wrote to memory of 3056 2360 iexplore.exe 28 PID 2360 wrote to memory of 3056 2360 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2360 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
914B
MD5e4a68ac854ac5242460afd72481b2a44
SHA1df3c24f9bfd666761b268073fe06d1cc8d4f82a4
SHA256cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
SHA5125622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
Filesize252B
MD5874f0e7cf885a0d325694da99b8e36d0
SHA1e1e31c48c9b77bdb78351593f9f65e41b6e84440
SHA256d04977c81621c3cd125308938cd7f2ac9b9d241e1adc4f4b3e67745d8450175e
SHA51270caa2b00d1b2826738546243dc6390aa96028ffd5c0a609a7120b22b7a35486a3cb634afd38ae547bb5678f7364e01b986a5b4c5dfb6033c488884346e10eef
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b1bec1b36e22be4bb98ce01f902ad114
SHA107455b1e0126cf7f32f2439f37600d8249abf80f
SHA2567ccce90fd73bd686e44b24233277bbdd6a9b0eaa42561e0337d3d6eb722c1d09
SHA512b3ab42f309dcccf112d02da926f25f0768b3656d014c4e1d363f746a0c81a050478f1aca277e7baab32bf065d5a5b491838291d12b23be66585c7e5785f62906
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD540768c9c0e32741c8ba55b65f658fe7c
SHA133517a5a775fd2225a1439943d8ca7080f141e89
SHA25690ed8435cc956772e8b053af0e8d0f8172afcc0b7d0096ac5bde4bad84fa809b
SHA5125e53312535736f0a4e557eb5ad1b472dd6a753a2f965a0e1b6468e37c86cfe634c650b63345163c3d695989a100232e976abf5c3846ddff202fb9a34f599fcff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c4b99a31bb11649812665f3ab9a8f6b
SHA17442f152d92afac2e40298f00e3d5b850dbd0032
SHA25612e92cd951bb7510faab1517f1ce1b8cbe297869171fef5b502886bedab4887f
SHA512e34e8e579c9a0f4df022778367d1ced57861dcf04006eebe2b509cecb12855f855c8fbbc084c8d1cf4362dada61b2f9aae11fcf3e0877a47852b3cd7e4599bd9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e3fa1fdc8f17416cf4ae3602fc1d24ee
SHA1a6732b9708e4930a51085ef59c3abd6a4efcfd2f
SHA256d6aeff412bdc89d910ad27bd64524553967c2f9192c3c9e7153b6cfb6e22e0f9
SHA5128acd2da24edc138dc571cdb0f6573f7dfdb4ee96f29f8af501a9310653d736e7f6180d9c285c5b5aecf0ce9c0fdc05b41744418ec917c3c723282f8a11df7bfa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e84a6fab9b814507fb51d2c2a6476a5b
SHA1beeb3aac13d037c18e24bf6ed5f9d3edcd842c29
SHA256f8090691718df0564fde1bc96f39e96c9286c09ecdec2b819e3fdc0ccbbf1142
SHA512239dd6764dc2cf99b9f600690ba45b6f7f385cf2de4bf087a37c5d1d0e59323023ac29ed5aa4a085da2b61fbec44f594c216b15a30164b1d517b66803ad2d61a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD529b884d1d0ec126b35cbdb41acd4477d
SHA102df0de714f6971cc4a59548fa7ccc683fb4dcfb
SHA256a857be45451cda900602fe00457ed5abb93ea3dcbcefc2c70f82faf14349e4a9
SHA5128780bb57886f8db87acfbc46faa2dfc60da7f8d6ef17d1844621b2c51bc51c54f755146b13081c30d58bae802c3800d9ee02f98f95beafaa40f091d9e3ffc297
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59225137f74a95feed0cadb46ad1c6e39
SHA1dbe721ef650ed3712f04b217094ff96d06375fe2
SHA256bfbc0ea9bcfdbaa20fccd9a3ffcb0b0879ce2d745c705e7ed52bd12eb4fa0150
SHA51221cfa4819d32d5c835fc71a24c6a405d08acf6865f30fae66b27837fb0753d80eee52faa9bad14d291ccce956962e6359457384c1876bc5480e771639abfdaaf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD572c0787c4c28355e96ace14182dcd541
SHA11bb09cf5312053abe0605fce2bc463193956dd8d
SHA256d52d016d10fe58bf65a09a14761d986e2e380205f9720bf402be006c42b2cc7d
SHA512bb3e6d8e36bde2fef0eed4544aecb7f18861f1f014111fcb15dd9de67b9a14b81ec5f9d93f48f2832e3a2a552a0c89409f83388d8cdbe6c90bf7761a65bb545d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
Filesize242B
MD517ea8e5fe227e1a52ad8e3ac6530dc30
SHA16d910605179d6ec6826001f9cea2b6689ce8d6ce
SHA256a29fd2214f3ea7202d6c6515232b0d965172cbc11e1ef49991ef8926ef7b3c57
SHA512ea0667887904f65f8e5e2ab7adaf0888efd078bb3dfd2bb4b79ecec5e44e28aa5a6d026dc87ef173e53e8670c0650de6f1cb416e6976360245b2e741855831f1
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b