Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240708-it -
resource tags
arch:x64arch:x86image:win7-20240708-itlocale:it-itos:windows7-x64systemwindows -
submitted
21/08/2024, 15:27
Static task
static1
Behavioral task
behavioral1
Sample
download.html
Resource
win7-20240708-it
Behavioral task
behavioral2
Sample
download.html
Resource
win10v2004-20240802-it
General
-
Target
download.html
-
Size
117B
-
MD5
2dccf9a2e169c68dd4f3bd5ea163e45e
-
SHA1
4ddcf984285a5c544ed1132f5f6efd7a5d01b470
-
SHA256
ae138caf8767f7be2fe6f47f1663b0e2e28d903264707aa9b6f73bb7b223902c
-
SHA512
ba8e31094fda723fa66d589e229f240773f46493198b776240897e60998e7695c2865e17213fb3ed0e2756de8227c9271464ba64c5bc9448880d5f2a03cb4f57
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DAB6D711-5FD1-11EF-904F-761931736E87} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808447afdef3da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000cf12b1a0478da1abe3448a61340eab8f61a361068a23eae8e0b6817aea2a6f23000000000e8000000002000020000000e0d456bf3bbe74366bc94b5f6324c09d877e2c67958f5447cc04927b6bfbf82320000000f39721ffe44355ebbea677d61522f2d67f7bc9c9231662d3f65aac431e5891be4000000042679ef415ca873297445ab10786e1f819bc3a8a3bb0370930a6c017398769a93417c10544b9c7fd668a400672befa9a4d86c9ffa5cb0034a76644fa7db45e77 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430415906" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000118eaa625a7188fb4072e4f95289e92314481599f0bab75f76adbd82ef37ac15000000000e80000000020000200000009a485b49082bf7b5dc42716f27ead1d36a6de0dfceb369689f9d135e5087d563900000003c98be024331d44938b8d7359b4192f85f2737adcddb0fc7b43c4830d01bbdfee760450b9b4c561a8b9af7879ac08415e8e57a5c6e340b31ed08c4f591037142f46ffaad1e3de84c54239ae0fb35dc83be9db3ca02ecbf498fe05568a16eb2ffa914ca8291536739c54a513bccea61428c5f31137c93d88faf8459abb17240a56e617d953876d48fade3e0924d4ce096400000000540be21426ec0e192c4b26a4b6ede2445d4a33cc65ef0d392b528dd9d3fe160aabebe98531173ab03b4e251c6b077c5f7726da6854dc329c97e3c9ab12795d8 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1364 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1364 iexplore.exe 1364 iexplore.exe 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE 2320 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1364 wrote to memory of 2320 1364 iexplore.exe 30 PID 1364 wrote to memory of 2320 1364 iexplore.exe 30 PID 1364 wrote to memory of 2320 1364 iexplore.exe 30 PID 1364 wrote to memory of 2320 1364 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\download.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1364 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2320
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f873e1050c9585a36ae7c17ec0193e0
SHA198d6546746d138cd687e1f1f22502a90446bfa45
SHA256bfd7668cb9e1a3341828fc2258e4150e1b9230ba21cd6885deb444e22f3bc2a7
SHA512f0c637183d39536786c3a43e9c0ccfbc00fab4cae7258112fd8adb5c0b925614bdfb59f28a98e391b5d0acb7363348c6a0f054fab3fb727c60a85d6f2e5ecdb7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a7dd8e8479377bc9b053a73dca711895
SHA16569768ce31e4ae3a023e4a0c3bf7eebd5c6fca1
SHA25631e8caa640dbaba82fed56e571b19679850e6d4203ebf374f77dbdb9066641aa
SHA512a67f9daf62b23f938c233210e481ca631b21504cd80003d08468bdc1e3b95025bb930c5f71359d98d84f59e2884a3acb868b21fa0a36dd6b18718adfb616d53c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6e6c01bb7fafe925ae116d97920b80a
SHA153e5cfe774353bd8185b5798b2e9e1782dfa636c
SHA2567af77ae85d4e2d38d97b7d4a200f026437c206a367f2faeead9df64b36be859b
SHA51217d6af623474c9af003923c77f01165e6d4264b5a193edf5edd42e07365e40bf6eeb3c27dfb0c687b3bbc1256fe71763f23fec33af83ac7f6628484025a5f4cd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD525658dabe0fde052ec72dcf960948a92
SHA1e7ed7de3d3d14129cad379cf814ee7d0784fb046
SHA256555af7e21fd15fe7851436439a3312c5d119f869a9ec40ffc22905e2ec844496
SHA512a2188ca049ad6edaf6c769830cd46b510d1a747b43ef39b938db555d240c693354aaa5567a61f94feb4dc8b402985d75e6e928fc278a75b4671ef23518333926
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD580d8638a38a9344d9f68693c150b8028
SHA12fc020c6f6b2e314bbf0f9fbfc1af904ae56dfe4
SHA25683d73a1601dd680b245e9de08f8aad09a894fb4ef49b2f8003492aa224b4a595
SHA5122926a88f156112dd97051154ad95b915dea28e1ca50d68eebdc3275a37680a3b6f6154ca11606016f9418d5b76a20ecddc6dcab5d11b55abcb9f6d6671ff9f1c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD594de3be12cfd33b7fedd24119c28fb8d
SHA148f86a56dd3d7f77aa55451f1c757ec9296c316a
SHA25618dd87ed91faeaa4fd93ec11a09f14fc3bb290c6a18e04746e821324937d1ef9
SHA512675fedb471f77dbfc25197bc988b1fd0e66d5548e82d7de9635b532dfb096021611a5819d7ad46e5fe1e9bb01bcd239652a71120e864e17f343d0af822460691
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD503e78ed138e8c529ad569a4d6aa51021
SHA19480653a5bf5ab40a72fa4a690346154a2587661
SHA2568d792b5fe0be6ef744828602a68f1889a68b97ae99f5c7ba7a7c5e88df0ce2da
SHA5122327854c86822db3b8e0f28450be413455a5823e8c1a478a8fa4c7de289623ab8bd285ddedc6f5e74115d3a0f5f112c0f9c25f851399750a431c938c206d0812
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53f0d51e3f736e520e38701f327d4b12b
SHA170b208078779ad4460e73c3ac35877914c48b1e2
SHA25605539370ddabc37a6aa0f255c62cfdd98fa74b1e9492c8ebabbf026c2634f4d5
SHA51204075fc5ec360b3cea83a57adaf9053d9f9ebc11920ca3f43ddc089bb2f1a25c942df010661eb201c8b9f515dfafac30360efc5e91c75563f33ee2adb4bb1108
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d338fecb12828996afa093ae4246195
SHA1ea0dca5af289e24e9dc96fa85df092fd3eb03961
SHA2568227648a9b1deadd41900a33b4efd7ca859b5c912ed8d3a92a2a0a44e09c3c81
SHA5123a0f55e840ac12ce33a1532a39acdfc5cdb6289ac8e5b115cd290175cdec82f8462f390985cc0604c3828412053e8d8526d465c345c0fc8ed1e7d1c082920693
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5030180a914a058dbf560110427c32e0b
SHA1178a0e3e965a5036649343c0ea85b9373a49e361
SHA256020c2d6dfffa831cf3ede616feecd8c2ab8a215459928598807c87b0e96aa21c
SHA512f50d1369a265cb96a6caa56b82dd70c71d8220a4dca6643f412c956748c6d3d11fc513ab4b1e7b8d0d79e9ea5fc9cb3fca317b7000305a6d643ed8c2842f521e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c3be8ddeefea5999670fb613c2c1ca88
SHA1c1338e3bac81f3cd2c0481a91eefae5e3c4d8e84
SHA256a43a97bc4b9e6155b3cf9eb2d860d7bd1da2cab99eb2b576827e3e2a9562c6fe
SHA512fc92306028f3482898255b802665c30d95297f8193e2be6d8368e660ce7fc8f3de221ca9d830921cb6cc722a928452cedc7363f207c5e0c8c8f09ab672fea589
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56b8ee2de3aa7ee91a1e4d6d03dbbaca7
SHA1200a8b5481bf039fb535942433e4fdcdd629712c
SHA256870fffe40f061919f9922894b7d8e8044d8a1d82c5c06affb57a144d6622f710
SHA51217846cab9d4f34858183e5725b4eb3124a8c59f1d2bc1fa1ff55fd843840422a7e02709edff46661547aa932ae80ea051f9c312cc70bccfce46246aa76597772
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563b144747e1be0c8df9025da9ba4ed3a
SHA16e0fd0b1f18bfc0533755d1e9f3e81442fd4051c
SHA25620337fe6389177022c067b3dd5eb003dd328e7d1fa98ac698f735c7242d7cf9d
SHA5124de694e4d1ad052510120aba577de01bf7fcf654949bfe9ae697b8fa01934cf51d1f19e1a41c66654d97a09ebbe6bb7159f86ddb5ad355aa06fb3a2f32398776
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55443c15b3dd3d919b7f254f2c3130453
SHA147a0f3bd701316a3823cacf0115bede231864e6e
SHA25642a6f274e3af6421387aabfd97bdc662559fa59a05e2193e20b1b9401cd047b1
SHA512b7e9dd942999de0e9b25d8dcde4605c9ae91ed9371112165a54ea0884ac2ba8e137ec6a98b829bf7633ad22e47c370f8c0140dc05670fe25eba6bd01414c2079
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56345da945c5994959a013f73a2afab16
SHA17111c05f6e4fa8371adc19014931b1ea9ffeb826
SHA256c16b73cace7e9ee25929b0a3a5d2861e5b01ccce47a1d7f5b1eb87f2c1be8d08
SHA5127e7de240e9e4a8560410423c6ce318e4f5e8702bcd0df2127e392849a50e4a3fcd3b2e1f0f31f16ea76220005e0eeeef3d8d09c32b2fa3bbc1ae379356d449e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD526a46c287cd4a295c403d6837e8e007b
SHA1a872d60c3d264aaadf2254bd101dd34871e0ac99
SHA25610d017714c91d7efed8c10921af02e8db1f94d6bb56bd25199551d3e5d69a31f
SHA51215b45c6b9363f9baf40f938bd385ef4841fb37113013502a1ca8189d5c9a06244f7ff219d646e8b311adce353deb0fa050440611f08e2463f8ef31f976bbb4ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55c6e9c49574d1fd5edf51b4edeb36d77
SHA137a3dd20a768cbe9415a2a111e937d3c53e67f61
SHA256b06fb5c7c3728e02e97fbd3c5617725cf8482c513f0b3ff013d57230ed2a601e
SHA512df468c88daa0740a3fc8d3ccc5f528524be5382c6aaae457ad1110357fefa4aced10be78157cdf035736b89e38540c65a8c35906149819ed571ff3ed51d6f239
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5ca7c0dcf092c978a6e47a3f0951f5f61
SHA147dbc94b5bb3eb1ba85333b3085887b64384fa9d
SHA256b729c789288747f44e5fd6f4349ee2f64cd0261dae77839197684023722f517c
SHA512a1fa5fdb602fe2b9281c4c1b744e4419dea71387421c6cf11daf5d3428d36e411c8e36843914decf1fdb88130686d67a2c2fb90d4d8b74740a515020c957207e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5080cc837382aa5cfb693e602ce84f617
SHA19805be2f9d714272aaeedf76642100218fa5bc8f
SHA256d33efafaf30b8982ab61da883b6776707a38c0cc97b2404f33d41a99b8548aa8
SHA512a8833b77978e9342ab1e430c9daf7f1e757ba643d7167f98e934e0551e7031ae49bc08d6715017e97601fc1fd63eebbe23d9f79c646993989c85b496657d68af
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b