Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06/09/2024, 13:22
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
19KB
-
MD5
54e88b891cf2c631f409f6885f3c7786
-
SHA1
4431495eaeefe61cb050b0e53e8cc222ce4e32b2
-
SHA256
f2d23d431e0fcff74904c0f1af74994a2f94d0e51b597b9eef97f2883e058c0c
-
SHA512
9a9d1ea34bacc096646c601e75b1647bdb1030af8d09c1908bd2c968388970edc2837d553d0a85fe993a39827243d68072dc7f023cac1c99c5e2c8cff5740078
-
SSDEEP
384:3M3spa1ocy494lbGa8MvhpNogG4Kyn2MFV1EY04TolJftn1xCejiw:3m1ocy4uEaPJpNdGJyFTEY04TolxLxPF
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1899E941-6C53-11EF-9704-E62D5E492327} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431790833" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000001f90a615fd480fac7f50e1e807d323fc6e10cdcc45f1acf2307da54d3e026a9000000000e80000000020000200000007a2a0d81986d68d8cc0bf01302696334e9db8847bc2498965e95cdf3ed145fa4900000008ab5882a333db0b65136053c25ae87503e147559ed9b0e410e568f68085e9d8f973f2a99ea8525eea9f8f747418f8ed462a3daf68589be6d5ef422e7326d6e306f60a84f6b05636fb5e029412839498f64678e686bc6f61eaf98fd68ba55261c7cfc2aaf406200282181c06007a50c73e02f6ffcfaf66150d35454265c8e13fe4df80cfa9bb9f509136042dee03299794000000071880cded948c9a8cbd3eff289ed7e4121ad1f82de8b5ed739795259348a5c9034cba77aa264f4f9193103b49ab30aac8018ee3ce7bb28330e11e48347b67579 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000035eb3271bbbae129ffffa629e02d6e3c332acd1bc7e681f14ae34fa4fe0b0ff7000000000e8000000002000020000000dc63963142ef6eee54520635f214edd0ff23cca3e2650d24382fd700278e5489200000004b343b25550acef22e57ce9cb9f3b0feb3b2f28c0ddbacd446135ea613fb0813400000002afbdc3388199fa9e71268779c903ff27dff17bf27dd3550fa0ac62d14acad09af1936b4ced9a6440ebdc909f76b7f1cf40f9543411e86c77388d25cda5a317a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 203cbaed5f00db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1704 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1704 iexplore.exe 1704 iexplore.exe 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE 2956 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2956 1704 iexplore.exe 30 PID 1704 wrote to memory of 2956 1704 iexplore.exe 30 PID 1704 wrote to memory of 2956 1704 iexplore.exe 30 PID 1704 wrote to memory of 2956 1704 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1704 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2956
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f0851b340c251b25f28640f36602bf23
SHA1ece2c5fbded171c6d8a0121cd89f12d386301cb8
SHA256a1c619c394c71ad5bc14b0fdd38f31d8402b89f95be493f7a3aa7cc07f5480b5
SHA51270394dd2322320ea3fed3e008ef2e838cecd095b841e7d736e0cced68ab8ca9b786d2651a74a89a050a2c89b9f0b560f67c8b64a865f20381a7e361ff8563cf7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e7797c76c59ae5131adf14409d480289
SHA112ab033f0abca88a0d25c93036b8a8d42616d5d3
SHA2568eb0b7f53a01fb65472067989867a5b7977a92f76b5136d89918eb9b37863cfa
SHA512cd47f16057b69185639cb7b60e98167ca5e0ece39d33dff87728c271cf05c92333d481469bb9e909108e6c200d9ee7606866f65b14e60b30af165e6662d33d1a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f19d52b299a08abb34073dbfd1c765f8
SHA1ca0f6cee23547ecaa53ee9aa21a3195dca481514
SHA2568fa4f836efd51991581f687c92d1f4d557ffafd59255890448c52d8232040efe
SHA512ae26089ec95e54c5ab87841aeb579ad4876fe6c35731e325ae996962210091104ac8196d72c2460328b63b3f97cb448c9dfac5ac5b295a93ac1d868492fa3bfb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD541024cbebe864091c92ab64d7f82a498
SHA1345fb84e750588fd45b89a9dd414b3805bb9c4cd
SHA256bc1b72a3e10f77bf567a3af862677a2063b5fef0a2545f71ea01e3b4dd406de7
SHA51298d6989693e21a405a43649a56570641fc131a86534938893bedf6fa4a69310344027415b7defceaec114bf4042238ab3477ec9ea6b2cb3a7a32e2ea5278719e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a93e3a9fe7b87701fa91fabbd310bbda
SHA1bbab7a6d32b9bf9b5ce3870cdf13aa95b2645896
SHA25619d9d1a836a68e0b6c0ff4f2b56e3118b24842dee4cf290c86521d416c5162b4
SHA512842d7559cb1695d953fd55781a1eec66aded6ec5292669ec25075d6ea39c3decc253a500ebe9ebe791d41040a4c0c81ff4a0eac049cef6d595174fe2e6b392df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b6e12c52da872054efbc1aad2473f006
SHA140520fb5e3fae6101276aecb57fc0bae40e13042
SHA256d993e423e95d2832deedd3d2be793840b4f0ac73cbe39cf334bfe6dbe587eb4b
SHA5122976e373b4498d07a2ec75bd5fb19e05ae9e77b81ec7df4a2b3db040c27d66583883ca4ae3c1683cb606d08c9d34956741053bb9e024387bbc3205a620341be4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5364560c8f24651c9036bccab85e8cfe0
SHA133ce98d0c3b849b07062f1dda7138aae99c5f962
SHA25619fc164515339c1922e8475667fca3edbcdf9a8f2ebcc5bb9094d8031375d9f6
SHA5129e0fc42bbd48a272426d1f7947fe8017ff497334ae41511016eb65a5b5a757d7f71c6319996848a2a8e61d7dad65f11bdc95d5bfa56bab78c2f9808ea4ef535c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51a0c7f286fa9ee0e588f5707024723fc
SHA13d19d5a54afc9e9f18fe53e565551be1e4c0ee48
SHA256364e1ec99e18f7e06f2912f98bd281f7db0e4d7ea50f3689fa122ae0d1b16d80
SHA5127c707ed6b235e065fa48871690efbb1ecedca080c682f3d85a0370dcf27db2e8c7162693a597a344b153aa816eec174cda6a4c9c392ac4b581d775da55e45942
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD563769a1cedb75798d3754dbea67b35bb
SHA1c81e25ac5b65385767412008c91f26e7ae016bf9
SHA25615391e522f3ed0aa0840411df96cee8d2ffc0d25794e8abeb39ed0d2b5819f94
SHA512bfeeb8e0808e9d3125d91f46fe85b609ec37b2a41a18593047726d5f0850416cd8e8e04f5c83fff9539e13810cb86f256c29fdf837d3da9eb29713a96f867d08
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51c61fece1ab71f6c86cdc71b7c1d1acd
SHA1fe74ed42ab7913a6f13546f826c922619ffa9b52
SHA256e65aa1f27ad41462e60d6aade8936a6feaafd051ba0904be29daba4232707bdb
SHA51229235d515e01802021d5fe51f0c8345e585a727e0c694e3c5dd68287c16d4e0e42bee9ba530341e8e694aa8da7457b49469578c1b2e860f401167bd1014d3ec1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a32579011457372f987bb3af663cb59f
SHA187dc149911c1a33216d2c0d6adafd1539007a7d0
SHA256021800e095eb46abd439331bd0bd2683c7939152b34d3fd6b285e8034130bc00
SHA512f6fb2990d1b7315d2fc74747da3f13cec4d56cc73e38cac86ae6c26e5ce7e5a2dcec759585b98ed40c84b5d12a90852e620fbe737d62831a5934060618983bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD592908fb2b31450142a0715b4027bc1c9
SHA15e7b65b53c3e3da6153239f27003676345f065f6
SHA25668043d935be3989420d7758ee60f9bb85e8ce60061bb1dbe72c372d8c3fc633b
SHA512e115093e20291fccfe6c49791af1bca01e2a34496f7de133d4d122fcc6dc85e822d342ab535d04c69aa884b802aa877b138af88af5f1ee7d92d02585f5199d06
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5146f9f638921327601c22fc0b7d01e47
SHA1495554fc9d50f237ba437640ec6cf257f588777e
SHA256db181c06c9bdc8602e6380e1e65b28869c733bd2fed89e5ae3f4741a640e7270
SHA5124dddc66e5b125d0e164f8aae3395514066ea000ff7d81736dbc25969ecc40030d5ff21e0a14aa3ca6b030aacfe47f8cd4690ef62b53222345dd2cc5a38bc6928
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5aabe44c3ae523c3fff4943826261fa7d
SHA11337d6f2e756df3847d859ab8d356f83552e242c
SHA256ba48ff0bd60dd36a641bddcad79e83577bfdb5760bdb98dabc80b6a8852e81cc
SHA51297c8508c90d8876f6becb928cb9a56736617825dc97b0eda9af829e990adbb25d925fa9e1e2c9f4b169852ae202b305dbf1103325242193593e6828035409c73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59c3ba3515183bb3ec2647eb08c143a6e
SHA1a09ce18ea6fe27dadcbd21ae673315dd8b529177
SHA25632ba47781efd6fad6cb1d2f0ee50ddc467dff782717fc17d347f0213a4d38c7e
SHA512f05146b2d0b9ab594ff11a39415b2321dab055716c2289187c35a6fb985af52601a898968b02e323223590246faa84e813392284bb667688843b118df8b67bcc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5537faf04c9d56934d8ce67f553cf8472
SHA1412f9a033ec8480bf42233844ed832b4daf8423a
SHA25673235d8b6cd1ede8aa7de0cba90ca0c292d813235bf494764ed9f7cc29db4db6
SHA51259a05d46ff93e67f850d16685ed14a50ae2388395e96583fc5a4f9054ea4554f89d754f6b33577cedc7738302cce0585c470437d98ce27376eb507fdb9fbfd56
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58d61566128ac099d0befa7557e1b49ad
SHA1e489e9b30d803a726ced4982a27638373c9fca39
SHA2569f632ace85cb86e9bd96dc3d92b753517987d2e6c844ef765b80357a78d1594f
SHA51249c1143774abae7564b2199b53805483523598dfc6ae7a8e88c7c57e49d53d0b6ad43973602a0d9b2ef35009655fa226e6022ce151cf3236c85594d187fbd7c3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD58eea9491dd4d37256642cc6884018ca2
SHA1b3016e25ce8624ab1e636b51381057f5aa471614
SHA2562b0f6a8ec1f53adbac61b7620f239f363567b4abf5784e703fb10df4f6e1ac89
SHA512b32c665e29009ca391d641451bf950e75197b954297781da7f3dad1f735edb22638809d894d4195a44fcfffbcc2600bda48ed2565bb17e2a2a45aef7c8415fa0
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b