Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 12:24
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
40KB
-
MD5
8c735e1be55f3bc3dfdd25021eb7eb61
-
SHA1
b862cdbf929bb9aab035a84abaff94970b9e7a3a
-
SHA256
6b494ee9fd9e9a715ca601b8147daf9963bd2b2ee1e4e0a5043f9f6c944fb8dd
-
SHA512
c6aca4cbb550b687c60076894441e308a36ef8dda2d2f44672fe6da62d1c5d2075bb15994cfffff593a89a4dff36554368a4000d80e2f830ddfafe240b0b9a4d
-
SSDEEP
768:SRmh0OBgpxK8t8VGw7tBc3Z8vfoc+i++mJLJ+BiEWLBv+Ki8QrTj+RookBTGo+Yd:SRmSFxK8CVGwpBc3Z8vfoc+i++mJLJ+N
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432046568" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000af6f90a67787b925db786883d9592bcbcd7c6b8ef567f5359c00f44320f378e0000000000e8000000002000020000000188b9d9594ee2ca0cd3b6dc20631a14c1e2b5eaceb8a5dcba5ed2c9faea238d020000000bd53fe41c0b63a6f9a6a5bf73f0d820f8599397f01832a82d80680a5254204bb40000000968635d61f9f246d52b2649b3185343888d643b30168dcdb75af3d870024c8c8e14aa6deb60867b774185306bd92a1c6e3678909cc06913a49338e2b27f7911a iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b47b97b302db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000078b316b6741ceec49abd3f2a94ee666d9349f8a8c5de5beaea90a04d218b45a5000000000e80000000020000200000001973f38d1ff713a0cdeed350387f0cec5380419248b940370996f023e8a5b27f90000000e9034dea0c6961929adaa65fc4cb6ccd562e5ce6f4760a7f8ca142be9de7c1954ad7529f950f02950598ce813bc227143578dc6296360ed26e5d93293af6fae3409146a5d1af64326ecda64f1be3586c80c03b236ea537622c54382edfb928316fc3082f1365c7a8f19533b20760179f497d59bf76bb7f1dcd6b7b8798662c72c626d75f7524a8f5bc9e792aa9426a4b4000000066fec830dbf0179799dd2eaa468d351fd427e82999841bbb4ce14e5f29f8bd7fbb0ef749be26a3a900a4735bb91edd43a2c189949794155d89f7672f1066a4af iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{812C2861-6EA6-11EF-9747-6AA0EDE5A32F} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1912 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1912 iexplore.exe 1912 iexplore.exe 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE 3016 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1912 wrote to memory of 3016 1912 iexplore.exe 30 PID 1912 wrote to memory of 3016 1912 iexplore.exe 30 PID 1912 wrote to memory of 3016 1912 iexplore.exe 30 PID 1912 wrote to memory of 3016 1912 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53629353dd729dfa631c62c4c63f6707e
SHA1c18553a4e2250e622f7d13b74cb4ca6791b129f2
SHA2562d2b92845edb2cc8851d27e86ec514fac74283901c8c878f4a2dae2b3be2ec9c
SHA51245fcc9a1d0dcd96e91a628eb50d521c5f90f6567bfd0ad9644363bfedda2a09dfcc667be11a0276ae5f45b08f9ec0ad922e41154337782054f0bd8334ba073ca
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5719bcf135928483a4be96f26be9496d0
SHA1ca60e140530d71c34666e5adb583cd510ff91318
SHA256a0dc3c55f603b639e7030af7a149028827fc52fa8761f2ec2e14826fa58ce9b9
SHA512e07a4af03f8d8b5cfef2f758b07be9c5e9989d90e4772b47796515ef1d78d81e130eda693bae142cbf9cb3028df3f63fe71fc40f0c63603e7028379a99030002
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55f20793acdff6db83f330ca5e9ff10de
SHA1a17789ac453ea0b9852387943fab4d9852a79395
SHA2563d852287be6b37b9b0201b664974f06465cab9d8db07e2d5df4bc0da864b9985
SHA512a8b570eb69a9733dea4e2244f1592db27aaec63a38e9fbf3b88cd9134fafa4a12478736b7adb8ad0075113dca218d7b23f5e8fc7eaec819ba70836692fb0b1d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c2de8a2bbabef9701414f651e096c1e0
SHA12ce75672df122f003e10c0d215d6093b78960a0b
SHA25615cdfc38d73a6c3e430276bc0e4b1b4f21dba693d443684bb03509512176fbdd
SHA51276bac25761e1e4b9313f2b253a7317ea178f2cddf32787c0b21435a107346071f152b0e9777a967702d95c240158ae6181883912ad977035e16f64856d8dfd73
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b5e53f126b99c0e5f3870e7b1fa404bc
SHA1f3b6eae78507b608936747d01838aa8e9c77a534
SHA2563b106dc56f31226342261f01f5588effcafd9a7b10596926e499b60932b73dad
SHA512a6a65495c1876c3f0282ce89bfe081347d52516a355e78b5d51003af9274cee699cb4c3704956dd7feae8e56e65a584924e89666cfbfea58e91e1a82d7cd172a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f4918b7450fa8add16bad72319f307b4
SHA10b52e0da8e0cfc55ec25b7022920ad56732fb40e
SHA25638e831235ae066d2067a93d94fd9e5ef7e76067a0e09b0e07c905a54f78d2d0d
SHA512890396fd0b429b87db971ac8f20f251983cea49b1b0194b1321b12220556f6b13774aa79b8ea5c28c4a64de4fa5a37d52db3b67f1bf3ea3f5278276b2e178b3f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523bb4538673174de02967d638e637f68
SHA1f9ae446a919b3ba70bc8f61fe4d63d5d64c68d19
SHA2568714e87c47ae4cf50803e6e2f9896c395c5b95c17cd7c77de6d0fbf20533676a
SHA512c00e492290e1529d8a399449f9a3fc82aac04e804b9aab4b564b081ca3597dcc58f181f91a3ef3b6052606ba7fd0426de1341b586b3123ad721c7a512a6ca542
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5da57013c2f803618604c6f89a1603102
SHA174f5a187114acab6212215bf87f6b3e5f15a8db0
SHA2567024a826c7b0bef63f655bd7188f1595c9dcbf5a46ca2fabef65d6e4bf51155a
SHA5127d60f537b324a981adeaeb52ac340f92840e0afe0b021b897973f37a13fafcb0c1e962aa647e8f0d315ea8973ec75967493b1ee56088d55369f960fd679a78ac
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD523de4cd7988b29637d02e447f7c62ef8
SHA1386d515f416808d76309110363f6ccb77b54ed17
SHA25627943a76452f2d20fba0ed81a119d037d64cb7a2ad8c836768f86d5febe668dc
SHA512b0b59acb6914cf82f3a3cbd1b4de0019f512bc68b11739b149e810db640234e8cfdba37b9edb22f01c16b6576c8d914c26b74aaf33b4e5b16ae59bb44411ca68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f5c7edbade53ea10a85fa674a5c6ba7b
SHA11e3a6453e8279a87ad468179823fdb6dee18c8c7
SHA2566b514eef78edbcaa4bb4a2a2ac0be3090547f3570ccdd3d6ebdf180cac41e0f3
SHA5128c96ae8c9ded477a74d9f3c13e5d08bec3562224ea7825b389ee9c1532adf8b17363416ff7a6adbd57e46ed06be7aac8192ede33fb2cbcf8192d398ec5349746
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bb7f24da34255c4717cced456c39b272
SHA1aa2c631c5261eb7f7822d2d6e33d225123ce1f16
SHA25606be85d5b69d6e212c6c46547582bc3c49fae309e0d0f528f530d99e39313ce8
SHA512ff3c1934b5fa73e93a489ee10bb51d2fee3371f77be3a5e5d5dd2bb49757159c918ef5f24cd550af61e41ca94c8be114fd7d605ae1435cb5b92890229b06ef15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59b2c6ce511b6067f98988febdd5c8f8d
SHA16e18a018542dec0a6fadd90976a71310976d9b76
SHA25660da92380d8b8ead2b6719b9ece71193119e5769b1d39c0207510b756d8da655
SHA51270716bf883c6a3b50a8c49c44ca63aeefb3bb568ddd18cb4d31127956f46c56549333014464047d213a61ab02179eae3adc3ae0d576caa31a0e6022027f8502f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52ce9e39498ae2b93641cc63de9278c80
SHA15c94ac492649e6d364fdda40e8db0787a87bcaf5
SHA25639021fb892a4b7fff11fec29905d4675c206a443efdca8cba797c660695a5983
SHA512c7d882239e1b29f01583f95595ce5c831241e721b49fa8cc76492afa7846985b893dd61720b757b655112d7a77aea4a6b851aa1911b38740231c1e9645b49dbb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD51b448befbea980e2ef5c824927172fc7
SHA144ef05c625cda31d05d0fcabb8fc3ffa047859d2
SHA256aa5041bb563630e8174c0dec4991fcbca5f5476b54988f5b82d9fcac479fba42
SHA51214db23b3c9329201fe4f7bfb4a89a432998ef051f0854d428b5e88d6398b90a19a08b1e3b600c13a2be97fd0d4ac9801510b0c60ff123e7502c528fed70e568b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD598342908524a8a915c066a169b4eb3b5
SHA1bac6f1a3be1a7e94216f0175ec1c55fab2cf37e9
SHA2565835662fbb376e0f4d63458ab81bf36a0bb972dd4934c3b1d3018c4cf2167b2e
SHA51295848219f81d3b6d6e1fb36b230a1d6eb3f57db9700dd86ff713919d319984e96a43aab3e942aad9f2b7791e12041c632a2a1a9184487362973ecc7b25a3cfcc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b