Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13/09/2024, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20240802-en
General
-
Target
sample.html
-
Size
213KB
-
MD5
5d3a1fd216a6bee6f949e10ce3d18ce6
-
SHA1
739bddc34f2fe0aea210e441c8cdd7f27d8d8a0f
-
SHA256
60c075be1ff9db22fdf893344ab6dda9ce2f86afc605c55dad1229761afa27ff
-
SHA512
284ad2c695d8b7fd3f704a0973a2fafc84130cd7e291cb4430fbf1b19fe2b258e7ffd8c498c81a17ec44c2680bd17b8f03b300d3e00263a8e5517ee308e818bc
-
SSDEEP
3072:SUR0t2pzzlQyfkMY+BES09JXAnyrZalI+YQ:SUVbNsMYod+X3oI+YQ
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{731851A1-7215-11EF-8287-5EE01BAFE073} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432424060" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2376 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2376 iexplore.exe 2376 iexplore.exe 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE 2336 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2376 wrote to memory of 2336 2376 iexplore.exe 31 PID 2376 wrote to memory of 2336 2376 iexplore.exe 31 PID 2376 wrote to memory of 2336 2376 iexplore.exe 31 PID 2376 wrote to memory of 2336 2376 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2376 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2336
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52f092ea45bb0361005481192d24890d9
SHA1b5a8bf53c9f6a0a2b68b519ebb457a73f0cbbfd2
SHA25677692a0cc9950ecc14eb985075383abb660e693a53ab1b92f13587b4ada24b92
SHA5127cba009fdea9691080787a37301d78ab3090c64e02f4326d31e383dc3aa9efcce0018cb56e7b70bc123ab9936309e7412de41ae9c6b2bd2b9671a04b4b2dd2ee
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b26d7a711499441a7d6a7edf6b1010bd
SHA184e2126fede0e9c0c1b0cd849433bc6484b203b9
SHA256fa229bae72408c77257a656700f8c3d30d741586b979fc27178ddf279aa0e5c6
SHA5128bc81d138903adf2d08e0df3a0f7817814ab4aea25ec2920cae5f15f26651ecb8ce6d0df9b6153e2d4fb838d536a7ea5b9e3572e391a50ccf6dfe5c9136401f1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD56cb7a241436e389a3882a3da0d93d6db
SHA17e236c9edd036f9498cd126acb4670b0e01c81fa
SHA25616fad99f377d5ffc99ffd8f1abeb6aa9663625693ae00212bc05298a38d5f3df
SHA5120bcc1afb4ea69dc4eb2808cdaa26d8be30ee224e29bed5a5c9286324c976a0224e2434ed98596c6c28ebeb54be5b9d794f2c97012b38f371bc60a16c6465a76a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55a069434eeb511932012fd953fab6e38
SHA12085380f76316c504447a4eebaff306dd4bb954f
SHA256ff76dbeb734e57da9c1c51edccc5805b3f36b30eca551fa9e1f6d87ed669f2a5
SHA51211bbaef0955d93feccacac89c84d39a5c25987f92aa15ef7e338bfff9111871fce6afb7cae41365bcda81b300d84b0f67355c45a4be44981ca6459f7be474c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD514a391c73acb7c3cbc1d43c3686ef0c2
SHA17c34972a23dca9bd38681f06bf94f5f886aec41e
SHA25681c88a315eb8506b97d15d33fa27cd20dd354c9ea9d5eccc15c7ed6dd9098844
SHA512f963212ee6b8e13e6b310f2e8353afca7e1a96de422646345ee2bbdcd429bf711d13435384b06eb937887654443caec685608aee4a5a835e18b4d563377ca82b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD588ea40b10813f54c3218794ad4f85e2b
SHA1083e6174406afc5ab31ff96f5ae3d597f38145fe
SHA25622e7dbd5661397192d6367bb37ef8adecf6c2f9c61a82372edc53cbbf7522254
SHA51245c550b1f97b37968d3dd7933a48fbc62571ec427614cc2927c4220a85b4221c1a13656fbe707e86704d6cc843cea7b3c1d438d559d399b1c26160344d585c72
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5b3fcb53c2d913da53609cc0478e6a9c2
SHA1518b877961ee3f029cde1d13ce63d5e5a580c9c8
SHA25683d6a347c7b1ebbd9a2b2079fff3e120eb9762389c82976685a9fb4de634b3e2
SHA512d120331e5dc29528ccc5efa5e43ef86ec380d9280a296bc33e0fe19b65065037f904cb5cf4c66d9c19ffe1ebbab38b14280d31da59d6a279e2002bfeb5c434ed
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d6f2cb41860f3c270a0a73e706bdfa3e
SHA120793e20994fb6b44b2eea30c0aa6e4afeb77998
SHA256eee99126065830aa36a08adaec3589770ff7719696dbec9a8b301625bd2a5bf7
SHA5120f103ce4811cf30386ffd6298401c615c1bf13a3f426ccbd62d8c230414e1cc7060c59d6ec83d190e5f553a469aaf759bb9d262e1f9717142f8d4d634dd9d871
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a07bbf091427d26bfc9ae2cb5191a995
SHA185cad72f7348d423f002f42e99ca5bb3095b0086
SHA256b98c6d2bccd6e992f604d256800b6aa2f7365655dd455ed8f3e22a07d1c22069
SHA512bfad27d70846f853fef520c9ed47d39e71d1bc1635fbfd776453175d9d315d05901acb3c372dfb0ffc71f00f4f15b9433c9c5c68c159d77083c8791245309567
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD508129b17ee82bedd93dfe636475068d2
SHA1cd208ef1c06b4e4edc7dfe3d63f73aee0ccc56aa
SHA2565fd50a7aaed2c9d01f0ce7feb9a9c24a48380936baab1fbbabdb16915d38fd0a
SHA512070f21154db063c26753692b062453c9bdf33139d6c2072def7206b0c7087d9e9962a9fd224666f9932e447befc44cdc9135b3f35ace1d3fb6b9c9b069fecbd3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD552456bb4cbb9cafc59fc376c20b5fe57
SHA1a1c23b5f3a4392d499d9fcdb44d95fcd294b19b5
SHA256927640e518d4db54c20da41659803952db4549629d60552ada1af598292b7c3e
SHA5128015c8cf655f03c21c6e6d7b60f361dec7b31e618f89276358b6689a37a1cf1d3b17557a28e8af91d5c864c990cfeee05f4612e10bca4d0f69db3b2dcac0e1bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD533c1d3d34713141cd486e7038c508be6
SHA19aae9fd7c3495b20defcfc5fd89f308c29dd6355
SHA256d3c3b15dd7706b28f23ed21332f186c06dcac2ac1e961dff38a1452653c27344
SHA512ddd5ed8def64d80c27627e8ace2fac548976014f9985e82356de395c8a6f33da8fac5ea79b48fe66108e7ee246ec0d72cc2b5a0ff3eb6a7287c4bbaf592ae385
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f2b3e6c2eee9917255bc5fdd86857c4a
SHA1e0be0bdee6a0eb6fe6cdd2c01e1b9b92d150e604
SHA256d7a9bf9cecd01950c2f99dd840d12bdd2505572ff36b87c0c0575b387d9304a7
SHA51230fd83147f1b32b6dbedf5fb49d863b077bb1ed37c5a254e29cb3f0b6002a81675c8e535a15f02fecf77e2e0544f7246e4a575b3c24db31de931aea24be04dc6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55925a58d73d8bbe57f6883ce86d519e1
SHA196484363a56579480fa27e6ebc834e226f4715e1
SHA256eb2c43be2bd8822f5dfe42254afb555e8d5ee967070b0bec721dd95a441cccf7
SHA51226f4737abee481ab04805c508b2c5fe11f16faf22dfa9e38b35af7fe93ab9155f19b2f70d6483373f79c2979eae52f0e6037c257e41c5e570eec65be0528e8e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5879e9473d0e89f24178015b8fd1a0f80
SHA1f107f0a8d3780f5f1da83b4536902f80be682800
SHA256e72314c2c469bd89d9547196837985d3c371f5c388cef3db0d6b090f58b207fc
SHA512fb297db940304864809d0d29e254cf8d0f595ab8f93450c1c6e0309ba008ae64ffc87e598ca9cc902d711fe6e0517fc23c4eb281c29376735f910a2c6ece6440
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d1621f7c69e4dcd9ee3f35bfa47b5223
SHA158e9269c6df9989775fdff81415dd9b034ff0574
SHA2565e5c5dd277f459de160581053f125b2735c531519b454a2a9cd9a96169131692
SHA51297ba21f73e4dd94e2dc5377863118b3d58f30c885f3c59e428894c39eab233353372d6a5198d4ef975578bedc8996a248f3fd21859472b466731e6adee101cb5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD53add54125f661088bdd3cad7a21c34fc
SHA17e41d7fedf7fc45603b8386b51ec39b09551172a
SHA2560dc23e84076142537e6a82acc102c80adf2828bc72b9909e8deded88bcb1e312
SHA512d7a10b026d0196c77557b73e64096c47311a697c1a89994970bdb5890910330f39191c4047e582d6295a934dae8cb61e4c62565bed57b71420fad4dd2e43d711
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52710a26050e8e3a56112e3be4c30d33d
SHA1d06396da46a075d70c1353bd080f224f4ece5f8a
SHA2560f4aed766f9ef19dd2095c692894f9cdaa5eeb65ea2fbf5738bd8e25bae57727
SHA512c12556e9cde791bd2e0abd6e4aea31734c0d6bd2519d9d673f0e6b616f4c4a3c9d1efb6d0c21c34a40487dffedca729bf609b0ddcd3aa7f50c0c4b95a6b841e1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52929138592c1bad10c1dd8021db73547
SHA187a4fccfbe9e59ecf36e3d888cc0edcec076a630
SHA256089cb4b257b06f0f67bc67012bda6decc504ca2b0286236f0f44876da597ac50
SHA512f199b97ef9c884b97683962e05c90ea7b518d71a53f81162556eae4fcced6e8a26922d0ef47d9b5d608c74ac311675b325842a92b469222f93747bb3e7af4c1d
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b