Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
15/01/2025, 14:49
Static task
static1
Behavioral task
behavioral1
Sample
eW91LmFyZUBpZGlvdC5jb20=.html
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
eW91LmFyZUBpZGlvdC5jb20=.html
Resource
win10v2004-20241007-en
General
-
Target
eW91LmFyZUBpZGlvdC5jb20=.html
-
Size
315B
-
MD5
a34ac19f4afae63adc5d2f7bc970c07f
-
SHA1
a82190fc530c265aa40a045c21770d967f4767b8
-
SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
-
SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E372E691-D34F-11EF-BFBC-7694D31B45CA} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004d6f241e2fc7c74f841c1b68a55899e50000000002000000000010660000000100002000000020eab03872f6f867fc27b8e32324ccc95ec4c2bb5118d1f153170783b949e08d000000000e800000000200002000000086b85e260aaa46d5a1f1b9c87f43b7ba5362c1629d6e901c5fc0d311984e418e900000007ae53002fad3237a9041a32d6e257790e1b2eae8d02181a84e3284d000e7ae203e93e342cb8d16d425aff009e2eca8fccf3d64f25ed861a7a36a62f026b60cbee2fa8ce9086edcf1f981be00dd9b3ff352c99c7d0feff04caeb8fe7a9abd66238314bafef569b2a404b00dd6846f62e713e49e0380cfa4fe487f18f73d76df30c9a2a471882380ec3bf74fa9bff9634340000000fb1187dddf61ad96daf2aaf825d26cd165c7841d84098f4a9fec4a4532d11c8c112a7ae8235fc70d71ea8bb897f3dfba2be9b88bcee476aa93f3d9d3f322d592 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b07ee6b75c67db01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004d6f241e2fc7c74f841c1b68a55899e50000000002000000000010660000000100002000000031ec1eae443c5f583f9028293401c4978fcebed3b586045dcc2639c8f25693d6000000000e800000000200002000000054dd251074f0a300f900afaf21604d84ef9cdfd087152e748d52423ffcdbc1ee200000007579436ec20c33404c97ff0e0ce07b8e21fe68505f3928cb53bda6173edaae5c40000000b44c23f7ee6480d1d3d8b95ad27721dda70ea3eef8528decc3309e58466886116197f35643da8ce3129ec44da3ee8d00768aacc3de6ac3492462883de99ff2f2 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "443114425" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2816 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2816 iexplore.exe 2816 iexplore.exe 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE 2800 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2800 2816 iexplore.exe 30 PID 2816 wrote to memory of 2800 2816 iexplore.exe 30 PID 2816 wrote to memory of 2800 2816 iexplore.exe 30 PID 2816 wrote to memory of 2800 2816 iexplore.exe 30
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\eW91LmFyZUBpZGlvdC5jb20=.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2816 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d16523927f018fdae120667dea691cfd
SHA139e5aa6659685a9b6f2a301b963e09a63bf1c706
SHA25688587342bd588117169d42971ff009237296436fe7557aa627388279450abefa
SHA5121f12f36f215445c10d37273c02444134efd4227b95ac3bad53dd485d5dd420d1078ab3b716286e61664047070fd43eaa76661d10b1e52ab419887161d5b2c68e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5d326dc89fe2d72b3665fcaa3a393e4f7
SHA1303175d407117315623a451076904393cde376a1
SHA256b7e59e95d79d3b7825cc4790ebe87aaed1aecd0f737b071baa657be03cbc9012
SHA512023492cef4f25cd10092cc318ed469cdf57ddf91034f0e0a8745f82f788ea2b396b00b16a6b76a6e77d3ac14315c3d04147c4d5f13402269b0883fe5d27b520a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54cacd97cab74409ebe4b57fb342faff3
SHA12d6c9684a322ebe6b76dcb40ec2769e97f0e6125
SHA2565d06f8fdd403c13ae174c259b0d8d0b824d4cd376e84b3f3b587181a8caf59e6
SHA5129f6ccc3702c0134897d40e79b5529737bc42975a98db57350471ed263e21d2e3325fcf3c4e4e4d5b55e1ecf8c5dac405252c05c5b44f3d654bc98a29f38bd3a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54dfef14dea9c6b36175d04074586b521
SHA12bbaf0b7a49b3a951851e6cae310727cc668691b
SHA256f7d0975ddb6eefd3d08a6ad4e3d2c08393e9726bc4407d2b7b3cae6f12355a0d
SHA5121d6f1b31a0aa8ef31d371d0e0a0c0472b4d89eda05022c01ec49f98f0e2159c2b595adefd71148ce4b772d40b92440306a6744620a8c2c4f0b6237b18cb55916
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5a814830f8a7c1492bcb5dea2f9d3a03f
SHA17074e70fac5b160f982e2e6ac99d14430bad4795
SHA256ea0100dd0d44955793af53c6b9e3d1c66004fb1fed8e2626dd74d9f33f92eef7
SHA51220e160a84cbde822e4fa5588c5b5df4e8cdd71be6ad321e818c4e009f87e993c2e62fbd2f223d7ebdb6dac263edbebddb1c5fcfe97b4f740a8d93f2af036ccbc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bf69dacd470fc62b1f47410d2e79af97
SHA185eff670439076786edfd566dd959b1953159755
SHA2560d8923dfaf0450545f905f870302932c83643a466d00608454b4e354c5381228
SHA512d4dd934e3e01d59d1ad425dd41ed7513300f9ed72df0596b8335ee254e27e1968d6a7d46e29ec14aff2c5bd04aaaa8ac400de81cb6237dd564a8b8af04724354
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5f130490d2561ebf7250855aee3814e64
SHA103eec95c25c961fe5bd1d6d4540d03037706f778
SHA2560365369927da5876993cd57799d502f3c7e2183b7e182b746e36ac2b65865430
SHA5124a0d6c6561c7544614f05b5240473e40ed288b431f7350018dadc3880c3feb8a9adf6ee8443abea2cbf2df141912408369333da35f0e66e62897ab8ec41af488
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD50f54c44cf13fe5dfe6d565059b7a6cb1
SHA17fb3dce12424aca445216b5013b9d66ed23fea1c
SHA2569a99166a9e75199f194c3788522e07cd98015ab1698f531720e27192de6573ea
SHA51258fa8687d7a7a99adf86c7976254ad4b02d4db3543df4218b97e3759cb6dff81fd7c6034aeb40d929d1d4b99942df62624b8be86d7a596a206496e91c0cb53ba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD52a22cdbd3d1ef81a10f0cdcd7f6284ab
SHA1e3972597230ba7635347e4db743844d2e0a08d7b
SHA256d392b82898915f25a920872942f786f54285c5f444302e49f479b76a1a5807f0
SHA5123973bd83a544a5407e8e9f3e71c14d21b40fb1830ec7451a1ac25c9cec83fc4a4aa32f9ccdc3a7083d8bd785b24d6cfce72104d0615da8fdd1ae35f9c180e4f2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD573075f6ad6355742e178279c5c635b24
SHA19bb80186c94e2c99891e6d4573dd83badbf01737
SHA25646042005756f3f551d368473772a7aaa2428543c7cf17211216d1c898afa371b
SHA512b4427eafa26ab865387d892e3c08026af523dcdc72a2ff15222be4153006caeb7eb710f4e5c2660fa49ef67d30bf36e976e34d9ceacb7ff8b69889b1c0e82ecd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD534336d5ac163113081189bde9120d1af
SHA12913077a87d1c0d894aa0561d404ae5994d090ba
SHA256557499ae6901edc3cee8bd7e0b0ff90c9d9a525c107043d35012ebbbcef6497a
SHA51261a2d32454d5460edb87df18ed3b83647938dd2d67f0ea9f969bf1266b18d7f6a486c294f00c807c581da73438bb3bd1ec13d783ee56168154b60e2dc5d248c8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b