Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
iPRS導入...pp.xml
windows7-x64
1iPRS導入...pp.xml
windows10-2004-x64
1iPRS導入...ail.js
windows7-x64
1iPRS導入...ail.js
windows10-2004-x64
1iPRS導入...orm.js
windows7-x64
1iPRS導入...orm.js
windows10-2004-x64
1iPRS導入...pp.xml
windows7-x64
1iPRS導入...pp.xml
windows10-2004-x64
1iPRS導入...orm.js
windows7-x64
1iPRS導入...orm.js
windows10-2004-x64
1iPRS導入...er.vbs
windows7-x64
1iPRS導入...er.vbs
windows10-2004-x64
1iPRS導入...es.vbs
windows7-x64
1iPRS導入...es.vbs
windows10-2004-x64
1iPRS導入...ute.js
windows7-x64
1iPRS導入...ute.js
windows10-2004-x64
1iPRS導入...pp.xml
windows7-x64
1iPRS導入...pp.xml
windows10-2004-x64
1iPRS導入...orm.js
windows7-x64
1iPRS導入...orm.js
windows10-2004-x64
1iPRS導入...er.vbs
windows7-x64
1iPRS導入...er.vbs
windows10-2004-x64
1iPRS導入...es.vbs
windows7-x64
1iPRS導入...es.vbs
windows10-2004-x64
1iPRS導入...e1.htm
windows7-x64
1iPRS導入...e1.htm
windows10-2004-x64
1iPRS導入...e2.htm
windows7-x64
1iPRS導入...e2.htm
windows10-2004-x64
1iPRS導入...er.vbs
windows7-x64
1iPRS導入...er.vbs
windows10-2004-x64
1iPRS導入...es.vbs
windows7-x64
1iPRS導入...es.vbs
windows10-2004-x64
1Analysis
-
max time kernel
135s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26/09/2022, 02:07
Static task
static1
Behavioral task
behavioral1
Sample
iPRS導入包/App/FCM_Report/App.xml
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
iPRS導入包/App/FCM_Report/App.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
iPRS導入包/App/FCM_Report/App_Code/CommonLayer/DataAccessLayer/Business/busMail.js
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
iPRS導入包/App/FCM_Report/App_Code/CommonLayer/DataAccessLayer/Business/busMail.js
Resource
win10v2004-20220901-en
Behavioral task
behavioral5
Sample
iPRS導入包/App/FCM_Report/App_Code/CommonLayer/DataAccessLayer/Business/busform.js
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
iPRS導入包/App/FCM_Report/App_Code/CommonLayer/DataAccessLayer/Business/busform.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
iPRS導入包/App/FCM_Report/Backup/App.xml
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
iPRS導入包/App/FCM_Report/Backup/App.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral9
Sample
iPRS導入包/App/FCM_Report/Backup/App_Code/CommonLayer/DataAccessLayer/Business/busform.js
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
iPRS導入包/App/FCM_Report/Backup/App_Code/CommonLayer/DataAccessLayer/Business/busform.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
iPRS導入包/App/FCM_Report/Backup/Properties/Resources.Designer.vbs
Resource
win7-20220901-en
Behavioral task
behavioral12
Sample
iPRS導入包/App/FCM_Report/Backup/Properties/Resources.Designer.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral13
Sample
iPRS導入包/App/FCM_Report/Backup/Properties/Resources.vbs
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
iPRS導入包/App/FCM_Report/Backup/Properties/Resources.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral15
Sample
iPRS導入包/App/FCM_Report/Backup/formExcute.js
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
iPRS導入包/App/FCM_Report/Backup/formExcute.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral17
Sample
iPRS導入包/App/FCM_Report/Backup4/App.xml
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
iPRS導入包/App/FCM_Report/Backup4/App.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
iPRS導入包/App/FCM_Report/Backup4/App_Code/CommonLayer/DataAccessLayer/Business/busform.js
Resource
win7-20220901-en
Behavioral task
behavioral20
Sample
iPRS導入包/App/FCM_Report/Backup4/App_Code/CommonLayer/DataAccessLayer/Business/busform.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
iPRS導入包/App/FCM_Report/Backup4/Properties/Resources.Designer.vbs
Resource
win7-20220812-en
Behavioral task
behavioral22
Sample
iPRS導入包/App/FCM_Report/Backup4/Properties/Resources.Designer.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral23
Sample
iPRS導入包/App/FCM_Report/Backup4/Properties/Resources.vbs
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
iPRS導入包/App/FCM_Report/Backup4/Properties/Resources.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
iPRS導入包/App/FCM_Report/HTMLPage1.htm
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
iPRS導入包/App/FCM_Report/HTMLPage1.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
iPRS導入包/App/FCM_Report/HTMLPage2.htm
Resource
win7-20220901-en
Behavioral task
behavioral28
Sample
iPRS導入包/App/FCM_Report/HTMLPage2.htm
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
iPRS導入包/App/FCM_Report/Properties/Resources.Designer.vbs
Resource
win7-20220812-en
Behavioral task
behavioral30
Sample
iPRS導入包/App/FCM_Report/Properties/Resources.Designer.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral31
Sample
iPRS導入包/App/FCM_Report/Properties/Resources.vbs
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
iPRS導入包/App/FCM_Report/Properties/Resources.vbs
Resource
win10v2004-20220812-en
General
-
Target
iPRS導入包/App/FCM_Report/App.xml
-
Size
1KB
-
MD5
c5cc9f821ce5b929332202b6f8fa0896
-
SHA1
16f5364a58c75a56f9bfd4e0f19dd0c138734f94
-
SHA256
6729193d39f39980b6d169bd0a6ae8e0059f3306ef365e19acfbc8a98554a00f
-
SHA512
da3c51c2f28cb6e948bed96aa63dd32a120b0da1227277609b45a0de5ae57874a4599015e1cf5c5ae3bab39f364e6eccfe7642fc95887e8e7730194b0eaafe5a
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30986589" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30986589" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06967bb5dd1d801 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E5E23BF1-3D50-11ED-B696-7ED4F7B3352B} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3129906286" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30986589" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000784c32d71373709eca046ce257be2efa293f44a25bdd20f63ea50856115a91c8000000000e80000000020000200000009de0869dbdd3c701c1744aa251c1018880d589096c98aa900c3541af2decd74220000000b03be6fc5c1e22d19889f2e0c59992b116de1043f0f589eb93ae63e1a03e14754000000083cbb8e2e7c46b7f1cd81d7b21d9d4092da1e052692246067de5dfcdb480e5921c2045ca46f836f8df3bbd6db0adc7a3adfe5f4af8fd821a91ff0ad472f45730 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30986589" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "370930293" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3134903561" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e2728ad8693e804caf0ad2c227b1421600000000020000000000106600000001000020000000e0e0c271feb2167e29e351013b392a93fc258dfad1d5713a956d911243446b44000000000e800000000200002000000081b4610536b49fd7fd1c2dcf27c16d448d4ceb740fa790eebeee606a37560ea820000000a1bb3bfcc95a78e4b2a06d06c1a9a9aa8ad5997fc6de146e14e179717e8e98b140000000188ecfb03288cbf265f75aad749ca40993384d59b60f986a79f366daf986c990d43f18d34865ec7f40452e1350bb7b7952ee846ebf3b1fc1f7a0a81a369857fe iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0956ebb5dd1d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3130059660" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3134903561" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 820 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 820 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 820 iexplore.exe 820 iexplore.exe 4776 IEXPLORE.EXE 4776 IEXPLORE.EXE 4776 IEXPLORE.EXE 4776 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1964 wrote to memory of 820 1964 MSOXMLED.EXE 79 PID 1964 wrote to memory of 820 1964 MSOXMLED.EXE 79 PID 820 wrote to memory of 4776 820 iexplore.exe 81 PID 820 wrote to memory of 4776 820 iexplore.exe 81 PID 820 wrote to memory of 4776 820 iexplore.exe 81
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\iPRS導入包\App\FCM_Report\App.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\iPRS導入包\App\FCM_Report\App.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:820 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4776
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5f6d292a2a65c9e87797c7b0fb3018460
SHA110b53657072ae3d240832b895e721dddfaadb6b3
SHA25668851b0ab7e9b1a9af4944d0459ae8adf3531e9345d2629f99f0a7ee5b8d0c6f
SHA512390095530172a02243c356b7d6049fd9b1da0e3a9f66918f0a2c1fee0ec27667724ab58266c46122ed6e5fd8389b5debf1ff0308285d136ce0cfcc7c3555d77d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD52116ab68de936679a27a58ea6453c061
SHA19e11647b8bd5ecb3d4865426477af5b994eeb755
SHA256d38c2bc61c39d0a2c1c5a6473db7b8db2909f3a9713b652a3aa9c5a745b6e129
SHA512e11e9209e91a6b940c416dc6323fe43f3f7fc904e8a88847d35ab367322fbf8702057b2ae545abf1abd46326547bb1ed43dbcaddf419c815ca0fbef28a53c549