Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/09/2022, 20:07
220928-yv7y2sghg7 128/09/2022, 20:07
220928-yvyelsghg6 128/09/2022, 20:05
220928-yt8tysghg4 1Analysis
-
max time kernel
67s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
28/09/2022, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
Benefits_Enrollment.htm
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Benefits_Enrollment.htm
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
Benefits_Enrollment.htm
Resource
win10v2004-20220901-en
General
-
Target
Benefits_Enrollment.htm
-
Size
894B
-
MD5
8980b1a93fe78bf6e0af956c2303f35a
-
SHA1
053fbbb80de7d672ada8e2ec6fafd4b1440e2213
-
SHA256
28ffced68f4e723ff44888dcc1465ea2b4872bd7e629119afab7a8b3c1e728f6
-
SHA512
a69fa95113ad43562d2acea40787a4715f2ff983561a7d2124cabd0a29d7dfa5cd808f62a24ebd8f09bd22a93ce2c09545603222e78c386738b2b6c0c9ca747a
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30987142" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012068ee23372fe41af7eabde7907acf000000000020000000000106600000001000020000000e1692ce5c19674bc7d1586b1485c1c7c6a728c423a7ab2d7caf17ba627b7ecfb000000000e80000000020000200000005c8478f1d0a47f10f2fc1159232760c53ecbda5a5ae9833b9b35d8246092060620000000be3ab085233eb156d94a2856188cab322de03b0f198ff01528fca668f974f2ad40000000f52b6974abdeea84165114be08d8a7193ef6705ab21240e1c83a3e01a147d4feca3a1b53e73900aff8f2e7ff9886f4d2b1e1139fb5d632c83dd1ab547e3ac684 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000012068ee23372fe41af7eabde7907acf000000000020000000000106600000001000020000000a5e68251a380b3b8fc94ba1bdeeda7b9a5e59dd57e4a497e7a63abe1cb688805000000000e800000000200002000000019c2d6a6a846b7877abef505c0bad6d74152f00501752e4803d04f7c5a0d8c112000000010dd103199c6d65d15394491a696a9cee43c58d039047c4541b86ddc32d2e226400000008c4a2dc9828f35c8bf0786b6aec9c4da5bc442bea106565b5581ce033a068342b9fa0938f99404c4d1c7d2754e0c1a8b1f6ddcdd2e2b99eb104ae1df2d3d2cca iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3554285111" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987142" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 106963d586d3d801 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "371167847" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "371184441" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3554285111" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FF3F1226-3F79-11ED-A7A3-62FB359F6F94} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3561474698" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "371216433" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30987142" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f04f6fd586d3d801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3844063266-715245855-4050956231-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3540 iexplore.exe 3540 iexplore.exe 60 IEXPLORE.EXE 60 IEXPLORE.EXE 60 IEXPLORE.EXE 60 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3540 wrote to memory of 60 3540 iexplore.exe 66 PID 3540 wrote to memory of 60 3540 iexplore.exe 66 PID 3540 wrote to memory of 60 3540 iexplore.exe 66
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Benefits_Enrollment.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:60
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD56e49f7f1e7d5faf70613dcb484cc70e4
SHA1b17a7107140658a4cab09549a23c78481a299026
SHA256038c08b412582a9f36e5eb1f65c5786f84e5239f26e7534c790a777265657142
SHA51298c3a2cac5680aa57680405185be9bcfb38ebc417007e0a911044b1b5aee96336c40eaac0c7a308cb2b3e3e2e3a37c3cdc685f998e2a99f40978588cee8f3fa2
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5e5d756b82bffe3bade04032607ddef73
SHA1a9973a3298789515915fda9499a85953c265a1d6
SHA2569db0a2e1c037089854aefdf5a3432327a00a8d18d87c829e713858b794381840
SHA512f71503cf20f1a05da1d4e8f5169df0f5e8c7cb20d714c73cf0cb6ff617d5750407d82302d2bb5e9c9113691d5ae20a5d7482a82d7e0ce04e29d4fedab4e703b9
-
Filesize
615B
MD5b0c713bb7daea99816432bc2b1e00b22
SHA14702ba8c42689533a0e7a04e004a83b2e230d2d4
SHA256823d33e4d8262559016236769b5845e334aa6b6d662000b09af99fa9b01ca90a
SHA5128a3905a3de93ad99595f2e49d596de983e652c9533fb746a01d63e171c9beb56ae015cc8b57dafd46c93d04fd86e83313031aa2a4eb8248d0976be2faa523aee
-
Filesize
615B
MD5cd6e33c5ce8a8f6444831362cd460998
SHA1d7ec0104529b979b4378f9dad2d1e5cdb08723f3
SHA2561c34f96922e4a0310b03446ec171f362c50722c4104cef6d45d1562494dff2d3
SHA5126c8a3f414d9a7df3d07c7ffb7638c1acf466abbf11a2b1d9c5f154a89a1381015cadddc7ef86449623e63e2a6caee71031b1459c9b5f31a4f03856ddd05fa03a