Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
1b5aae06cf7...6e.apk
android-9-x86
1b5aae06cf7...6e.apk
android-10-x64
1b5aae06cf7...6e.apk
android-11-x64
1404.html
windows7-x64
1404.html
windows10-2004-x64
1SFStockCha...e.html
windows7-x64
1SFStockCha...e.html
windows10-2004-x64
1WebViewJav...dge.js
windows7-x64
1WebViewJav...dge.js
windows10-2004-x64
1calendar_d...e.html
windows7-x64
1calendar_d...e.html
windows10-2004-x64
1calendar_d...g.html
windows7-x64
1calendar_d...g.html
windows10-2004-x64
1calendar_d...k.html
windows7-x64
1calendar_d...k.html
windows10-2004-x64
1common_tts.html
windows7-x64
1common_tts.html
windows10-2004-x64
1commonapi.js
windows7-x64
1commonapi.js
windows10-2004-x64
1decode.js
windows7-x64
1decode.js
windows10-2004-x64
1fontsize_fun.js
windows7-x64
1fontsize_fun.js
windows10-2004-x64
1illegal_domain.html
windows7-x64
1illegal_domain.html
windows10-2004-x64
1insert_rel...4.html
windows7-x64
1insert_rel...4.html
windows10-2004-x64
1json.js
windows7-x64
1json.js
windows10-2004-x64
1json_1.js
windows7-x64
1json_1.js
windows10-2004-x64
1licaidaxue.html
windows7-x64
1Analysis
-
max time kernel
134s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
15/08/2023, 22:00
Static task
static1
Behavioral task
behavioral1
Sample
b5aae06cf771eae62f010f2db6f70b610445bd23147b5eac248414ec69736d6e.apk
Resource
android-x86-arm-20230621-en
Behavioral task
behavioral2
Sample
b5aae06cf771eae62f010f2db6f70b610445bd23147b5eac248414ec69736d6e.apk
Resource
android-x64-20230621-en
Behavioral task
behavioral3
Sample
b5aae06cf771eae62f010f2db6f70b610445bd23147b5eac248414ec69736d6e.apk
Resource
android-x64-arm64-20230621-en
Behavioral task
behavioral4
Sample
404.html
Resource
win7-20230712-en
Behavioral task
behavioral5
Sample
404.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
SFStockChartDecode.html
Resource
win7-20230712-en
Behavioral task
behavioral7
Sample
SFStockChartDecode.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
WebViewJavascriptBridge.js
Resource
win7-20230712-en
Behavioral task
behavioral9
Sample
WebViewJavascriptBridge.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
calendar_detail_live.html
Resource
win7-20230712-en
Behavioral task
behavioral11
Sample
calendar_detail_live.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
calendar_detail_meeting.html
Resource
win7-20230712-en
Behavioral task
behavioral13
Sample
calendar_detail_meeting.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
calendar_detail_meeting_black.html
Resource
win7-20230712-en
Behavioral task
behavioral15
Sample
calendar_detail_meeting_black.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral16
Sample
common_tts.html
Resource
win7-20230712-en
Behavioral task
behavioral17
Sample
common_tts.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral18
Sample
commonapi.js
Resource
win7-20230712-en
Behavioral task
behavioral19
Sample
commonapi.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral20
Sample
decode.js
Resource
win7-20230712-en
Behavioral task
behavioral21
Sample
decode.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral22
Sample
fontsize_fun.js
Resource
win7-20230712-en
Behavioral task
behavioral23
Sample
fontsize_fun.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral24
Sample
illegal_domain.html
Resource
win7-20230712-en
Behavioral task
behavioral25
Sample
illegal_domain.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral26
Sample
insert_related_news_7_24.html
Resource
win7-20230712-en
Behavioral task
behavioral27
Sample
insert_related_news_7_24.html
Resource
win10v2004-20230703-en
Behavioral task
behavioral28
Sample
json.js
Resource
win7-20230712-en
Behavioral task
behavioral29
Sample
json.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral30
Sample
json_1.js
Resource
win7-20230712-en
Behavioral task
behavioral31
Sample
json_1.js
Resource
win10v2004-20230703-en
Behavioral task
behavioral32
Sample
licaidaxue.html
Resource
win7-20230712-en
General
-
Target
SFStockChartDecode.html
-
Size
168B
-
MD5
0075186861e0a71e5b9b046daaaadcfd
-
SHA1
8d1f23e30125ded761b892ce939e167bdf24a7da
-
SHA256
69aef184af12eb631704c6f6f37f38bf1523b591981e1cce3198ad811eb37259
-
SHA512
a7cd0047a06ee8e980c9712a72d7ccf50148b13515215ead1a9547c7c14e813b0a3f2b178f8f673f77d1dc37e51819b683b4c7885785aebd13b34d0f1b108332
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "136087559" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10f6cc08c4cfd901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "398901826" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31051716" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31051716" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{314E489A-3BB7-11EE-A61E-C615F1EABC99} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31051716" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a07bbe79b265d14db3b0aa02a38821470000000002000000000010660000000100002000000076df5380982f4f1e35be7a3be9af6ef9fdf4c9a26df423590b2ae68cfcfaf02d000000000e8000000002000020000000fdb0d724bd6e098e0aea9574bb5fc201d7cdd6387ffaeef61a56c0fe5af0316a20000000ac4f9e06d17d50fbe996263e87dd6ab7a616b17bd2c0ff47fa969171f5a9dffc40000000c7359d295993f32341a0f45e75231800168d55518f1f206c8bcb6bd77f66d13eddd2d49a8b262ac62661c33d7b670e2679804d6de15368795d9d4fc10301a211 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a07bbe79b265d14db3b0aa02a38821470000000002000000000010660000000100002000000002c0919e8db82eed61828926c998ea048dfc3c13b5545524f8187cd34d0fbff9000000000e8000000002000020000000e691d7e60b3a4ce0fb4793793177644751d7bfac48722170508a22d479299f4b200000001c65d33d10d5e4e060a2cd45e9226f76411954f60c073abf701f28d6fcc1d7ae4000000076a00d46ea36cb64bfa5af4517fe36b93a690983a80048435d351ac321f932da63431c104757da8cf6a46f7173f97edcc21cf9291123719f387f95c6803206c2 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "102649704" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "102649704" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0c3e408c4cfd901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3540 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3540 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3540 iexplore.exe 3540 iexplore.exe 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE 2936 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3540 wrote to memory of 2936 3540 iexplore.exe 82 PID 3540 wrote to memory of 2936 3540 iexplore.exe 82 PID 3540 wrote to memory of 2936 3540 iexplore.exe 82
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\SFStockChartDecode.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3540 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2936
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5abd894aef4f73449a6cfc2d076225933
SHA1a2d44ad11d7e16dfa5ecbee8502ca659ee48cf96
SHA256f7303aeb79a7b3b1848d6c70ac0a4d9c068d1503d1243e4ed393696e9ef24d04
SHA51228ce4e117ed6c9f6d708b4e349f123bc9b8469ea996926caabf4e127a0628a8d6925e12dc2af678feba0be14bbcb53d6b69100f09e2fc91bb96c491896b77bde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD50b8c277fc9911c58da1e3539c2d507b8
SHA14031088c259c7302993b70c52e99e8bf67c30814
SHA2560cde2c62ffde289c868ddd7f3dc6f4dccbb8bfd5309a5e66ef65b6e58e927f15
SHA51219a6caa0d6bc1cb95994261a19b07a0991821ae80c5d1fdfdc6326f73220d2c356b819dbe6f11f0b95d0d0e9b3e6c7cc44fc62b4c88b059891d7f4f21851eafb
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee