Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
107s -
max time network
225s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system -
submitted
02/09/2023, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
4a7effc3779660472214103984f3dbab0965bc20605a6cc5f1f4d17ddfd5f998.html
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
4a7effc3779660472214103984f3dbab0965bc20605a6cc5f1f4d17ddfd5f998.html
Resource
win10-20230831-en
General
-
Target
4a7effc3779660472214103984f3dbab0965bc20605a6cc5f1f4d17ddfd5f998.html
-
Size
229KB
-
MD5
393ff39b2ccca6e961712bd25d415902
-
SHA1
c22a6e068b65c624c5f322b73a97c6967457a170
-
SHA256
4a7effc3779660472214103984f3dbab0965bc20605a6cc5f1f4d17ddfd5f998
-
SHA512
db5c1aa9f342b6a3f96442e9acdc6df345b7e3bcc8cc7e5bd6ea426da78dd47bb146cc8f0d2c832ecdea8720c8c2ea1f6dbf0abdb313ab82e8f417dae56c247d
-
SSDEEP
3072:Me8T+SjaZah+38dz2edsd1K/za2pIQ6ddUNstRF7bcF0bP5Fylw/FcYcPFko/Eb+:Mj+SOZSbdsd14lwv3Rq
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31055192" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4130561207" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz! iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31055192" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0528afa58ddd901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31055192" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "400395156" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "400411750" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4128531621" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4130561207" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4128531621" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "400443742" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000134594b430d3b84a835d800db364e7b00000000002000000000010660000000100002000000075f54c95b3f77643576d75fb010fb90dfbf78d956c6084150348baa4349a850e000000000e8000000002000020000000e6dc0ccda2b83e0c0bbf30a484831a76f42d243089e3119f005c0c3a489fb20d20000000ccf06773095ca42b72558db33a7e9bdd075472a0892649cc3c0cb5b1055c2faf400000009fc32e3508a3c7ed443e7350ad7b1ddc355e654bd7d8dd3a4883c31b04a19731949078e5ceb7ff49d8f156715e91b2c7d8a711f344a43d74b620bee86312737f iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{219161BA-494C-11EE-AB24-5E40299A3A6C} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000134594b430d3b84a835d800db364e7b000000000020000000000106600000001000020000000e79d75be619c0bdbc3aa55089065967f659c8aaa40cddc2fa09cc7a62a1e836e000000000e8000000002000020000000d3c5134ff66ff27fb1fa96a04e8a186855f7adfc0cf6f54b57829a403094c704200000000eaf1184191f2c3afa0728a61b11572ce32c550301e373f4461924469d3bdb784000000052777315c9be2671699aed0356b455a1f17768a5e922aa386b798e6b87850f34b7e20b5bf73aaa237382a1e767743d3277a8efc10ef49b1fdd0ca611fe591f8e iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31055192" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-307324125-4249701739-3835089310-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b179fa58ddd901 iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4868 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4868 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4868 iexplore.exe 4868 iexplore.exe 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE 1436 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1436 4868 iexplore.exe 70 PID 4868 wrote to memory of 1436 4868 iexplore.exe 70 PID 4868 wrote to memory of 1436 4868 iexplore.exe 70
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4a7effc3779660472214103984f3dbab0965bc20605a6cc5f1f4d17ddfd5f998.html1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4868 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD524be8a92460b5b7a555b1da559296958
SHA194147054e8a04e82fea1c185af30c7c90b194064
SHA25677a3cfe6b7eb676af438d5de88c7efcb6abcc494e0b65da90201969e6d79b2a3
SHA512ed8ef0453e050392c430fdcf556249f679570c130decd18057e077471a45ab0bc0fba513cb2d4d1c61f3d1935318113b3733dec2bc7828a169b18a1081e609a0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD53a50ce37c484741b6394155c1f7581e0
SHA119bbc1d0c2b6aa535a01270633d49160b0e4630e
SHA2562c16cea1471e4e46950429a7c0ac0481e88a24d365ccc0398c1e6a858d577140
SHA51264ef562f568d14a3da0345b8c58e91c7416d0fb8707cc704ebab0bf556fd3d6b9c7c9d20e88632bb851f4e82a45c3144979dcbdf3706088e6b89c85fe3347cbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize342B
MD5964ad23b486ca17848523e65dcc6c5a5
SHA1e5d8c2a306ad16101dd4f0cd44534d7a606e6868
SHA2562691b2430a0bc56a4d17b197884629fc2c1afc900368cf0a25b2ee2bec6a054c
SHA512488d741441160b11f07cb8f75198f1040b9277e42191dce3336d0361e33797cd8cc41a1637037cce39e5dec7296b362a3413acfd442b1b0b84975dd298c0b098
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5d7794e280259b2017bbfca61638f6b1e
SHA1757998a7f49d84eeef5ca38a744b5e30058cc15a
SHA256a9a8aba38607761e83ae420338c259015b1d9d446341b980c4988e8d9e399854
SHA512ea24eaa95eb372a1df56225cc203830fe3ffff42eb410850b28ce0084512523a6cdc30e18145af19ed401c76f17cd46343559c53d7bb18de45f3ed65c4eed38c
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
610B
MD5c1f9bd94dea06ae120ebd9139e903824
SHA1fef192d4633efcdede40813bb132a78ae54bc07f
SHA25616fa75d902f7508382230165885c5e50a47d3facf62db4c7833eb24150df7ddd
SHA5123fef954aa401274f0da7f582de3c12a62562bae7db6dba1d9a8e470de63736f6cef3d42a23efc2e15cfa5ee2d4983586ffb1dc11c52095425c3626d0dcc95fdc
-
Filesize
645B
MD51350a6ce63473f5ddfa9408670689a6a
SHA1f4a288ac4fad75bda512cbf71c3df1b9531d43fb
SHA25687c7a33a59a08aa7d5856a53cfa4128c39b31a4cc7ee5f8da049eeb98252e441
SHA512327cabd0145e494d0ec911b752ee072518ca284433dfe944f8c758d4b330e7db55f7d463e22b6f60e69f2080ecefdd487e3fd3e85a4141181aee7b6b7221a8d4