Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 17:20
Static task
static1
Behavioral task
behavioral1
Sample
ff3a26f6c5dabc0c6b00bef8f2db766e.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ff3a26f6c5dabc0c6b00bef8f2db766e.html
Resource
win10v2004-20231215-en
General
-
Target
ff3a26f6c5dabc0c6b00bef8f2db766e.html
-
Size
34KB
-
MD5
ff3a26f6c5dabc0c6b00bef8f2db766e
-
SHA1
ef2a67eadb2729f12fbf621db345d08caad1e1a7
-
SHA256
2f6edefd0eb9885253e33b1fd409996fdd37d201eecb8df97b5ed0f32739de9e
-
SHA512
42feeed084f711363daa663914c283fd86ac0f92f1b45fe246797479bd1bbe73d7c8387015181bf704f2bd5b48f97f489e98aec240cfc7ea779519f4ebaf3352
-
SSDEEP
768:BIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZDOC:BIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqc
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "30677" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "30595" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "30128" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "30128" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410173771" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "15759" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.youtube.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "15759" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "30677" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "45606" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "30128" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "15210" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DOMStorage\youtube.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "115" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "15677" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31077960" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "115" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "197" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "30595" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "15210" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2448679567" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077960" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "30595" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "45606" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "282" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{BD9646E9-A23B-11EE-9ECD-4ECC77D3B663} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "15677" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31077960" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\Total = "197" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "30677" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\youtube.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2454773481" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "6" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "121" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "282" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.youtube.com\ = "45606" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1232405761-1209240240-3206092754-1000\{741D923A-BA01-4C3F-8BF7-8C490A0AFFED} IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4856 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4856 iexplore.exe 4856 iexplore.exe 116 IEXPLORE.EXE 116 IEXPLORE.EXE 116 IEXPLORE.EXE 116 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4856 wrote to memory of 116 4856 iexplore.exe 89 PID 4856 wrote to memory of 116 4856 iexplore.exe 89 PID 4856 wrote to memory of 116 4856 iexplore.exe 89
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff3a26f6c5dabc0c6b00bef8f2db766e.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4856 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:116
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229B
MD58823a75b180ad4fe22dfe822b3d35296
SHA1ffdcf6573d9428da2332d45cb8fc86bfaae7f10a
SHA256946369ca96b24a939fd4d9523af9a6a42389970abee0013693331453d0726d79
SHA512ad3fa1f8184c97eb48acdcaf94ffb896800678f8cf70a870875c6c7fa6af76be8cd31c244d100446d33e55019146fba5ac091b8f781296bf493369865af9279d
-
Filesize
229B
MD5576f02dea41f2f4239fcc5202c20324f
SHA146a2dc0fea790acbfc680356dcfbe5d55abceb3e
SHA256ccbac6bc87330f2c6f79b9f1f112e49872fde56df42deaca65d4954c528c01ee
SHA51271a142199d7c202df518b62deda0a5336d6f1080920e59b890112b4b28299a231d05c7779faece5e7e8ea3a571b4ee1e8565c90947e6d5a80940122e083df6cc
-
Filesize
229B
MD5f7b500832b91da7484952fa4ea95f249
SHA1f9b40f648130cdb727731a42a380b86f16935e01
SHA256a9d59bdf23c3f598d0edd2696f49f3b99c6e0dfb74b513b81ca8ee4948f36678
SHA512ba3363ef5e6790b2821de9ec466b9e3c7a9a46c757af33e194d2adb99f81fc76c384f28c043f3de21e3be9501216d2f11532a49ffeb71ad798b975b5f72ca5cf
-
Filesize
70KB
MD57dfbd349fa2ac161e456111600bb1e73
SHA127a5663e1f33e9e506a2e1a427cf711482e3de9f
SHA25663d44bdac3ec9d5cca5c64e20c01c727c475d4dfe5a2e768a4d4fba71a201a6a
SHA5122ae779b4a5c4e9ae1e24d6ac37db97f859fb0d420835ffbdb475b94152979f57d16088e5df0db68ad34af97fa15a274e97ffac23a5a576c52e23d534738e4b10
-
Filesize
46KB
MD57dd5441457d340da8dd59184286cd2f9
SHA1502e1fdf20773842dfb785466322fe61319c9464
SHA2566cf0869a9631642582d19bb4b984c837d1defed1162436fb3250ec23606c98cb
SHA512b2f6aab15b7f03a654274d4c605ca8087a7d7871bd8aa2fd9b89a2265b4d0f83e71f64b700eca17bbb370af8f8513033265fa70e3d8593a4f42b6f45ea9224cd
-
Filesize
23KB
MD52281473173522048d0ab89664c4429e7
SHA13932d70abc160355f81a0fa00d531d595e01b581
SHA256be72b444841dca8fb9cbe5f63f05fa3561b091b286f64c0ab4e4aae74d28d791
SHA512b7894b2b4c207819d3d6bd6a090307d85e6710c5360cfb1aeddffb8dc30e9402f8c4a5dcc491ce26206df05a16ca5dddc42a0bd5a12d01f0ec116df042714772
-
Filesize
13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
Filesize
322KB
MD5303d9f3d8084d98c3cfc81721790f192
SHA17bd3f1a1f6b4752b7d646dd45051e446be259a41
SHA256d854531f9c3833536d6971b4fd7617dafe1a2c6fd0bbed9469122e73ff3b13a1
SHA5125dacdc9b308da058cbc33e80a4e4900adb17bd63c9b55316da06cb3f0867257180d89cdf7d0069440cfdf5a696f66d2b6161add2e090daed59114bf1d6c36aff
-
Filesize
357KB
MD5f273335110f2108edde77264cebddef1
SHA17b7881cfffe8fd1197e74da6ae4fdc62b3cce672
SHA256af17d4cff542b33c97ee3a95f82a21d8993c87fd3472dff534fa855828a3b615
SHA512c45111893164fcfed5be0c6c1fc847495868964e498411f7dd1658c7e7af6aba6931fd73825c9ff73d0afd0e7c48af0c7b3a7fbdc08b02a81deaa51657b00c39
-
Filesize
1.7MB
MD57043145e1364b8767d07af6de37cff5a
SHA172dff23ff43f83138661499c69cc44cb70e9356f
SHA25637585b9741f5a1cff768adb35bd8bec54b35ff0ca022ee6ce0935879c8cbb0e3
SHA51242160bccff5c5e44caa863c6f956a84a818ad5dc43c79adb09e0221fe4b81f272f37f085f301626fdd89f4673b9cbbe8cacfa94f55a160aa453aba2f8bac3967
-
Filesize
51KB
MD502e3aa6de0c0cecb0267cd83d6f64d51
SHA1ab29481e145d32c7ff2a2e850a90e93ea9e2a60d
SHA256234595572b74d58cd52917208142b3131ad7992126358ee0d917a40cd1240e83
SHA5122e01c259120af23f10fab29d646879a9db5d1b8c4d8ed37b1c6cb0a49c19fbd7683e77f1749ac476fb44fe6f992c2403a3590a8d79ebf0dbaa3164f50c702660
-
Filesize
29B
MD51fa71744db23d0f8df9cce6719defcb7
SHA1e4be9b7136697942a036f97cf26ebaf703ad2067
SHA256eed0dc1fdb5d97ed188ae16fd5e1024a5bb744af47340346be2146300a6c54b9
SHA51217fa262901b608368eb4b70910da67e1f11b9cfb2c9dc81844f55bee1db3ec11f704d81ab20f2dda973378f9c0df56eaad8111f34b92e4161a4d194ba902f82f