Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 18:01
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20231215-en
General
-
Target
sample.html
-
Size
297KB
-
MD5
dba8d8c8120260b1384d7fe4665bed50
-
SHA1
2658aa052714d3f83fe7cb7e3a00c0bdc0c3b884
-
SHA256
d507efd53860e9169b5c62a468495daba83f720028285be90f66523ac3740530
-
SHA512
1be0a1c3937dc0acff3f533d490571cf3160faff4809f459fef2de2dfbb0926664c6d6d3dc66514e58f7926ede4a81e32f90a855bb40addeef4b99c539522e25
-
SSDEEP
3072:SLqlBYXvRTPK3BxxlVhJlJRsHygM5ZzYcB:SelBYkx7VHR6ygM5ZzYcB
Malware Config
Signatures
-
Detected phishing page
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: IEXPLORE.EXE File opened (read-only) \??\R: IEXPLORE.EXE File opened (read-only) \??\Z: IEXPLORE.EXE File opened (read-only) \??\A: IEXPLORE.EXE File opened (read-only) \??\E: IEXPLORE.EXE File opened (read-only) \??\O: IEXPLORE.EXE File opened (read-only) \??\Q: IEXPLORE.EXE File opened (read-only) \??\U: IEXPLORE.EXE File opened (read-only) \??\I: IEXPLORE.EXE File opened (read-only) \??\M: IEXPLORE.EXE File opened (read-only) \??\N: IEXPLORE.EXE File opened (read-only) \??\S: IEXPLORE.EXE File opened (read-only) \??\V: IEXPLORE.EXE File opened (read-only) \??\Y: IEXPLORE.EXE File opened (read-only) \??\B: IEXPLORE.EXE File opened (read-only) \??\H: IEXPLORE.EXE File opened (read-only) \??\K: IEXPLORE.EXE File opened (read-only) \??\T: IEXPLORE.EXE File opened (read-only) \??\W: IEXPLORE.EXE File opened (read-only) \??\X: IEXPLORE.EXE File opened (read-only) \??\G: IEXPLORE.EXE File opened (read-only) \??\J: IEXPLORE.EXE File opened (read-only) \??\L: IEXPLORE.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078133" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31078133" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3157504965" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410248142" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "39" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3139623637" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "24" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "24" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3139623637" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E62823C4-A2E8-11EE-8184-F21AB124C203} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3157504965" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078133" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "24" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31078133" iexplore.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-768304381-2824894965-3840216961-1000\{5EBD19E0-1817-45AE-946E-38C435FEED81} IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 4772 IEXPLORE.EXE Token: SeCreatePagefilePrivilege 4772 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4036 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4036 iexplore.exe 4036 iexplore.exe 4772 IEXPLORE.EXE 4772 IEXPLORE.EXE 4772 IEXPLORE.EXE 4772 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4036 wrote to memory of 4772 4036 iexplore.exe 89 PID 4036 wrote to memory of 4772 4036 iexplore.exe 89 PID 4036 wrote to memory of 4772 4036 iexplore.exe 89
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4036 CREDAT:17410 /prefetch:22⤵
- Enumerates connected drives
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4772
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IVKOU8D5\spdmg-backend.i-mobile.co[1].xml
Filesize13B
MD5c1ddea3ef6bbef3e7060a1a9ad89e4c5
SHA135e3224fcbd3e1af306f2b6a2c6bbea9b0867966
SHA256b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db
SHA5126be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\IVKOU8D5\spdmg-backend.i-mobile.co[1].xml
Filesize113B
MD5f37b6f46ee0c6c09dd5c7868e51ba4cc
SHA1ab4234e562c8d7f44ed5b2875cf5f2c27a517896
SHA2560843ae0d7e5532d909de8751d61dc0b777247f45f2fbcb94355d8716d44bfd28
SHA51297aadfc3dacd53b09187c9841d1cae8c81ef43898553701e7294da9a0e94d8484ca5046f86533b1a5de86f12f2245660f3be6b85488de7e2c774ed3c3061d503
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
78KB
MD5800db8e2137029535b1d63a33ff68798
SHA1c31c5b7fff4b772d7097ca2924005cd5b7ed5b67
SHA2566b3602d883b1677efcd02edc8ac314d2430f772b5fba24d51e8884dc15b53668
SHA512d135d7799b06331c75a967a69feb0a0c0e48a0594cd03f2d9ade285fbc21424179971587d6d6f171053f8aacc2755b048f21ff5938b5aa121fb532de1e7c936d
-
Filesize
9KB
MD57050d5ae8acfbe560fa11073fef8185d
SHA15bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA256cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
SHA512a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
-
Filesize
1KB
MD53a6ae88ca63a968fd7c014c982fa5731
SHA17769f4be128e863f2f14fd0a9b59d1c49dcc9023
SHA256b8666b6a7bda5ea0466128485e57eb867e069582c3709bde90ec39f88d467d0a
SHA512c2f1e6adc5c5e7f0e32327eddaf913abad088c398ab5dedb6e93be005b9a640cf65bf04ebf7e92ae0f725f51c40480fca1afc77beb6c871eb6ef5dbc73d0b2d4
-
Filesize
138B
MD5aff950cab4c0265e21d401db15f1026d
SHA1f03e18461817f7a6546c8bf8fa8d686d7e30aca0
SHA256753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
SHA512a1f0f6f3dd6788a1d7c922c6a8fc81d4709dbd0bf28433023fb8fbd151f645daa096c6e9dd670fb7f86c1699942514a11c183aa09f0018142f823668fb2a0aa2
-
Filesize
154B
MD5cfbeaf604823f038b8b46f0ac862b98c
SHA17b9eb1dac48e74fa5f418bc456cb410f88b81d98
SHA25620c1ab602462b7fc0d5b4cbd555cacf127b69a07a737579598ebcbc0f5b21319
SHA512c99bf4f1351efb28a74fa2504429875d9a63eb2d6a145a060ed487f83ff3a42b6c85d94165b960edca90aceec58d16a6ed37b25f44452bbacd7f5204c15c23cc
-
Filesize
5KB
MD5ae7cb309043502df5c9f24611919e5e3
SHA11bf98c35a7636dd040724e2aca206911166e67e6
SHA25697d6804c0aa265471fcc7117bf178829d14e5beb00f61e149f5f3624af0791cd
SHA5120b14994cfdeb2199d06ccbe4d1837327949f073b2b50359b4fb08e4b21e5ecbe54650e2954d2300aa77774379565de147c4a5233ec38531adf1557eeac2d1ff2
-
Filesize
51KB
MD5575b5480531da4d14e7453e2016fe0bc
SHA1e5c5f3134fe29e60b591c87ea85951f0aea36ee1
SHA256de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
SHA512174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a
-
Filesize
20KB
MD599b44c11698756e240c74c7f302345de
SHA13a9a6cbc3a10c3e9be9a900a977e341d0d786daf
SHA256afba8e7564c8117817ad655c9bef0c2ef4a248783837a70bf42c51dfdb7eb910
SHA512c8ebdbc1dc1eddd3dde9bc04503f6cc64a8036e5ecb4c9248f13d265f80b08b46705ed01fe3b37d19ba32de548eec8130b120bdb2d19e9b0a001ef5d5d5bfea3
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee