Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7WB主题,V...��.url
windows7-x64
1WB主题,V...��.url
windows10-2004-x64
1WindowBlin...1.html
windows7-x64
1WindowBlin...1.html
windows10-2004-x64
1WindowBlin...2.html
windows7-x64
1WindowBlin...2.html
windows10-2004-x64
1WindowBlin...IG.exe
windows7-x64
1WindowBlin...IG.exe
windows10-2004-x64
1WindowBlinds/anim.dll
windows7-x64
1WindowBlinds/anim.dll
windows10-2004-x64
1WindowBlin...ck.dll
windows7-x64
1WindowBlin...ck.dll
windows10-2004-x64
1WindowBlinds/core.dll
windows7-x64
1WindowBlinds/core.dll
windows10-2004-x64
1WindowBlin...ch.exe
windows7-x64
7WindowBlin...ch.exe
windows10-2004-x64
7WindowBlin...en.exe
windows7-x64
1WindowBlin...en.exe
windows10-2004-x64
1WindowBlin...rt.dll
windows7-x64
3WindowBlin...rt.dll
windows10-2004-x64
3WindowBlinds/tray.dll
windows7-x64
1WindowBlinds/tray.dll
windows10-2004-x64
1WindowBlin...ll.dll
windows7-x64
1WindowBlin...ll.dll
windows10-2004-x64
1WindowBlin...32.dll
windows7-x64
3WindowBlin...32.dll
windows10-2004-x64
3WindowBlinds/wbdb.dll
windows7-x64
1WindowBlinds/wbdb.dll
windows10-2004-x64
1WindowBlin...lp.dll
windows7-x64
1WindowBlin...lp.dll
windows10-2004-x64
1WindowBlin...32.exe
windows7-x64
1WindowBlin...32.exe
windows10-2004-x64
1Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 20:47
Behavioral task
behavioral1
Sample
WB主题,VS主题,精美壁纸,电脑美化技巧,美化软件,炫目登陆界面尽在稻草人美化.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
WB主题,VS主题,精美壁纸,电脑美化技巧,美化软件,炫目登陆界面尽在稻草人美化.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
WindowBlinds/Diamond/NS_Shellstyle1.html
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
WindowBlinds/Diamond/NS_Shellstyle1.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
WindowBlinds/Diamond/NS_Shellstyle2.html
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
WindowBlinds/Diamond/NS_Shellstyle2.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
WindowBlinds/WBCONFIG.exe
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
WindowBlinds/WBCONFIG.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
WindowBlinds/anim.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
WindowBlinds/anim.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
WindowBlinds/clock.dll
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
WindowBlinds/clock.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
WindowBlinds/core.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
WindowBlinds/core.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral15
Sample
WindowBlinds/patch.exe
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
WindowBlinds/patch.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
WindowBlinds/screen.exe
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
WindowBlinds/screen.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
WindowBlinds/smart.dll
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
WindowBlinds/smart.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
WindowBlinds/tray.dll
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
WindowBlinds/tray.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
WindowBlinds/txtscroll.dll
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
WindowBlinds/txtscroll.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
WindowBlinds/unzip32.dll
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
WindowBlinds/unzip32.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
WindowBlinds/wbdb.dll
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
WindowBlinds/wbdb.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
WindowBlinds/wbhelp.dll
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
WindowBlinds/wbhelp.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
WindowBlinds/wbinstall32.exe
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
WindowBlinds/wbinstall32.exe
Resource
win10v2004-20231215-en
General
-
Target
WindowBlinds/Diamond/NS_Shellstyle1.html
-
Size
8KB
-
MD5
6784b22ad0303de8ee5887af8a0cc056
-
SHA1
543a8c2666a15e680e52e4a2b488047818c0aa25
-
SHA256
eadb7aef346d6dcd8c0c13076add9a24ffcbab1438d598c22ea3777346d73299
-
SHA512
5e683f4b3140785f17d95c07cc91e93261711a9570436cca3ebec29d11ba9c394d4b1f9359adf302ecee08d0e6ef5dbb3918f9e7b62e7f2c05b49bcb85990d04
-
SSDEEP
96:VvgaVaIJG1UbLfFP9J7VMnKzsFzAGKB4OS7wFVOcDR1To1+JZAF/AG9OSSwrcE2A:VvgO5JG1uhl51ZxuTqogiuT8/
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{12F0C801-A346-11EE-AF58-6A1079A24C90} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a00000000020000000000106600000001000020000000995a8b23e236b68096c626a725e4762f955ffe72c04da282bc445ba50ab03db7000000000e8000000002000020000000dd42dc3cd98fe4c865b71fdf69f088cf5d98e75c92254a00742986502e24a0b9200000003ce774c2721961f1ab27bc40271343c059021b155a32327931164c892e0a37e640000000fe681e9fa0fb3dc31109f928b55a1a4f71b3060340fdab0061932c6e31485a266b229fb738b156e8c8b07f7363fa26ac03e002a8fff30fdb24d16f75e5a8e0a4 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000969d72c3e5a03a40a0257479feadc03a000000000200000000001066000000010000200000009e57121a07825fbb61330386a0731c893835bda850e3dcaefed2f37a4c6867d1000000000e80000000020000200000007da66e9a58b2ee4f1c3d6e736ae4a2569a61690fe3465dcba1655ed4e5e37f3f90000000a0dee9e6f53832650a58abee5577837b8582956c93d73aa3b3a65bb0286b2838fa4caaeaff5f98aa36151573fe045948eec8f7dc6c24cce7b740077ea508b4901089b537182c2592ed7d7abbe6aec8f479ab7c6b2f974327c6840d293d76b4f0e0b2239b1f1e510f573706ef945e48406d4dcf0099f6561da9be51e510332f5b4897aed0d723fe410538d4d0afd990ac40000000540d406dc91aa3d6d098b0d808c9bb4ec67f99d086fcaabdde9e2fc5dbc70fdd29cf529dac46016db48d39704058581fefc29f2b21e79c4cdca7aafecf2dad5c iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c09787e75237da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409685077" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1792 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1792 iexplore.exe 1792 iexplore.exe 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE 2364 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2364 1792 iexplore.exe 28 PID 1792 wrote to memory of 2364 1792 iexplore.exe 28 PID 1792 wrote to memory of 2364 1792 iexplore.exe 28 PID 1792 wrote to memory of 2364 1792 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\WindowBlinds\Diamond\NS_Shellstyle1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1792 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b615035f5d8c50100e4c27f87a0003c0
SHA13239bfc816fdcd228752f7478f02e4aca495be49
SHA256d2b8780b780112c1d00355770f0246d4cdb86bb14d6d0a2ef04bff1b2306116c
SHA51202cdc9a68ef003b99d13eff576680cbde14fe840bd01ef9d6f74042586b94e4d5b1458e7e6fd576bff8293b962f4a63b8e21617f34613ca2c9d173b190edc030
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5df0a7416801ec3460e6f5f0aebb4fd74
SHA186495da165cc128f9a506d93545712f9f599c153
SHA2566db4766dafc0b1a1e43ae96e99986244724d6cee3201fb3cd0b4e76efe50dbd1
SHA512f8cb1951621eae8efcab06784122e6b334d90c8092ec5a1d974b4bfdaea53bd84a4485b143c4745d229244b9b853bc79d1a52afb743efbeffb4b5a46a8bda722
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d1ed2ea1d035f89856aa03aad17bd1c8
SHA14e948125a56a942067e8eb0e72569ffdd7dfd5d9
SHA256ad644a585422d147e2e7eed6c404046b9501c12cb2d41dc3dcc60d1bb5d02a06
SHA512b8d97e4559cd8450d486cd90cd8430297c17eea0aac6d31a772bce3d21688de0a25bf1180ee0972c26cc38117fcae37121039dd136c79ac010ee74f1bc6d5263
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD583245cc0c0a45050f41ab57739bb63e0
SHA1c6ca62bca978a93e375b3a136d5868c2ac5b28c0
SHA256872fa76d31cb70ff76a44def8c5ed74bb14a4608f24a24c22a9a3adf1a10ddf9
SHA51212bbb7abbc6e8a81ecf90216b01dae6282f9f0f63f59530f9a44643e156ff2bb74c02698fc7a44db359449cf501b0ca9569d207a56ad0c7e9aec746628d6528c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522f953223a44feb7b8eb0b1db82763f1
SHA1d2fdc1aee9b0535eb16899913f2c2a400e0e7566
SHA25650ca62258fdb3393be37f88c5882f0aba62a23d3581c19a48850f77176fbae6d
SHA512fe5f10824fbefa7fd07c6ae07a87772a415b8e9d49c3756081d6008e2fe5249754c27a9d007a7d538a367dc2cf9084255a9723902e70877c1ecc82880c117e50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50c0facfbff8ed993e3b446ea14abc47d
SHA1d7354cb33d2defdc405166f2d80987fa129d7319
SHA2566e05313534733c2c62de314e4b808711d91cb1798f0f85be4b9dc62784ab03d7
SHA512c93a17b88de340426fd3bd7df888fd505c244272c34b867e52d57447a596eec5e050b809ca3bd318284e93ed8e1bb1711d76d4be27b36f615899c4c5a15f2fdb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bd413b8976a66a1807227d88786bb22f
SHA1fcfcb526c061174014d8f3c5a34e2efb22b26fda
SHA2564f26d5d0bedfb3a3546ebbdc80502cb9b3e921a22b9f95c503a0d4b9b4a3ac55
SHA51225d69262c7c92be3c5a376ac043c8af37127e1878d5ff0d3bbd10522549360ed0841dcd0a761ae17533ba04bf9a02e54463d73ea02a59f66ca0498224ffe8752
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06