Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

35447a943b...e.html

windows7-x64

1

35447a943b...e.html

windows10-2004-x64

1

Analysis

  • max time kernel
    93s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/12/2023, 18:41 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    35447a943b8996f508109a14b892ffce.html

  • Size

    2KB

  • MD5

    35447a943b8996f508109a14b892ffce

  • SHA1

    db9b36199915fb026bca0f3be0f10708f84f84f5

  • SHA256

    c3aec66d99b8a33036d9718ce277e441b02f52b684712abacea21aa4069881f7

  • SHA512

    3e761bcd986cc0aeb816f30e650e5fe2c5b3d45f6c7fad5b9803d8efacdd4a245e47c58716a6c4d6ededabea5ffc1a150bebbde98e14d27f784997ce844aebe2

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\35447a943b8996f508109a14b892ffce.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1584

Network

  • flag-us
    DNS
    cdpuvbhfzz.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    cdpuvbhfzz.com
    IN A
    Response
    cdpuvbhfzz.com
    IN A
    103.224.182.217
  • flag-us
    DNS
    cdpuvbhfzz.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    cdpuvbhfzz.com
    IN A
  • flag-us
    DNS
    83.177.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.177.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-au
    DNS
    IEXPLORE.EXE
    Remote address:
    103.224.182.217:80
    Response
    HTTP/1.1 408 Request Time-out
    content-length: 110
    cache-control: no-cache
    content-type: text/html
    connection: close
  • flag-au
    GET
    http://cdpuvbhfzz.com/dl/adv598.php
    IEXPLORE.EXE
    Remote address:
    103.224.182.217:80
    Request
    GET /dl/adv598.php HTTP/1.1
    Accept: text/html, application/xhtml+xml, image/jxr, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Host: cdpuvbhfzz.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 302 Found
    date: Fri, 29 Dec 2023 05:58:36 GMT
    server: Apache
    set-cookie: __tad=1703829516.6120172; expires=Mon, 26-Dec-2033 05:58:36 GMT; Max-Age=315360000
    location: http://ww38.cdpuvbhfzz.com/dl/adv598.php
    content-length: 2
    content-type: text/html; charset=UTF-8
    connection: close
  • flag-us
    DNS
    180.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    180.178.17.96.in-addr.arpa
    IN PTR
    Response
    180.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-180deploystaticakamaitechnologiescom
  • flag-us
    DNS
    ww38.cdpuvbhfzz.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    ww38.cdpuvbhfzz.com
    IN A
    Response
    ww38.cdpuvbhfzz.com
    IN CNAME
    444188.parkingcrew.net
    444188.parkingcrew.net
    IN A
    76.223.26.96
    444188.parkingcrew.net
    IN A
    13.248.148.254
  • flag-us
    GET
    http://ww38.cdpuvbhfzz.com/dl/adv598.php
    IEXPLORE.EXE
    Remote address:
    76.223.26.96:80
    Request
    GET /dl/adv598.php HTTP/1.1
    Accept: text/html, application/xhtml+xml, image/jxr, */*
    Accept-Language: en-US
    User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    Accept-Encoding: gzip, deflate
    Connection: Keep-Alive
    Host: ww38.cdpuvbhfzz.com
    Response
    HTTP/1.1 504 Gateway Time-out
    Server: awselb/2.0
    Date: Fri, 29 Dec 2023 05:59:36 GMT
    Content-Type: text/html
    Content-Length: 132
    Connection: keep-alive
  • flag-us
    DNS
    241.154.82.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    241.154.82.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.182.224.103.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.182.224.103.in-addr.arpa
    IN PTR
    Response
    217.182.224.103.in-addr.arpa
    IN PTR
    lb-182-217abovecom
  • flag-us
    DNS
    96.26.223.76.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    96.26.223.76.in-addr.arpa
    IN PTR
    Response
    96.26.223.76.in-addr.arpa
    IN PTR
    aba1c1ff9d2ec5376awsglobalacceleratorcom
  • flag-us
    DNS
    205.47.74.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.47.74.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    41.110.16.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    41.110.16.96.in-addr.arpa
    IN PTR
    Response
    41.110.16.96.in-addr.arpa
    IN PTR
    a96-16-110-41deploystaticakamaitechnologiescom
  • flag-us
    DNS
    157.123.68.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    157.123.68.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    161.19.199.152.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    161.19.199.152.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    198.187.3.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    198.187.3.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.134.221.88.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.134.221.88.in-addr.arpa
    IN PTR
    Response
    18.134.221.88.in-addr.arpa
    IN PTR
    a88-221-134-18deploystaticakamaitechnologiescom
  • flag-us
    DNS
    194.178.17.96.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    194.178.17.96.in-addr.arpa
    IN PTR
    Response
    194.178.17.96.in-addr.arpa
    IN PTR
    a96-17-178-194deploystaticakamaitechnologiescom
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    30.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    30.243.111.52.in-addr.arpa
    IN PTR
  • 103.224.182.217:80
    cdpuvbhfzz.com
    http
    IEXPLORE.EXE
    334 B
     365 B
     7
    3

    HTTP Response

    408
  • 103.224.182.217:80
    http://cdpuvbhfzz.com/dl/adv598.php
    http
    IEXPLORE.EXE
    602 B
     475 B
     7
    4

    HTTP Request

    GET http://cdpuvbhfzz.com/dl/adv598.php

    HTTP Response

    302
  • 76.223.26.96:80
    http://ww38.cdpuvbhfzz.com/dl/adv598.php
    http
    IEXPLORE.EXE
    509 B
     464 B
     5
    4

    HTTP Request

    GET http://ww38.cdpuvbhfzz.com/dl/adv598.php

    HTTP Response

    504
  • 76.223.26.96:80
    ww38.cdpuvbhfzz.com
    IEXPLORE.EXE
    190 B
     132 B
     4
    3
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
     8.3kB
     15
    14
  • 8.8.8.8:53
    cdpuvbhfzz.com
    dns
    IEXPLORE.EXE
    120 B
     76 B
     2
    1

    DNS Request

    cdpuvbhfzz.com

    DNS Request

    cdpuvbhfzz.com

    DNS Response

    103.224.182.217

  • 8.8.8.8:53
    83.177.190.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    83.177.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    180.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    180.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    ww38.cdpuvbhfzz.com
    dns
    IEXPLORE.EXE
    65 B
     133 B
     1
    1

    DNS Request

    ww38.cdpuvbhfzz.com

    DNS Response

    76.223.26.96
    13.248.148.254

  • 8.8.8.8:53
    241.154.82.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    241.154.82.20.in-addr.arpa

  • 8.8.8.8:53
    217.182.224.103.in-addr.arpa
    dns
    74 B
     108 B
     1
    1

    DNS Request

    217.182.224.103.in-addr.arpa

  • 8.8.8.8:53
    205.47.74.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    205.47.74.20.in-addr.arpa

  • 8.8.8.8:53
    96.26.223.76.in-addr.arpa
    dns
    71 B
     127 B
     1
    1

    DNS Request

    96.26.223.76.in-addr.arpa

  • 8.8.8.8:53
    41.110.16.96.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    41.110.16.96.in-addr.arpa

  • 8.8.8.8:53
    157.123.68.40.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    157.123.68.40.in-addr.arpa

  • 8.8.8.8:53
    161.19.199.152.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    161.19.199.152.in-addr.arpa

  • 8.8.8.8:53
    198.187.3.20.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    198.187.3.20.in-addr.arpa

  • 8.8.8.8:53
    18.134.221.88.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    18.134.221.88.in-addr.arpa

  • 8.8.8.8:53
    194.178.17.96.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    194.178.17.96.in-addr.arpa

  • 8.8.8.8:53
    30.243.111.52.in-addr.arpa
    dns
    144 B
     158 B
     2
    1

    DNS Request

    30.243.111.52.in-addr.arpa

    DNS Request

    30.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verD8FB.tmp
    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\R977VUU4\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.