Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1taoaisi/Conn.vbs
windows7-x64
1taoaisi/Conn.vbs
windows10-2004-x64
1taoaisi/ad...ut.htm
windows7-x64
1taoaisi/ad...ut.htm
windows10-2004-x64
1taoaisi/ad...ot.htm
windows7-x64
1taoaisi/ad...ot.htm
windows10-2004-x64
1taoaisi/ad...ce.htm
windows7-x64
1taoaisi/ad...ce.htm
windows10-2004-x64
1taoaisi/ad...ce.htm
windows7-x64
1taoaisi/ad...ce.htm
windows10-2004-x64
1taoaisi/ad...wf.htm
windows7-x64
1taoaisi/ad...wf.htm
windows10-2004-x64
1taoaisi/ad...dit.js
windows7-x64
1taoaisi/ad...dit.js
windows10-2004-x64
1taoaisi/ad...up.vbs
windows7-x64
1taoaisi/ad...up.vbs
windows10-2004-x64
1taoaisi/ad...ss.vbs
windows7-x64
1taoaisi/ad...ss.vbs
windows10-2004-x64
1taoaisi/ad...nn.vbs
windows7-x64
1taoaisi/ad...nn.vbs
windows10-2004-x64
1taoaisi/ad...es.vbs
windows7-x64
1taoaisi/ad...es.vbs
windows10-2004-x64
1taoaisi/ad...ex.asp
windows7-x64
3taoaisi/ad...ex.asp
windows10-2004-x64
3taoaisi/ad...tch.js
windows7-x64
1taoaisi/ad...tch.js
windows10-2004-x64
1taoaisi/ad...n.html
windows7-x64
1taoaisi/ad...n.html
windows10-2004-x64
1taoaisi/ad...ut.vbs
windows7-x64
1taoaisi/ad...ut.vbs
windows10-2004-x64
1taoaisi/ad...02.vbs
windows7-x64
1taoaisi/ad...02.vbs
windows10-2004-x64
1Analysis
-
max time kernel
117s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 12:25
Static task
static1
Behavioral task
behavioral1
Sample
taoaisi/Conn.vbs
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
taoaisi/Conn.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
taoaisi/admin/SDEdit/HtmPop/about.htm
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
taoaisi/admin/SDEdit/HtmPop/about.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
taoaisi/admin/SDEdit/HtmPop/emot.htm
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
taoaisi/admin/SDEdit/HtmPop/emot.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
taoaisi/admin/SDEdit/HtmPop/face.htm
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
taoaisi/admin/SDEdit/HtmPop/face.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
taoaisi/admin/SDEdit/HtmPop/replace.htm
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
taoaisi/admin/SDEdit/HtmPop/replace.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
taoaisi/admin/SDEdit/HtmPop/swf.htm
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
taoaisi/admin/SDEdit/HtmPop/swf.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
taoaisi/admin/SDEdit/SDEdit.js
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
taoaisi/admin/SDEdit/SDEdit.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
taoaisi/admin/SDEdit/sdup.vbs
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
taoaisi/admin/SDEdit/sdup.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
taoaisi/admin/add_download_pass.vbs
Resource
win7-20231215-en
Behavioral task
behavioral18
Sample
taoaisi/admin/add_download_pass.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
taoaisi/admin/conn.vbs
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
taoaisi/admin/conn.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
taoaisi/admin/cookies.vbs
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
taoaisi/admin/cookies.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
taoaisi/admin/index.asp
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
taoaisi/admin/index.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
taoaisi/admin/js/menuswitch.js
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
taoaisi/admin/js/menuswitch.js
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
taoaisi/admin/sd_Down.html
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
taoaisi/admin/sd_Down.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
taoaisi/admin/sd_about.vbs
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
taoaisi/admin/sd_about.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral31
Sample
taoaisi/admin/sd_about_02.vbs
Resource
win7-20231215-en
Behavioral task
behavioral32
Sample
taoaisi/admin/sd_about_02.vbs
Resource
win10v2004-20231215-en
General
-
Target
taoaisi/admin/SDEdit/HtmPop/face.htm
-
Size
2KB
-
MD5
3f1d336f7c1379c0fccd8af9cafcc15b
-
SHA1
09f1c02e1b3a340071a65499690fc0bbc4bc511d
-
SHA256
5066a47e9ca0b21c980c42a603667d30dbcc0695fc9b42575a9482086e2d0509
-
SHA512
928b5ed169cbbbed85b36c57c3f24cbe860139b5b7f2b20b8b82a31f049fac320cf7345751782b853942e8b7f262cabfce4f8e4d1361cbd95662e9851f10ee84
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000ac9114279809fb43b5ccbf7fe4becbcafe2fb1741ea07966a7fa3d5e10070dd8000000000e80000000020000200000004401b8cd70d2e20de0041f2115ef22e8f2f3e47dfd0d30191bd0c6da99bd7a86200000000940c729a7fa19261e62485a7bfd480149d046d4fe8154254f91de335084378440000000e239d88158931e54e95193b8f24b926ed93cbd473db539e1283827c5a9c8f54410a4d63869c9ae33e8209e784b8ecdb13155988a9643bd8542c53c8e6f5dd321 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000566b58630fb3a044b91770fce5e9b2d600000000020000000000106600000001000020000000b85b5fb35d08ac7a82e6325b47104883fdbe8c9cd0a1caa1f4ac4e22d6fb0581000000000e800000000200002000000072b281cf67f2c9963a1a0ffb34445bd257d184376fe685e31ec2a67b60ae41ff9000000079ab77041b6413301198c233a312931c36ab955c8332f7d0db29110473c5613ec0b6048823a353e3eee3ea3f424c43b72bbcaffa43c22f4dd804b3257f58afb0876ef5be03473342c47a0af9e409b73ed29d8c7dd7710173126f26eefc747f0675c57be956f2063a831c924e8c88a6eac8765718e00f21a67a5c87c3c1fa347bfc102be95dbcf50ef4f3688f54e2119f40000000f257e7a8815eee6e158a2066ad23396a93409f020118cbb56f63bdf0f0d1f41ea735ac9234eaab8e00a08a90f2df79833c9f4a5f1ce571e39c1b6ec7916bce5d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410442326" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3A838941-AA29-11EE-9A90-DECE4B73D784} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0251c0f363eda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2512 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2512 iexplore.exe 2512 iexplore.exe 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE 1608 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2512 wrote to memory of 1608 2512 iexplore.exe 28 PID 2512 wrote to memory of 1608 2512 iexplore.exe 28 PID 2512 wrote to memory of 1608 2512 iexplore.exe 28 PID 2512 wrote to memory of 1608 2512 iexplore.exe 28
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\taoaisi\admin\SDEdit\HtmPop\face.htm1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2512 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1608
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5587965625a5d2ff0ec7224b228e24a45
SHA134cf14d44127970cd9f1193b751fc028f135a9b0
SHA256462b9f9f92a1f56f116450efc80464ba0b643920c1f2240eae9118ce925236e1
SHA5124eded956336c33c2b356db996aff42b9b896ccb043fbaaca337f53296fb53cbc133924a5579f8aea8b99b99cf911d6f964c807beb156aee6748cc715e013ac4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5862a093e833127930b9e23952afcb1c5
SHA13e9a04ca32087bb83ad12c69626ab5dc3977ed40
SHA256e7b9405a0fde4f54fe43952e05ca87105c3b6a5d8093e863f519ce0bd2a1367a
SHA512b15c6d798c1ce03798ee61da2c90acf4f088e159a536275b5c533d4f6ed52ebde16873e35cdd33f4a4ad4815a4fe685006b20d02f3cae122e39f34fe2b9d48f3
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51aa8d3a7d4152e3733ef44cfd65a18d1
SHA131d5fa056046440d3916584720549254611b5d54
SHA2562eb0ac9ef3ff3922095b8d0d6e99c979e84e246ab31b367b2ee9fc47e70d3f4a
SHA5123b646c461f644a7f97a4a07db96c90e53e2f5aee434341313b87f72878f7c43f87eeb9a51d20bda3459e652acc7e3c22acfc5717d8f8aa9affa5a7f3a0170bbd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5daa7371d8ae8cf4407a8803286411d5f
SHA15742e89e7168ebeaa6a712256ec711af8a6f292a
SHA2564e8e1a9b7bb0e8d54c742e18e2c18ca3c152d6a41ac01b8af303046c965ea1fe
SHA512428445381fdaeaf1eb75d78882b495d0d45e57286d33d7f4dde43fcd7b2b3852afae552a102c9fb115a7a6987ba2df02e37002e298be5ce05d923e984a2fe68e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b8ccb0999b59b92f38ebee0d798386b5
SHA1c095af801f1d0753f72c34ee0e0b3a94096b69e9
SHA256e538fae332b85f656fcb792558e42b673b9082111cd92b47f69628de9e56678b
SHA51244993cbfdfb76fbf7d5ed8bda228a465b892823355fd7cbc2acec46a7093c35da2f0a668eb6f599b6478607cd6e4ef2802a1cce64209c07aa76ccff5af372f38
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ea40184b6d97fa8edf5d6a63cfe327b
SHA1234ca91b8f67dd1fdeba6e929d48ce81551f46f3
SHA2562584810dca92fdd4937d275428f36d4e93c2fd4bd6847815a96eda49a8b8221e
SHA5129b8e9f47b5433f61a9c95d330c27db77c045e5e3de7ed5036238686b9ca1b8682680cd5df3e1dfd730613b9fccd3851d52e5bb01aff2c4c17f8792eb2c116d2f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD579f975f2e5689974fdbf049707ddf3d6
SHA110dde812fcf91d930e5e81dff3df1c1cff1d1e51
SHA256f17253b43a40b7710376062bf4ec8fa64ed7e9eba714900b0fd7a6361aad90b4
SHA5121e9321114109c032807614ad584698d623dcc7b697e4cb74a88e5ec206bcefe61066ff6fbbd573b960343bac5333ec4e59289cb99ee99db980eec9a628893996
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06