Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
3Static
static
1shop8/电�...��.url
windows7-x64
1shop8/电�...��.url
windows10-2004-x64
1shop8/电�...ay.vbs
windows7-x64
1shop8/电�...ay.vbs
windows10-2004-x64
1shop8/电�...de.vbs
windows7-x64
1shop8/电�...de.vbs
windows10-2004-x64
1shop8/电�...D5.vbs
windows7-x64
1shop8/电�...D5.vbs
windows10-2004-x64
1shop8/电�...at.vbs
windows7-x64
1shop8/电�...at.vbs
windows10-2004-x64
1shop8/电�...op.vbs
windows7-x64
1shop8/电�...op.vbs
windows10-2004-x64
1shop8/电�...ct.vbs
windows7-x64
1shop8/电�...ct.vbs
windows10-2004-x64
1shop8/电�...to.vbs
windows7-x64
1shop8/电�...to.vbs
windows10-2004-x64
1shop8/电�...ct.vbs
windows7-x64
1shop8/电�...ct.vbs
windows10-2004-x64
1shop8/电�...de.vbs
windows7-x64
1shop8/电�...de.vbs
windows10-2004-x64
1shop8/电�...ct.vbs
windows7-x64
1shop8/电�...ct.vbs
windows10-2004-x64
1shop8/电�...IP.vbs
windows7-x64
1shop8/电�...IP.vbs
windows10-2004-x64
1shop8/电�...er.asp
windows7-x64
3shop8/电�...er.asp
windows10-2004-x64
3shop8/电�...2.html
windows7-x64
1shop8/电�...2.html
windows10-2004-x64
1shop8/电�...AD.vbs
windows7-x64
1shop8/电�...AD.vbs
windows10-2004-x64
1shop8/电�...QQ.vbs
windows7-x64
1shop8/电�...QQ.vbs
windows10-2004-x64
1Analysis
-
max time kernel
189s -
max time network
594s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:13
Static task
static1
Behavioral task
behavioral1
Sample
shop8/电子商务购物网站管理系统/源码之家.url
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
shop8/电子商务购物网站管理系统/源码之家.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/Alipay.vbs
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/Alipay.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/Code.vbs
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/Code.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/MD5.vbs
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/MD5.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/TimesCat.vbs
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/TimesCat.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/TimesShop.vbs
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/TimesShop.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/TimesSubject.vbs
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/TimesSubject.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/addto.vbs
Resource
win7-20231215-en
Behavioral task
behavioral16
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/addto.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/AddSbuject.vbs
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/AddSbuject.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral19
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/Code.vbs
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/Code.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/EditSbuject.vbs
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/EditSbuject.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral23
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/LockIP.vbs
Resource
win7-20231215-en
Behavioral task
behavioral24
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/LockIP.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/PayHacker.asp
Resource
win7-20231129-en
Behavioral task
behavioral26
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/PayHacker.asp
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/SbujectStep2.html
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/SbujectStep2.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral29
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/TimesAD.vbs
Resource
win7-20231215-en
Behavioral task
behavioral30
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/TimesAD.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral31
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/TimesQQ.vbs
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/TimesQQ.vbs
Resource
win10v2004-20231215-en
General
-
Target
shop8/电子商务购物网站管理系统/电子商务购物网站管理系统SQL版/admin/SbujectStep2.html
-
Size
2KB
-
MD5
748d620425f3d13d2180238531045377
-
SHA1
e118e63f879ff7eaa6ca2a0aa2f4b0f8ccd6dd25
-
SHA256
7beee418280f92f4e7a2e9c2d7a5f7bb79acf91830e4f360e3fbe967f713b094
-
SHA512
a043610b2150f8cd5b1e44e75832495ecd92713173aa46a4aaef4969b4a626b9bd2d20087a1a76de271fe773db3e0b00a7bb506bbd53cba6871edd1bcbfaab83
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "279573970" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "411174313" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080290" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31080290" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 201f5c37623fda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad0000000002000000000010660000000100002000000002d728af8b912c0a98ee1ceae4b6c4b8989bb5e9eea4827cb0a5effec381cfdf000000000e8000000002000020000000caa025d150d6e61fd028bc53c091dd6bf2e4914511aec5b9c9d668cc73ea1a1e2000000067097b1865163e5701721489474b71cc07bd418afbfc63ce9bd0130197982d4640000000440ddab5000c7012007eacce94176c88feabef0ac01754c8f401c5a1aca7a124ca56db757085c4ec7333be021b56b73969e3c370f7f01e0e767920195517ae60 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{3B43AFF1-AB55-11EE-B7F4-C6E29C351F1E} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "279573970" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31080290" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "429418364" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31080290" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d228e40a7820b94dbd5c7b6846f2f5ad00000000020000000000106600000001000020000000e20a43a68218cb63cd383797c2f7d5d3401a56aa20d077cb3449d06a03b68e03000000000e80000000020000200000002a5e8f9c766f500fc6967ed498a054756a08197a7584f008994ce2f39e4f1de32000000081c008d224e778df297198d62e651db4699936830753f25cf6e870610f5c352a4000000097cf63dbb9d811e79ee3b2293635296dea1bdf1504f03358ed6a6973cdd5291ea7ead5866a23eb9ceb2b0fea10d48bb90406a1e800f4b4afa8451058a80494df iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "429418364" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80b0cd38623fda01 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1424 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1424 iexplore.exe 1424 iexplore.exe 652 IEXPLORE.EXE 652 IEXPLORE.EXE 652 IEXPLORE.EXE 652 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1424 wrote to memory of 652 1424 iexplore.exe 85 PID 1424 wrote to memory of 652 1424 iexplore.exe 85 PID 1424 wrote to memory of 652 1424 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\shop8\电子商务购物网站管理系统\电子商务购物网站管理系统SQL版\admin\SbujectStep2.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1424 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee