Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
3d9ea6b1e72f9aecec98e137b003c327.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3d9ea6b1e72f9aecec98e137b003c327.html
Resource
win10v2004-20231215-en
General
-
Target
3d9ea6b1e72f9aecec98e137b003c327.html
-
Size
19KB
-
MD5
3d9ea6b1e72f9aecec98e137b003c327
-
SHA1
56be18c6d5e0a6489430aaf12398eb21e924f362
-
SHA256
61b783d38da25ace60d0b4b17157f4e3b4bca3762b8fe3923334d9536e45c0d0
-
SHA512
51cefab495c1f4bd7ac8599137b6e914db2d753442468169ed9b7b2da074fd51938a1f6dc9bed80d84229b5c0fcd2b168edf08004157f38fa17418810ac9afc8
-
SSDEEP
384:4+QfPFd9QZBC7mOdMUItKfpC5IgSnbmFe7AcDa6GLLAPd:Zcd9QZBC7mOdMUxpC5I9nC4vPd
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DOMStorage\website.ws IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\website.ws\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079652" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410900385" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\website.ws IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1359043656" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ec156be43cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1344563082" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31079652" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7AFC7F5F-A8D7-11EE-9BE3-4EA1437444E8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee00000000020000000000106600000001000020000000da081f51b2b27a250af27b64b3aa80293572fea3d7a5790175c51e687b18ff0e000000000e80000000020000200000006db1b837a0edebbcebc312ab101db31b46d968fc24ce6e247e88afaad6b5643320000000dd2f286dfce5be796e5c02bf00239ec48d442ab5c632c7b332c2f76b27eda4bf40000000b315b5d03cdbb327e80634b39fd1f77543a38543d8f44a0ee1e8460b9e858b07b0e1c8060ac2f61426491ecc9b80c487188070a877c2dbdc54a3cf766bf15a5d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805e7766e43cda01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000056c0f093da428f4099809f3dbcc1bfee000000000200000000001066000000010000200000000862e0bdb3b59e0a2262143b82f76706f3ba086b549e4879be9674ad33a171c6000000000e80000000020000200000003e3c9203400f9da585ab3e9a086cc2715e6295598eb60d14cb3701931fd1a6d12000000018d93baab63fa3bedf1bd20d990f352971fea1d062c81eae1aa2c681042021f440000000c2e5c1003a3a6e0df4233b2bb9101cffded1d1133dd2af010d51f602562b501b3af7050f7c26c943f2b30a41683b3474d70be5cccbdc8c4a10983883626d4df6 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31079652" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1344563082" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2800 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2800 iexplore.exe 2800 iexplore.exe 1628 IEXPLORE.EXE 1628 IEXPLORE.EXE 1628 IEXPLORE.EXE 1628 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2800 wrote to memory of 1628 2800 iexplore.exe 88 PID 2800 wrote to memory of 1628 2800 iexplore.exe 88 PID 2800 wrote to memory of 1628 2800 iexplore.exe 88
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3d9ea6b1e72f9aecec98e137b003c327.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2800 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52f6bc0a2cc0fbef23205e2f861dd30b9
SHA196ca1432c0e4a75b01cdee4b887985ec664d4424
SHA25696b017f53290701d77bf264a9e3e07800988da6512ddbab51cde2eb8f05b4331
SHA51203b3d976ebc5a0120a020fef9743666ad2a8e6000b29e5734e57e8faf9959815f1f9c3a9e91605337160b64866e1e5822ae882d2dc3ac1d702d0c89b89eb1dbf
-
Filesize
3KB
MD561e2a760dc00df1902b71fb2c476f080
SHA18b8be8ee045c78a8309089e4ed72c46b635d5852
SHA2565ab20bf6ee7f7ba9688e7e5e4aef4804ec97734e2345df45dae48490e7dd0a58
SHA512fa3e17d56957df605b492ebf33b175de40f9caddb46acfd205af9caed0984eb455d89fe39667dda3f8364e43f2d9b9405f5c0d76173f5ae286a9185f92c52389
-
Filesize
16KB
MD57bc46cd787fd2b6d3336e056301d4b84
SHA160062992ac61926ac3e1604b7f89cc373639c66a
SHA2567fe32e1f272b3c300aca9d573ab228d87c605b4a705369d3c459523c52c9428d
SHA51237ae02c8da88d3ff585d85035162f4e927cf1ed4d77d6b83264abc12a94af5b484095f2f46e9f3a6ef80436593ab482646b80479bebb8e782667eb86e98d3397
-
Filesize
42KB
MD5e57c81f3a17073a78a7c3c865f74f89a
SHA1587d7c955432f1e5a87460ecbf9086ae2589346f
SHA256e36f1f796e538f826beb42510edc0354133c61c7f711b827def7f91d3f7c8bda
SHA512630aa9dba2aee1125103954b093af8b24907d98761e1a9b93fb6f6c43abfec3afdf53825e3f12fc3cf87fa14855daadfdbc90b1e49b503fb2917599dd77daf52
-
Filesize
20KB
MD5301d51da906e6cd41dea529d764dc504
SHA115dc16d366325aea102fa46c11edf04ea83a0283
SHA256d49065ed2e4f7cb5eafab0fb03611563146102e514a5946bfcf08de6db58b85b
SHA5126d50fea1d52b5bf19d1c758465d054dd3b0f03dbd754c29177e7f7248c275dfea2f61368857b54da914187966539f2eb5dead4308dcc331980fc26ca42255ca1
-
Filesize
17KB
MD555a0d8277a94894a8b40f72717adf869
SHA184ec2afd66e38aeaab8988fb18787e32ac6e3bb0
SHA256f8bf624dd3d3247c58ddf95b43c5bbce5c12404158d466ff8235af41e595f29c
SHA512152d99198ebf5e5ab18de1bd1ffb804912934a8fede44826a08c4b7b30e17be222acdb406e8e005819f1e40a4e2d63c91a01a19e672c309c74f2ce19b09efb3c
-
Filesize
17KB
MD5461958e1e515e8e0f372e73b4c819d53
SHA13745471542e7992dd2f5d85b2948da66845ade37
SHA256186707c7ae0d45cba1490a5556f59fc371f6ab88cc16c452fef8b70072cb5e54
SHA512734f8cde6780c2deeb1f23b21097fc381193ef0c3492d16b411984bacaf807b2799e340d254e8371ecbb73b104d29ee8a46448e26e0ef14b26460ebdde100d50
-
Filesize
650B
MD5ea5a5798612df63ab0532174aaf62634
SHA10f4713eef39ab07510d3703ef201885475ef0b42
SHA256ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31
SHA5128cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907
-
Filesize
841B
MD5e7afdc59ac3db2e735bca0105b3fcd6d
SHA115b9055b555854c519549aa4c01dca887191d945
SHA2568376faa9ea3b31a84f476ab14bdcd9110051f2e74f99d8a5459658d48a5e8cda
SHA5126f4dfbec2348bf4bfcce6f9282b227d92d905448aacfdce547a8bcd952eae2de820ce61a0b4fef85f8590512d455cfc20e315bb88b6528f28d618b9558643405
-
Filesize
18KB
MD513df51261863c362f5069d24f9d3cbab
SHA13a6a8948514aac9ae6528e22955ec047d9c2eb32
SHA256fd7e31503e9caff128415b2745022938ba6ccb929e1f494fd1b8d7777793cb7e
SHA512d48f2f33e6ac4801614049f7d9009ad18d58134b3fb8974c4cf6fe109ea82949407e2b0a4ed488426aa117a501f71ac1c6ed19941e5cc098a9058fe2e965c267
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
2KB
MD5cb546f0ce2ca2505cbc9088d8a4592e5
SHA1d87b70b1a34f4313d085de80da3aa4e8845af904
SHA2560c3851f8f6d7b9dc63645a68b0db991edc9162620b9d757684a4a20206c458fb
SHA512b6fcd078f43082daf299a49646280ac3a30b91d10dcfaf8e9fb9e8317af417e34d45ae7397af9507d4101b7bcc58169c2f64adcaa253fc08204b98020b20b551
-
Filesize
4KB
MD5f784a2dfd0ed53c79fbd8fa1b659c148
SHA1208dbaddda3ad773a79c37190be7271534cd5632
SHA25606b38ee5447491fe18209a2daf425004d6ba4155821bd4873ca31ba7b1145544
SHA51253414e72f3c1645fe4ab558f750302273356f73d245a0447ad709757674c182efa5dbabb0e7d690bc2c169291088d700d506a6a6cd2d6f36ab6e942b618e2d88
-
Filesize
113KB
MD511af30548d129f207d171711eca973b6
SHA154e9ce151fccba2ab2bae5aae06e694f05382631
SHA256c457764ac4f7ae60acf301cf441b93fc3ee07c22a5409b26818b79e57648f842
SHA5129c787860e8cebc27e906506c24895f0658c486b30c5b4ae43992064b3acc932594cf307a472aa4de7ef4a166d2ba489fca27da6ea130c98f8ec18d04a34dbfa7
-
Filesize
11KB
MD5431e020ed3f165c36b9c455c1abdfe03
SHA18ce16c47d4ff3bf17e1440701e001ccae77c6013
SHA25620b74f32cbe2437ec79c1607092220b9c050fc28daa6d70875e0c926c56dfa6a
SHA512749824d25ca49b010a4f42837cb9f9a4157163b76aa30d67a47457e271a3936e300420d0478ead894b1af4ef166edc6ea65d137da88f1291ea73a5efd6938fc0