Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 18:22
Static task
static1
Behavioral task
behavioral1
Sample
sample.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
sample.html
Resource
win10v2004-20231215-en
General
-
Target
sample.html
-
Size
93KB
-
MD5
479bf6574cf1f9364d42a09b03971cc9
-
SHA1
6fb03193035f4615d3d8cfbd8f349f2d7f8c50a7
-
SHA256
53f0f99a4609d33665ad3ee55aa3a3b3f5ccde44d55a927ae9a06d0fe2be5ad8
-
SHA512
12ce03f0d35c54b9b17171f6ebda9b2a2445c39f149efe7ab48a9f4fe118ea7a63a154a0e9e6af05a9ad81e422fd255f47be2c9c201da5368d57a624d63c90a5
-
SSDEEP
768:W3Yu5gcDXDvdGtx3nC8lghdEYwCCKJrrdy3112kteiZtBlhNn/w+ieoCjqPlJU2+:Wou5S67xuF1n8uCldhOn
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "412367118" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c47f1af20644814589e7a32def35942f00000000020000000000106600000001000020000000112859523a0c9a49b5baa216050aa0a5c612a6f870e92d39a031d58e330b7db9000000000e80000000020000200000004f698d3634ad6bd8bebf7dcb693121724958ca8f61c10f68b86d0d10c55c60942000000000a2a4f93e2b25cbf35aa8668ee765548f5de3d08abbfa8c4f20af87b93e2c4c40000000e6dd9a90b4f4a951d607659a3e4f9049da759350f1a4e6cb47af37db0e1dfaef6b089dc5115cbd548b028a64c19ea07a370aad53b772bd8bc9008a1fd6e6bb4a iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "63" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "39" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "39" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "39" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{85F47C3C-B62E-11EE-9A4E-E6683C810C58} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f4f5633b4ada01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1517535878" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31083067" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "24" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31083067" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "24" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "63" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31083067" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1526754281" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c47f1af20644814589e7a32def35942f0000000002000000000010660000000100002000000088775b016fca8f9a7cd696bbf5c411a0e1e673cf3a2404fa7ce68204041d6d61000000000e800000000200002000000087ebc7d1d610791569ef53c4ac94814a86ac5eee4d76b22acd2cdc9e83192b9720000000b5e60d8c5829b717da78c43e74ff97f650b7bca86ff9cf2e6223801b00ff50b84000000067065a875e63364c564a0adba75673e3c50fe87e7207effed12eabce740e2438a68a65f4c710150d78c6f6137c10ea51fbc4ef7fcd8678f7129fb917ee5c809d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\International\CpMRU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp\ = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\i-mobile.co.jp\Total = "24" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Software\Microsoft\Internet Explorer\DOMStorage\spdmg-backend.i-mobile.co.jp IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1517535878" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00609643b4ada01 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 372 iexplore.exe 372 iexplore.exe 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE 1500 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 372 wrote to memory of 1500 372 iexplore.exe 81 PID 372 wrote to memory of 1500 372 iexplore.exe 81 PID 372 wrote to memory of 1500 372 iexplore.exe 81
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:372 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1500
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD503dd565decfc1149cd138e00e990ef7e
SHA17cb72be9f9ffd6e470f54f4e615b66f50106810e
SHA2567f6da74cb7284c990c17cb1f14eb3ff6bc45b7ef807bd220fc560cdafd1d8304
SHA512914eeeacb3d4e36ddc6856241d7d9ac9ccbf62d774a76dcda9fbdc72014443c52e855337856fe213bd1f55a05f57874fabd02532de3cbedb12ccb98d7f6ef330
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5910d0e648df143819b8eb884d29af866
SHA123eb9b17a0aed88ca613c6eb0df27184c12cc86d
SHA256b5b1cdf7067c740bb3065f8bd22c67f7fb4ddcf117b23492e42587449b86c411
SHA512cf4430313a6863d91ca23242584a2dc4d11ab6ab3b75eab7ef7c675fe8d93751235f1648ec8fcd8b151815b7ab443b7178bb9af63701232af1c7eb26fc0fb7e4
-
Filesize
154B
MD5cfbeaf604823f038b8b46f0ac862b98c
SHA17b9eb1dac48e74fa5f418bc456cb410f88b81d98
SHA25620c1ab602462b7fc0d5b4cbd555cacf127b69a07a737579598ebcbc0f5b21319
SHA512c99bf4f1351efb28a74fa2504429875d9a63eb2d6a145a060ed487f83ff3a42b6c85d94165b960edca90aceec58d16a6ed37b25f44452bbacd7f5204c15c23cc
-
Filesize
1KB
MD53a6ae88ca63a968fd7c014c982fa5731
SHA17769f4be128e863f2f14fd0a9b59d1c49dcc9023
SHA256b8666b6a7bda5ea0466128485e57eb867e069582c3709bde90ec39f88d467d0a
SHA512c2f1e6adc5c5e7f0e32327eddaf913abad088c398ab5dedb6e93be005b9a640cf65bf04ebf7e92ae0f725f51c40480fca1afc77beb6c871eb6ef5dbc73d0b2d4
-
Filesize
40KB
MD58708320ed6f30341854f267d40b6421a
SHA1b233e5ee5e844b83024a17854bb718d458a8f904
SHA25631d8a246b4ec27f114c453b9d4ef714538bc6e3b3c76b9f46d63a67950144930
SHA512078bb4558a9402720b1afc080ce427eca1d35c65214a3cb59cf1a3c12706378bc68137a76c4d7082f331ec7c0d9aea6cabcce8a3407b5c7e3ee602c740ccc556
-
Filesize
20KB
MD599b44c11698756e240c74c7f302345de
SHA13a9a6cbc3a10c3e9be9a900a977e341d0d786daf
SHA256afba8e7564c8117817ad655c9bef0c2ef4a248783837a70bf42c51dfdb7eb910
SHA512c8ebdbc1dc1eddd3dde9bc04503f6cc64a8036e5ecb4c9248f13d265f80b08b46705ed01fe3b37d19ba32de548eec8130b120bdb2d19e9b0a001ef5d5d5bfea3
-
Filesize
138B
MD5aff950cab4c0265e21d401db15f1026d
SHA1f03e18461817f7a6546c8bf8fa8d686d7e30aca0
SHA256753e0dd54f28c4f7009b9c0b18a68aed175416bd8b7d134858264586eaac56f0
SHA512a1f0f6f3dd6788a1d7c922c6a8fc81d4709dbd0bf28433023fb8fbd151f645daa096c6e9dd670fb7f86c1699942514a11c183aa09f0018142f823668fb2a0aa2
-
Filesize
51KB
MD5575b5480531da4d14e7453e2016fe0bc
SHA1e5c5f3134fe29e60b591c87ea85951f0aea36ee1
SHA256de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
SHA512174e48f4fb2a7e7a0be1e16564f9ed2d0bbcc8b4af18cb89ad49cf42b1c3894c8f8e29ce673bc5d9bc8552f88d1d47294ee0e216402566a3f446f04aca24857a
-
Filesize
5KB
MD5ae7cb309043502df5c9f24611919e5e3
SHA11bf98c35a7636dd040724e2aca206911166e67e6
SHA25697d6804c0aa265471fcc7117bf178829d14e5beb00f61e149f5f3624af0791cd
SHA5120b14994cfdeb2199d06ccbe4d1837327949f073b2b50359b4fb08e4b21e5ecbe54650e2954d2300aa77774379565de147c4a5233ec38531adf1557eeac2d1ff2
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee