Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
172s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2022, 06:36
Static task
static1
Behavioral task
behavioral1
Sample
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html
Resource
win10v2004-20221111-en
General
-
Target
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html
-
Size
42KB
-
MD5
71ba35e1d99cda384dd16df1255946e8
-
SHA1
0c3e2c86e5499c65a70b376da2589aa4640b8fd0
-
SHA256
b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d
-
SHA512
d40660333d45f4ef40d5552533ca7b1dbf2d513a3f087e99d698f0d5a7144c387fd72206a9f3874e98d38b9eacd007fa23670b062c4dfb9d06726d264e4b420a
-
SSDEEP
768:bwi+B04Zyn3kbjF4rZ1EFLxNFdjNRqWdZx47eW7m17u7BlfFi:bEB04sn3kbjF4UFx30gV
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb00000000020000000000106600000001000020000000f0edde5178b0956849e8372105714305648b89bf8a6204c45401d7f79ef82b21000000000e8000000002000020000000a793a41e16d32661dc47ce9559dce4dfa538c5644702d58319a6bb9df28c63b0200000006b5c1e7455a3517a32ec32b0aefe48ead32edbd040fd581ae08ac7377f84ecf5400000008b20e190fcecee6bdfac27e78be1ff0a8783df270acfdc2c8adb8884b4c0e1b5bd1f88897d5239c17a6b0cf7194349c1f7f9b61266bf1185eea8bff167d90aeb iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000eef4ddb70fa9964f8bf69d510f57c1eb0000000002000000000010660000000100002000000082fe0d7dffb92fe87cf41400f5825352a73f7a3d2a99046edd50b551cc695d68000000000e8000000002000020000000b74434177fe8c3948354f21f356c7d3073b3152cb0d9b6bd7fc5570bd18e6a14200000007215df60f1bf9f90a5d771279c848bcf00bcd3f4450733011721718555f87d6c40000000571e2fd98f26cc4ff0340101e99219d53d7e8af3c7f81c9c120d2b1c79f8ff31be14efac159d07e6e3ffcfff12155ae1a685e31887ee5df854d5719e4d429725 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{890549BF-6BEE-11ED-BF5F-66CD4AA2E676} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 8051b363fbffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20a40a65fbffd801 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3008 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3008 iexplore.exe 3008 iexplore.exe 452 IEXPLORE.EXE 452 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3008 wrote to memory of 452 3008 iexplore.exe 85 PID 3008 wrote to memory of 452 3008 iexplore.exe 85 PID 3008 wrote to memory of 452 3008 iexplore.exe 85
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b09d3658aba7bc982f710da3d8d4a3eb99cbd565f92d83bd71a44c0c6f58a38d.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3008 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:452
-