Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
71140d004c1...e8.apk
android-9-x86
11140d004c1...e8.apk
android-10-x64
1charts.html
windows7-x64
1charts.html
windows10-2004-x64
1echarts.js
windows7-x64
1echarts.js
windows10-2004-x64
1highcharts-3d.js
windows7-x64
1highcharts-3d.js
windows10-2004-x64
1highcharts.js
windows7-x64
1highcharts.js
windows10-2004-x64
1piecharts.html
windows7-x64
1piecharts.html
windows10-2004-x64
1Analysis
-
max time kernel
144s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07/10/2023, 23:36
Static task
static1
Behavioral task
behavioral1
Sample
1140d004c1d53d19cfda93589740628a5a409ceaafc4f44edccd96d1ee13aae8.apk
Resource
android-x86-arm-20230831-en
Behavioral task
behavioral2
Sample
1140d004c1d53d19cfda93589740628a5a409ceaafc4f44edccd96d1ee13aae8.apk
Resource
android-x64-20230831-en
Behavioral task
behavioral3
Sample
charts.html
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
charts.html
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
echarts.js
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
echarts.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
highcharts-3d.js
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
highcharts-3d.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
highcharts.js
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
highcharts.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
piecharts.html
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
piecharts.html
Resource
win10v2004-20230915-en
General
-
Target
charts.html
-
Size
2KB
-
MD5
4dd3d6c23b270f58a4e365a84a5fea16
-
SHA1
3ade4d6ea0d935296d2142d017cae5c73ab3d864
-
SHA256
36feb2344bedb91e76c25f72db09d811bdf39a1b49ced9bc1f7921ea42b6997e
-
SHA512
02dda39bb0d40b17d57a3c123e5972ec6df9bfa6aaea8d4ec0524a07839ad214d23954b3f7a694dea6bef296682492f1a0ddb30d27b5eab67dbdf6c56adf4aa5
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{AD2AFB4A-6573-11EE-9784-462F79703E28}.dat = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31062400" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2233355364" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31062400" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{AD2AFB48-6573-11EE-9784-462F79703E28} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2233355364" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4084 iexplore.exe 4084 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4084 wrote to memory of 3444 4084 iexplore.exe 87 PID 4084 wrote to memory of 3444 4084 iexplore.exe 87 PID 4084 wrote to memory of 3444 4084 iexplore.exe 87
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\charts.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4084 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
PID:3444
-