Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/12/2023, 04:26
Static task
static1
Behavioral task
behavioral1
Sample
639b7bf00b6141af10ca737861c05908.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
639b7bf00b6141af10ca737861c05908.html
Resource
win10v2004-20231215-en
General
-
Target
639b7bf00b6141af10ca737861c05908.html
-
Size
842B
-
MD5
639b7bf00b6141af10ca737861c05908
-
SHA1
255281c2c07a040dc5fbc6fc979a3aee02e08506
-
SHA256
38ce412d35c9122054c31450616f68547b80e0323855d9f8c5135945bb05a713
-
SHA512
22c223efd73ebe4686c9bb7d3486468b6df94a2ac3b53aea6a57f3c956ad62cb8b30f7338a97dbbd4c2a574453b064334eacd60830d99dab9624c74149f39c4e
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{F868A5F9-A09F-11EE-9ECD-7AA08ABF42A0} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 736 iexplore.exe 736 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 736 wrote to memory of 3908 736 iexplore.exe 16 PID 736 wrote to memory of 3908 736 iexplore.exe 16 PID 736 wrote to memory of 3908 736 iexplore.exe 16
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\639b7bf00b6141af10ca737861c05908.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:736 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:736 CREDAT:17410 /prefetch:22⤵PID:3908
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c6bdda3f990d9f4af799c6780b8859b4
SHA1a621164f6b814af5e867c84e7b014695c850fc7e
SHA256bf1d3d4bd2bfaf7e1c3ecda4669a16a68da4c2780c49c60b09d3fbc13a1633dc
SHA512955019d37611587f11831068a20a8b7f2a51838d6c11d02c822aa752fc056ba1336ce2d8f1e7d338fee9b3c9b11889ab8c615a1f60183f27cb060b3976033443