Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 21:53
Static task
static1
Behavioral task
behavioral1
Sample
13f13995d78c6c491e1557a0919481a5.hta
Resource
win7-20231129-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
13f13995d78c6c491e1557a0919481a5.hta
Resource
win10v2004-20231222-en
1 signatures
150 seconds
General
-
Target
13f13995d78c6c491e1557a0919481a5.hta
-
Size
11KB
-
MD5
13f13995d78c6c491e1557a0919481a5
-
SHA1
6b9f003341e53609934b09910fa8fca204187d35
-
SHA256
573e06b3f0deae39074880a5f7fb369d84468ec31610fddf32188b2fb722385f
-
SHA512
e821648925795be1bd656fb0fcf6686efb410189cda302bd66d345527c06f1965dc85dd6cba50ecfe293485accf3f63b333259e7c93579b1e4dfed9ca4df22b5
-
SSDEEP
192:Z4G4G4v4WCKuJD4B4B4B4B4S4B4B4a4S424r4y4pj2424N4Iv494z4h4h4h4C4Gk:Z9bKoIIIIXIIFr/evcqfiVv4EIIIbNIV
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1716 wrote to memory of 2976 1716 mshta.exe 19 PID 1716 wrote to memory of 2976 1716 mshta.exe 19 PID 1716 wrote to memory of 2976 1716 mshta.exe 19 PID 1716 wrote to memory of 2976 1716 mshta.exe 19 PID 1716 wrote to memory of 2976 1716 mshta.exe 19 PID 1716 wrote to memory of 2976 1716 mshta.exe 19 PID 1716 wrote to memory of 2976 1716 mshta.exe 19
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\13f13995d78c6c491e1557a0919481a5.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\ProgramData\qPaperFolio.dll,D2D1CreateFactory2⤵PID:2976
-