Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
7s -
max time network
64s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
1a47393834255d8c7004f3a8edbb43b1.html
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a47393834255d8c7004f3a8edbb43b1.html
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
1a47393834255d8c7004f3a8edbb43b1.html
-
Size
6KB
-
MD5
1a47393834255d8c7004f3a8edbb43b1
-
SHA1
0df510f478b48a32392a744003aa7f8c030271c9
-
SHA256
e9b3239073461a6ba3df2ba769ec87390e74e841884e23f00d6de9dd8994d9d6
-
SHA512
86d1f91ce8056b2565f4dc51384c02d5f088db7833a1c0626ceb2dd0378d888dae53c4f81cc4b15d2b6c5511d077d3957b22f59ad53f8b58222f75049daf14fc
-
SSDEEP
96:uzVs+ux7kzLLY1k9o84d12ef7CSTUnLcEZ7ru7f:csz7kzAYS/Mb76f
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DE1CCBB1-A2F4-11EE-8024-4EA1437444E8} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3336304223-2978740688-3645194410-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3188 iexplore.exe 3188 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3188 wrote to memory of 4512 3188 iexplore.exe 57 PID 3188 wrote to memory of 4512 3188 iexplore.exe 57 PID 3188 wrote to memory of 4512 3188 iexplore.exe 57
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a47393834255d8c7004f3a8edbb43b1.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3188 CREDAT:17410 /prefetch:22⤵PID:4512
-