Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 23:40
Static task
static1
Behavioral task
behavioral1
Sample
1a4764570b9805fa22141fda4b14b093.html
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a4764570b9805fa22141fda4b14b093.html
Resource
win10v2004-20231215-en
3 signatures
150 seconds
General
-
Target
1a4764570b9805fa22141fda4b14b093.html
-
Size
94KB
-
MD5
1a4764570b9805fa22141fda4b14b093
-
SHA1
280709af7dec97cef9d6d1ec5ab11854aac187de
-
SHA256
f9f46e13770a7638e082e708316a6d9d4f4e7a27e791ca42b55c203098882f49
-
SHA512
b2d87340d348224ad87dde2b3b678e4e028bbfa623dad50a94ff42de4650aace0a47c6e5be05263c1ff123e6b0e405e5f7802af7f816896f438702a775e8d7c3
-
SSDEEP
1536:WosQ8PaLl9pV2sJIv72nAHRLnteGnv4OxEkntm8XOVwnM6tvHv4ZNdknMtvvQxUN:WosQ8PaLl9pV2sJIv72nAHFnttnv4O/W
Score
1/10
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{CD25FB64-A2F4-11EE-9ECD-76CF25FE979C} = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4960 iexplore.exe 4960 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4960 wrote to memory of 3480 4960 iexplore.exe 15 PID 4960 wrote to memory of 3480 4960 iexplore.exe 15 PID 4960 wrote to memory of 3480 4960 iexplore.exe 15
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1a4764570b9805fa22141fda4b14b093.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4960 CREDAT:17410 /prefetch:22⤵PID:3480
-