Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
1221e40ffe08f9a4e823012fbc038bcd.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
1221e40ffe08f9a4e823012fbc038bcd.html
Resource
win10v2004-20231215-en
General
-
Target
1221e40ffe08f9a4e823012fbc038bcd.html
-
Size
430B
-
MD5
1221e40ffe08f9a4e823012fbc038bcd
-
SHA1
aa40bda2fd47550b7f429937047b5450bccfddaa
-
SHA256
7b7bf594aaa7130ceacf9f8cb3d644e60481b9d082b67646928c470ac0503781
-
SHA512
b442c548369c02c444b8c538d4fa493fda751c3deaf38420cba7f1492198f5ead46c6f5523e228ab3e3c40b639a757731b0f440cb5faa9820099c486f3befb87
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0CEE0171-A2CB-11EE-BB4F-F68B0B0A1028} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 964 iexplore.exe 964 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 964 wrote to memory of 2072 964 iexplore.exe 21 PID 964 wrote to memory of 2072 964 iexplore.exe 21 PID 964 wrote to memory of 2072 964 iexplore.exe 21
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1221e40ffe08f9a4e823012fbc038bcd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:964 CREDAT:17410 /prefetch:22⤵PID:2072
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD598ce835900f6e83ca21d93be9c85d710
SHA1e39d737a4dda09a99498c658186c2660ddc27cbd
SHA2565f0ad38eeb2cc27c340d52d6d94c46989deb78387c9844a4403694b5ebc24365
SHA512fc51d9078d8e3f6b0a033662bf1aabc24c7906a9051fcbd98e723c4b7539ec747b85dcc9ca821ae554da7e089023f316fe26a86839277e6330e9eb9d02237f9d
-
Filesize
5KB
MD59c81d346f860dadbcb4bbac6b7fa2db9
SHA10971f091b45b902d3ae75d1cb2ee7d2190d553ec
SHA2565e606f08c3aafeda778b2039878d5133a4142de3b5aecb9c462bf7d6e10396ee
SHA512c75a6292a4db65b5f2c7e28a8535261f4dec70f1bd62f1bd78a3c98facc17ea606a0a9004e4a9b0fe53db7d6f2fc67143626647c09204b90e4017269266a8856
-
Filesize
3KB
MD5a75c230f34b9296e6fdd8b0b855df5d8
SHA1e0b9e32053d44532fb4e8bb55b54c3211965517b
SHA2568adba20b1dd9747ec8ac6ed5a26a8dfbfc7ab82213d8051b76ac771c76b87920
SHA512950b94afc397ac760f38f4c68691bda6b541832e1d23f496e36568def2b9f9dcb6984c6a42ff6b5abef0e19b76c37e40baab22e9dcc9360091b609333029b24c
-
Filesize
1KB
MD591abe01116ab422c598e9c8af72cf4da
SHA10f2815fe8e067d48537ad168225ab4674271fa27
SHA256b1d7aef06456fe7431124129a28f0138bb5fccfa4f4161e3087de23c005e5edc
SHA512a4d5b20c3014153b6b382c43404917bd2cb5bd2a59bb1e981f5a19eb7dbdec185ace288e9700428d24e5ac623e45d04905e706f0c45a1642b1aa6c091213c23c
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee