Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 13:08
Static task
static1
Behavioral task
behavioral1
Sample
209e4d0587ca0dd12bdd61bae3f84d87.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
209e4d0587ca0dd12bdd61bae3f84d87.exe
Resource
win10v2004-20231222-en
General
-
Target
209e4d0587ca0dd12bdd61bae3f84d87.exe
-
Size
56KB
-
MD5
209e4d0587ca0dd12bdd61bae3f84d87
-
SHA1
31ada5ee435b781061d6d065b2d4ec60e6807f90
-
SHA256
b964009584f24112b67af871333acda4e7652bb463a68df16b64564e78b5abf8
-
SHA512
e958f3b3d31577ab2a5dc9cbae38d5ebd9b10c4c5c2f07e978ccb925fc9f739528efc311bb28b766bc2c75ed53e594433b53675745df3f0b0c46dbc38700ed69
-
SSDEEP
768:Cs8ppOCMSnt4nOiucrM7xSAsgyqvPIGXMSBjX9tUivGXXsFJjhYQ:CnR2OIy4uytC7OkP
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{384FC485-A564-11EE-A0B6-766E2D171A79} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2496 IEXPLORE.EXE 2496 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1572 wrote to memory of 1116 1572 209e4d0587ca0dd12bdd61bae3f84d87.exe 21 PID 1572 wrote to memory of 1116 1572 209e4d0587ca0dd12bdd61bae3f84d87.exe 21 PID 1572 wrote to memory of 1116 1572 209e4d0587ca0dd12bdd61bae3f84d87.exe 21 PID 1116 wrote to memory of 2496 1116 iexplore.exe 23 PID 1116 wrote to memory of 2496 1116 iexplore.exe 23 PID 2496 wrote to memory of 1800 2496 IEXPLORE.EXE 25 PID 2496 wrote to memory of 1800 2496 IEXPLORE.EXE 25 PID 2496 wrote to memory of 1800 2496 IEXPLORE.EXE 25
Processes
-
C:\Users\Admin\AppData\Local\Temp\209e4d0587ca0dd12bdd61bae3f84d87.exe"C:\Users\Admin\AppData\Local\Temp\209e4d0587ca0dd12bdd61bae3f84d87.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2496 CREDAT:17410 /prefetch:24⤵PID:1800
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d
-
Filesize
1KB
MD5c6bdda3f990d9f4af799c6780b8859b4
SHA1a621164f6b814af5e867c84e7b014695c850fc7e
SHA256bf1d3d4bd2bfaf7e1c3ecda4669a16a68da4c2780c49c60b09d3fbc13a1633dc
SHA512955019d37611587f11831068a20a8b7f2a51838d6c11d02c822aa752fc056ba1336ce2d8f1e7d338fee9b3c9b11889ab8c615a1f60183f27cb060b3976033443