Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
29/12/2023, 20:53
Static task
static1
Behavioral task
behavioral1
Sample
03b6d455e0c3b154d2071730d1b9799c.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
03b6d455e0c3b154d2071730d1b9799c.html
Resource
win10v2004-20231222-en
General
-
Target
03b6d455e0c3b154d2071730d1b9799c.html
-
Size
100KB
-
MD5
03b6d455e0c3b154d2071730d1b9799c
-
SHA1
3020816728f5467b60bb725a5864793f97e0204d
-
SHA256
e80ab6a283c4e26a5a9416f11e7896d10f9030e7aec5e028829e36ef3ed1ff28
-
SHA512
74ebae8adc7d9cf1a1bcce02aed70632cc7af968168c8298930e33bdc8ae6caf3f85cf57580cc9aa1b7af546ec6b7ca7f0dc15fba598702c03f249fc7d588401
-
SSDEEP
3072:QfUnbf1Uaf8gXmUafyNRBUafef6UafarvvUafrtZ6UafmFmUafNdRuUafs6vUafN:KQNQtRTY3OZ
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E34E2DE9-A6A8-11EE-A0B6-FE6B1C63FCC4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4008 iexplore.exe 4008 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4008 wrote to memory of 1180 4008 iexplore.exe 17 PID 4008 wrote to memory of 1180 4008 iexplore.exe 17 PID 4008 wrote to memory of 1180 4008 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\03b6d455e0c3b154d2071730d1b9799c.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4008 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4008 CREDAT:17410 /prefetch:22⤵PID:1180
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5eb67baf06a1d94f22035da0b59a13d1d
SHA168948612d15d7eea6fbdb80371d9c7f78ff9b189
SHA256428769b8aa88bd8024d80218948cd9af21332cc919bced628a7d8261aaffd800
SHA512cc0f8e6fc3bb6765993e1074b4e34e8de49acb9c771635c02f3471249eaddd6c5a549cf492ebddf1af2e90d82cdb3f7a603fc0443334b9d4131ca78c50a085a3
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee