Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
112s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
1695e1c24d3932aca325cdca3dc16845.html
Resource
win7-20231129-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
1695e1c24d3932aca325cdca3dc16845.html
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
1695e1c24d3932aca325cdca3dc16845.html
-
Size
11KB
-
MD5
1695e1c24d3932aca325cdca3dc16845
-
SHA1
ab79365d2141458cf4896c998c65fde08630e8cc
-
SHA256
14e3bb4b3e27d3fbad8da718648f4765825ff13af00c6cbc01c00263cac08da9
-
SHA512
477f9f118e681c1b617da403023cf7f80fa772976c590f435006211b037bf6ee69c0af3bc92a3b3a5f878435fd7590712ff42ff6e8cf29686b7709f41621beb3
-
SSDEEP
192:vpVLd6ANCij/+AbzPoj9xfPAr+TkfPk3R22wkKkqR0QZ4cFR8PcGKc3cGSckBXbI:vXxl9+uzPoj9xf/HF6qCC+kcPMpHF6ql
Score
1/10
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{DEA4089F-A800-11EE-A0B6-52ED22FB7E6C} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4316 iexplore.exe 4316 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4316 wrote to memory of 1984 4316 iexplore.exe 17 PID 4316 wrote to memory of 1984 4316 iexplore.exe 17 PID 4316 wrote to memory of 1984 4316 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1695e1c24d3932aca325cdca3dc16845.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4316 CREDAT:17410 /prefetch:22⤵PID:1984
-