Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
7s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 13:33
Static task
static1
Behavioral task
behavioral1
Sample
38300e411e9712c6fcf08269788cace7.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
38300e411e9712c6fcf08269788cace7.html
Resource
win10v2004-20231222-en
General
-
Target
38300e411e9712c6fcf08269788cace7.html
-
Size
57KB
-
MD5
38300e411e9712c6fcf08269788cace7
-
SHA1
3885397134398a7b3d688ba2e0bb79c256be9c4d
-
SHA256
e957f72a8fadd51bdc4abf7ae0fb483d1f3482851744d143a01c02ac840a9d51
-
SHA512
bfd12db29e5373b6e501aa3bde389998b0dc4f52a74ae169d781dcd4fe2c4751429737ae82aaea32d10e0631c7014a37afd63ad8bd8670d7321db49d8cdc6907
-
SSDEEP
1536:gQZBCCOdy0IxCPBQBfkfwf0fEfZfGf2fWfMwfjf+fBf+fofJfYfQfufXf6fxfofT:gk2o0IxNco8cBOuuL7GZ2whAoGPiZQY8
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{113A5F66-AB87-11EE-A0B6-7AB8B57C8E96} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1856 iexplore.exe 1856 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1856 wrote to memory of 3704 1856 iexplore.exe 17 PID 1856 wrote to memory of 3704 1856 iexplore.exe 17 PID 1856 wrote to memory of 3704 1856 iexplore.exe 17
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\38300e411e9712c6fcf08269788cace7.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1856 CREDAT:17410 /prefetch:22⤵PID:3704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD509283fe34ecc631ed0b693febaefc627
SHA18213b2164d5a1915265f42c12b3d34a8afa345c0
SHA25638126819763a1fe8ce3ceb26d3e6cbc252a9bdb68698d684db378edf55c0de76
SHA512b6159de434655d89ad9b11c09e2a3ca56ae9b56469573a8d302e707e386225bf7a525ab97161725182bacad05877554e601f102bd9cd40451fc7e7429531f981
-
Filesize
1KB
MD5d8f520bbd7e02557af36e767a37c18bd
SHA10ce0f0dd324c4076e9ae13ba167a8d3bbc464d0e
SHA256c1b86d199882f0caf26e7b52c64aaa12e55fe854a88449f84b24d0aea57c5921
SHA512293263f4ad55a1fe88e7ebe253be9fbf0fe8a025275a0e3a5ca294656b336db32a94fdf6af4b24459f10d88f1f0f9cbb34124b0a6191831d34ab31ebae286677
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
2KB
MD5cb546f0ce2ca2505cbc9088d8a4592e5
SHA1d87b70b1a34f4313d085de80da3aa4e8845af904
SHA2560c3851f8f6d7b9dc63645a68b0db991edc9162620b9d757684a4a20206c458fb
SHA512b6fcd078f43082daf299a49646280ac3a30b91d10dcfaf8e9fb9e8317af417e34d45ae7397af9507d4101b7bcc58169c2f64adcaa253fc08204b98020b20b551
-
Filesize
650B
MD5ea5a5798612df63ab0532174aaf62634
SHA10f4713eef39ab07510d3703ef201885475ef0b42
SHA256ee44a690e6d7ba27656d9a013b7803d69461a19444d834c918d16c1c56598a31
SHA5128cfd3dc5eb7f2ab4f27abf80bea6955a00112b84ba074cfb8a1bce0207c36f6f12e2f3e90b8ebb8fedd56a5520a4a0d09397af9e6f4885addd890df7bf3b8907