Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2024, 17:44
Static task
static1
Behavioral task
behavioral1
Sample
4c1164dd147f10c595573ade1d1de0dd.html
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
4c1164dd147f10c595573ade1d1de0dd.html
Resource
win10v2004-20231222-en
General
-
Target
4c1164dd147f10c595573ade1d1de0dd.html
-
Size
56KB
-
MD5
4c1164dd147f10c595573ade1d1de0dd
-
SHA1
655b0b559987861ade0e9c90ab00125f606303ef
-
SHA256
fc68ce48f5697169aefd07cbe26b1f86f86770372a145067e4e489ecfea55fcb
-
SHA512
eed1d75d8f2c22f5ddd1ad8882aedc4f3688aa93f7d5346be2a16f550a9bd823bb23aeacb40d55b88a0fba616663509b007cae93e9ff90414ad6fe176ba51700
-
SSDEEP
768:4LnpHvvCIoodr2cRxfeim9RDWNPJ7KyySqJ/+xpaBgVp:4NHv7oqr2Iwim9RDWNPJ7Kyu+xp1
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{8A6A9DE8-AE4D-11EE-A0B6-766E2D171A79} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1528 iexplore.exe 1528 iexplore.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1528 wrote to memory of 2364 1528 iexplore.exe 19 PID 1528 wrote to memory of 2364 1528 iexplore.exe 19 PID 1528 wrote to memory of 2364 1528 iexplore.exe 19
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4c1164dd147f10c595573ade1d1de0dd.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:17410 /prefetch:22⤵PID:2364
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD51bfe591a4fe3d91b03cdf26eaacd8f89
SHA1719c37c320f518ac168c86723724891950911cea
SHA2569cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8
SHA51202f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db
-
Filesize
15KB
MD51a545d0052b581fbb2ab4c52133846bc
SHA162f3266a9b9925cd6d98658b92adec673cbe3dd3
SHA256557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1
SHA512bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d