Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09/12/2020, 00:12 UTC
General
-
Target
5bd267095b25bea0d5a95b4d6c22b871056ca7b8dc137351850d6a577ba62b80.exe
-
Size
150KB
-
MD5
a8864ed2fc43a52cb42127c37720c88e
-
SHA1
96a8f93afd9c2835ee1d22ab58cdd0399bfdfc21
-
SHA256
5bd267095b25bea0d5a95b4d6c22b871056ca7b8dc137351850d6a577ba62b80
-
SHA512
5502b38b0ca9921c9cf9c3667cef846f1f495302c89290ba7351c169cb50ad9153a7d097af9cc882a6d7353e7b118647a59a07aaa293c25dd243132f82e43deb
Score
1/10
Malware Config
Signatures
-
Modifies Internet Explorer settings 1 TTPs 131 IoCs
-
Suspicious use of FindShellTrayWindow 8 IoCs
-
Suspicious use of SetWindowsHookEx 32 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd267095b25bea0d5a95b4d6c22b871056ca7b8dc137351850d6a577ba62b80.exe"C:\Users\Admin\AppData\Local\Temp\5bd267095b25bea0d5a95b4d6c22b871056ca7b8dc137351850d6a577ba62b80.exe"1⤵
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3472 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2020 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1100 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3172 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2912 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1372 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" -Embedding1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3212 CREDAT:82945 /prefetch:22⤵
- Suspicious use of SetWindowsHookEx
-
Network
-
DNSgo.microsoft.comRemote address:8.8.8.8:53Requestgo.microsoft.comIN AResponsego.microsoft.comIN CNAMEgo.microsoft.com.edgekey.netgo.microsoft.com.edgekey.netIN CNAMEe11290.dspg.akamaiedge.nete11290.dspg.akamaiedge.netIN A23.2.226.89 -
DNSgormaire.websiteRemote address:8.8.8.8:53Requestgormaire.websiteIN AResponsegormaire.websiteIN A45.142.215.136
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=7bcd18a1fe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 562
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:12:50 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: multipart/form-data; boundary=72aa300ffe29323f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 559
Host: gormaire.website
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:13:04 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: multipart/form-data; boundary=6b7271c3fe29323f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 558
Host: gormaire.website
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:13:15 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
Content-Type: multipart/form-data; boundary=4b47773bfe29323f
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko
Content-Length: 581
Host: gormaire.website
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:14:10 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
DNSiecvlist.microsoft.comRemote address:8.8.8.8:53Requestiecvlist.microsoft.comIN AResponseiecvlist.microsoft.comIN CNAMEie9comview.vo.msecnd.netie9comview.vo.msecnd.netIN CNAMEcs9.wpc.v0cdn.netcs9.wpc.v0cdn.netIN A72.21.81.200
-
GEThttps://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlist.xmlRemote address:72.21.81.200:443RequestGET /ie11blocklist/1401746408/versionlist.xml HTTP/1.1
Accept: text/xml
Accept-Encoding: gzip
Host: iecvlist.microsoft.com
Connection: Keep-Alive
Cookie: MUID=156B8F486CA765E81D6580396D23643B; MUIDB=156B8F486CA765E81D6580396D23643B; _EDGE_V=1
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 2031
Cache-Control: max-age=3600
Content-MD5: CVxyaI3n2Q5lJtwNiHjz9g==
Content-Type: text/xml
Date: Wed, 09 Dec 2020 00:13:17 GMT
Etag: 0x8D58936D97F913B
Last-Modified: Tue, 13 Mar 2018 23:05:01 GMT
Server: ECAcc (bsa/EA9F)
X-Cache: HIT
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: e00d8221-001e-00a2-5abb-cd209e000000
x-ms-version: 2009-09-19
Content-Length: 15845
-
DNSgo.microsoft.comRemote address:8.8.8.8:53Requestgo.microsoft.comIN AResponsego.microsoft.comIN CNAMEgo.microsoft.com.edgekey.netgo.microsoft.com.edgekey.netIN CNAMEe11290.dspg.akamaiedge.nete11290.dspg.akamaiedge.netIN A23.2.226.89
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=64849bf4fe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 568
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:13:28 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=5c0176fffe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 552
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:13:42 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
DNSgo.microsoft.comRemote address:8.8.8.8:53Requestgo.microsoft.comIN AResponsego.microsoft.comIN CNAMEgo.microsoft.com.edgekey.netgo.microsoft.com.edgekey.netIN CNAMEe11290.dspg.akamaiedge.nete11290.dspg.akamaiedge.netIN A23.2.226.89
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=53c3758bfe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 550
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:13:57 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
DNSgo.microsoft.comRemote address:8.8.8.8:53Requestgo.microsoft.comIN AResponsego.microsoft.comIN CNAMEgo.microsoft.com.edgekey.netgo.microsoft.com.edgekey.netIN CNAMEe11290.dspg.akamaiedge.nete11290.dspg.akamaiedge.netIN A23.2.226.89
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=440d56bafe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 551
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:14:23 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
DNSgo.microsoft.comRemote address:8.8.8.8:53Requestgo.microsoft.comIN AResponsego.microsoft.comIN CNAMEgo.microsoft.com.edgekey.netgo.microsoft.com.edgekey.netIN CNAMEe11290.dspg.akamaiedge.nete11290.dspg.akamaiedge.netIN A23.2.226.89
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=3be2684cfe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 569
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:14:37 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
DNSgo.microsoft.comRemote address:8.8.8.8:53Requestgo.microsoft.comIN AResponsego.microsoft.comIN CNAMEgo.microsoft.com.edgekey.netgo.microsoft.com.edgekey.netIN CNAMEe11290.dspg.akamaiedge.nete11290.dspg.akamaiedge.netIN A23.2.226.89
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=331a1ecefe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 552
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:14:52 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
POSThttps://gormaire.website/index.htmRemote address:45.142.215.136:443RequestPOST /index.htm HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Content-Type: multipart/form-data; boundary=2a96f980fe29323f
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: gormaire.website
Content-Length: 553
Connection: Keep-Alive
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Server: nginx/1.14.0 (Ubuntu)
Date: Wed, 09 Dec 2020 00:15:07 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
-
52.109.8.21:443
-
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
45.142.215.136:443gormaire.websitetls
-
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
72.21.81.200:443https://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlist.xmltls, http
HTTP Request
GET https://iecvlist.microsoft.com/ie11blocklist/1401746408/versionlist.xmlHTTP Response
200 -
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404 -
45.142.215.136:443https://gormaire.website/index.htmtls, http
HTTP Request
POST https://gormaire.website/index.htmHTTP Response
404
-
8.8.8.8:53go.microsoft.comdns
DNS Request
go.microsoft.com
DNS Response
23.2.226.89
-
8.8.8.8:53gormaire.websitedns
DNS Request
gormaire.website
DNS Response
45.142.215.136
-
8.8.8.8:53iecvlist.microsoft.comdns
DNS Request
iecvlist.microsoft.com
DNS Response
72.21.81.200
-
8.8.8.8:53go.microsoft.comdns
DNS Request
go.microsoft.com
DNS Response
23.2.226.89
-
8.8.8.8:53go.microsoft.comdns
DNS Request
go.microsoft.com
DNS Response
23.2.226.89
-
8.8.8.8:53go.microsoft.comdns
DNS Request
go.microsoft.com
DNS Response
23.2.226.89
-
8.8.8.8:53go.microsoft.comdns
DNS Request
go.microsoft.com
DNS Response
23.2.226.89
-
8.8.8.8:53go.microsoft.comdns
DNS Request
go.microsoft.com
DNS Response
23.2.226.89
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB