Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/05/2022, 18:25

220501-w2v7qaadhl 10

01/05/2022, 18:22

220501-wz279adge8 10

Analysis

  • max time kernel
    141s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    01/05/2022, 18:25

General

  • Target

    decrypt-decrypters/privateKey.xml

  • Size

    1KB

  • MD5

    ef98e844f401ce505f3cfadd50387a2a

  • SHA1

    53152b609e4c2a5904f55ef4862463c9e97b6840

  • SHA256

    8e1978ba42d685cc1fdbfea65f2c6e6bb08d1a82601c6586c5df2984cb764c40

  • SHA512

    c2483aea1caf32e166456c85dd187cca4d5a7503c9a9194b4e5a0eac2b9762b53385c67e3eb29bab03306144479b6250907202980c494840c468713b143aa7a2

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\decrypt-decrypters\privateKey.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\decrypt-decrypters\privateKey.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4576
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4576 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3400

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4292-130-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-131-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-132-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-133-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-134-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-135-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-136-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-137-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB

  • memory/4292-138-0x00007FFABF110000-0x00007FFABF120000-memory.dmp

    Filesize

    64KB