Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    08/09/2022, 15:47

General

  • Target

    https://share.mail.libero.it/ajax/share/031ac22804c24c4513f29874c24c41b3b880eafa6566150e/2/m8/fRE1RRlM6Ly9kcml2ZW1haWwtZGVmYXVsdC1hY2NvdW50LzMyOTY3Nz0yMzM2MDM5NTk5/aZHJpdmVtYWlsLnJlY2lwaWVudA~THVjaWEuTWFzaWVyb0BhZ3JpY29sYWdyYWlucy5pdA.ZHJpdmVtYWlsLmZvbGRlcmlk~MzI5Njc3IzM2MDM5NTk5&e=c56365ea&h=c7cfa194&f=y&p=n&l=1

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://share.mail.libero.it/ajax/share/031ac22804c24c4513f29874c24c41b3b880eafa6566150e/2/m8/fRE1RRlM6Ly9kcml2ZW1haWwtZGVmYXVsdC1hY2NvdW50LzMyOTY3Nz0yMzM2MDM5NTk5/aZHJpdmVtYWlsLnJlY2lwaWVudA~THVjaWEuTWFzaWVyb0BhZ3JpY29sYWdyYWlucy5pdA.ZHJpdmVtYWlsLmZvbGRlcmlk~MzI5Njc3IzM2MDM5NTk5&e=c56365ea&h=c7cfa194&f=y&p=n&l=1
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1684 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1108

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    60KB

    MD5

    6c6a24456559f305308cb1fb6c5486b3

    SHA1

    3273ac27d78572f16c3316732b9756ebc22cb6ed

    SHA256

    efc3c579bd619ceab040c4b8c1b821b2d82c64fddd9e80a00ec0d7f6577ed973

    SHA512

    587d4a9175a6aa82cd8bb1c11ca6508f95cd218f76ac322ddbd1bc7146a0e25f8937ee426a6fb0fb0bb045cedb24d8c8a9edfe9f654112f293d8701220f726b4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7d3048a3c5794bb2baea3ddb342a7d20

    SHA1

    86777f3bbc8d556e3d5a5e54b068755e1e2cda87

    SHA256

    3dede51563a00d43ca56d8dfefb974288c0ce64e6824762d17bd94ec9f8038ef

    SHA512

    21b54ce1f81c17afc10089426af3ae8bf3307763c71e155219ba64a12c99a88ea7fdb4c55db59f65c5f50f1018cedb82448d989e7d5c45f7aa7eadc4b1e32ab3

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\N5GBU39U.txt

    Filesize

    603B

    MD5

    9232f7b9ce79935e2a2bdc5b926b85e7

    SHA1

    1b48da58524d0364a5095253205ea94f20237bab

    SHA256

    27d48d1a202b6017513fc2bc1a0803a45f47e3ef72ba3d7ac3aba8ccce68c220

    SHA512

    3f70c5a3cd9ca6480598cedb473b1be62dd55b75a9b4498a92467caacd7bfa4b043b6b7db9eae8e7cb379bfcc5d60788eb269bbd04b2463f08c49446a2b11804