Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    75s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2022, 10:41

General

  • Target

    https://github.com/NoahCodingStuff/Youtube-View-Bot/releases/download/release2/Youtube.View.Bot.v1.2.0.rar

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/NoahCodingStuff/Youtube-View-Bot/releases/download/release2/Youtube.View.Bot.v1.2.0.rar
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1912
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1912 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2028
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\Youtube.View.Bot.v1.2.0.rar
      2⤵
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:580
      • C:\Program Files\VideoLAN\VLC\vlc.exe
        "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\Youtube.View.Bot.v1.2.0.rar"
        3⤵
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:1500

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    340B

    MD5

    b486955e1f800355760e38844cc57f8f

    SHA1

    bc60d4ad41d4a064cce5090e0d2138911b95e41b

    SHA256

    8064d57746f1fc0bf5e7982a94568c778969f355ef5df75ba7564e91e473ae80

    SHA512

    9c1ac52c880063a9e10b2b57266a5bf4c9a54837d820d1babfaa06de3108a49568ad7b2d12eb2c4669a6975741f7a5765dc8f821c295c43ca173d2d0cf62c99e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3XPFXPM5\Youtube.View.Bot.v1.2.0.rar.h3acaa2.partial

    Filesize

    818KB

    MD5

    f9b3ffea20debb172dcd7af6fbdc97d0

    SHA1

    22edbc2a7aa2c7fe9d1fef47f334ab0825cf85ab

    SHA256

    ad64c98d5b86e957b01cb593ba2eca44930523f2e8c0632ca94a9041705cde47

    SHA512

    d6b1a4ca544a7cdef8d43deeb52477baf7af8c87d8707b806fa44fc5633e6ba27b0d9d4091c7cef88bb0dfeacd493aa8520a189bd0d4cc74284035ec3c921a1c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\99B502IQ.txt

    Filesize

    608B

    MD5

    2eb023bb1173feb50dbab200eb8f2392

    SHA1

    7b14f27f5de32ab25359a73808f4244baa682938

    SHA256

    09ace799554d3b765646ce64cf488ba78c65909e9535aba286c83b6e6407ad4f

    SHA512

    437c3ac09a16aa87afe714ed89e1c07d6c749f2ad768b867db1236b541d68cc0b00090750927dd434bc2192f88cfeb53f3a2af6895721d148d22e9c39683e245

  • memory/580-56-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

    Filesize

    8KB