Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    110s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 00:41

General

  • Target

    3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe

  • Size

    72KB

  • MD5

    f44e19bdfb48d55070b178f2390cb377

  • SHA1

    51a80565642350107b469896f983b2b65eb08864

  • SHA256

    3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053

  • SHA512

    a7f6c2cd37800248d70a74882fbbc39c59c822c70f44bd9c61e1fe6590ff57ab6c8a84403b4c0ae580c1048fa9f31094c7d6e443bd377f55e3a680f58f9fe01f

  • SSDEEP

    768:1gR2+xq206IEcCv69Xt/OGf2nLtyXUNA0ev0Z:1gR2+x/OEPv63xOnLAcAXvG

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe
    "C:\Users\Admin\AppData\Local\Temp\3a174c4147035d270a163364d65bfff17eb6dace5f066402640bf16ffe8a0053.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Windows\SysWOW64\explorer.exe
      explorer http://hi.baidu.com/qq289555239/blog
      2⤵
        PID:1884
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
      1⤵
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://hi.baidu.com/qq289555239/blog
        2⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1224
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1224 CREDAT:275457 /prefetch:2
          3⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:468

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      340B

      MD5

      070a3a9da27e80808b476bd508f400f5

      SHA1

      1d13b0e01b876f377acf9df97764421b3b37096d

      SHA256

      ffa8586175d92032cac1b4bf6b3db44b3fa78b4871006098d208f24e6b592cde

      SHA512

      5c8b6bfd7ecc212fd8a2cc4ee8b43d27f6d5ab26e298a5a1cae169cafa3e6cc23bb774cfba1b7254937c7fe8cf9cb70eb415bc8d8154c12897bb619fcf2303a5

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\tcz8fqz\imagestore.dat

      Filesize

      8KB

      MD5

      1f55bc669421587f70e6e728db3bbd1f

      SHA1

      a2982d6f1b52b4fa41bdf3c7a1b7f6486966c7cd

      SHA256

      b58d5ef162addf4920e922e340eee43bf129af590a790292f8261bf9d3568877

      SHA512

      1893bed4ff84accb2ade53bf388b9d31fddf8354def566b5d7814c790d1eacb648a54e851997e4a568ba8c74bd41ce57c8c00dcb62a994414cd201ff693f9bbb

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O67X7PPL.txt

      Filesize

      597B

      MD5

      58d441964f6324dd10a9268ff4089c42

      SHA1

      7e455ae27c21c46327683dc95b3aa0c3572f0055

      SHA256

      df3b1f3134b39bc6779d3d9fcef080ad56949d75cfd5ffb40c313ff86c2c90fc

      SHA512

      14fb87472a23aee8fc0444b724eefd77de28dce337c8f5b877cfa25dfa1007dd428a6ec73531fe6a626e874c7b96379572288cd761ee2ed37c55c31629cd03b9

    • memory/948-56-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/948-60-0x0000000000400000-0x0000000000412000-memory.dmp

      Filesize

      72KB

    • memory/1240-61-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

      Filesize

      8KB

    • memory/1884-58-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

      Filesize

      8KB

    • memory/1884-59-0x00000000744C1000-0x00000000744C3000-memory.dmp

      Filesize

      8KB