Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    74s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 07:47

General

  • Target

    https://isurvey.panel.co.kr/Common_check.asp?Alias=7886181444&panel_id=819045

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://isurvey.panel.co.kr/Common_check.asp?Alias=7886181444&panel_id=819045
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1184
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1184 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:840

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    340B

    MD5

    0f54532a9a07ec928260fe5c18706a54

    SHA1

    7b88dc427028662fcd4a2e5e35274705c492ad43

    SHA256

    dcdf5fa29dcbc1454e54787670c74f8b433c7e4f84c558f4727d881091fb3eaa

    SHA512

    dd16950027c2fd6f6ee933f155113ae81f01418caf847b23c910f0b80c1b72e7ab09636e2e7fe980f4422ac2b4737c38b050d8688b2cf7b6490bd622a1dbf84b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YZHWD9C5.txt

    Filesize

    606B

    MD5

    145de47cc88c69722b6720c00c6218fe

    SHA1

    80e216557f519e8c2552d1ac95c5256887d00275

    SHA256

    9970b9ae3abb5557682ef7810a5952328b11d28247acb0561134606583616d9a

    SHA512

    b1a568d0d5cd8bd1b4d0fb1f456ce5c77147684954f197116b9aea83656344b701750f4b84630df0f7df92f5d99a9adb2b0d50ee96703fa5d85337b9ce0bbcf4