Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/09/2022, 12:00

General

  • Target

    http://rndtech.co.uk

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://rndtech.co.uk
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4016
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4016 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4332
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4016 CREDAT:17414 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2428

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

    Filesize

    717B

    MD5

    ec8ff3b1ded0246437b1472c69dd1811

    SHA1

    d813e874c2524e3a7da6c466c67854ad16800326

    SHA256

    e634c2d1ed20e0638c95597adf4c9d392ebab932d3353f18af1e4421f4bb9cab

    SHA512

    e967b804cbf2d6da30a532cbc62557d09bd236807790040c6bee5584a482dc09d724fc1d9ac0de6aa5b4e8b1fff72c8ab3206222cc2c95a91035754ac1257552

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    0a8ccb22b686f8477bd7c0815474980f

    SHA1

    4a8127d2f3e3840737696dbbbae0bdaea33da790

    SHA256

    1792128e4ffcb7422d38888abd7879f2958acaebddd325a27a2144bea963e825

    SHA512

    53cb292ad44cb41d9f1e68d4b532a0fb6396b74a86edb2c95033d27620f60b58b6c45ba97291f8397a07a6556952f611901b88bd1983027197555983093738f9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

    Filesize

    192B

    MD5

    68fdafa8e725657ec341f58c59f0e873

    SHA1

    a2852c2cb47a7cbc94c0bc53c24719d538e0e695

    SHA256

    64e303c407ac003754e394efd0c4b0cbfcfa0eab08f022dd430c070df6c682ab

    SHA512

    a12c2d478eee766f107af08a1b54a4878f6f7ad3f72ccc4a5d912e7f10d2d5768bef3ef1e2899d77734d760346e361c2e13f9b387b1ad6b0fa15e9db6463d28b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    ffcc55e6a00ddc593ecb8bd8acb86a3c

    SHA1

    ca2fbfe78c40f6a3c88972cdcaebcc724604c05e

    SHA256

    027669cbcc296e4ef1296bc282f07e8581af40b75c0e4110c54ac36ddbb85135

    SHA512

    d0eeb358db48c86bec6debe03e432c29ffcf7e97f99747845b1244cc3e3333255ae0b1fb52a04174fe87eb34184b3a1e9269a3526939c377340eac3d325e40fb

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4IGDP7OE\rndtech.co[1].xml

    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4IGDP7OE\rndtech.co[1].xml

    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\z2evvp3\imagestore.dat

    Filesize

    97KB

    MD5

    5c2df7ff88c76b0821c9595baa051ed4

    SHA1

    554fc575331b8d2944161135b29a358e7d84fba1

    SHA256

    c2ba69ed317c878ce28fd741479b0ba32b10569b197d00aa03a27805a7d7d1a5

    SHA512

    d270f16310274bb3f619f788d489250f60f5210b50e39a0a1d550144bd08f5a89742f22a2308b0df778cf42d4497c1f2a70e6812e30f77b2b02e1b927dde4549

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\web.assets_frontend.0[1].css

    Filesize

    239KB

    MD5

    754160d30f3b3f19c579268053ec83ed

    SHA1

    e07a12a409df659fa0f1ce7752ea22aa24c1c435

    SHA256

    962b06249515348bc836ac7d5ded4981df229b23ee62eaf13ba234a065efb8f7

    SHA512

    172fdc8180c383a1c28e018a9184a4659ef1bce1686fa9a49d6edf5f6e770b0dab72fc39e3c3a5040fcbf53404e2972074f13eb193c186027b6c885679f94ddd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8YLPV06K\web.assets_frontend[1].js

    Filesize

    72KB

    MD5

    a2f26b9b6626b95ac43c8b42459bfbf8

    SHA1

    e4dbeabe2b5ae0ff3bb310e4f2bd067e5c2e8319

    SHA256

    0ee5cc4ddb165027cafc1d2aafa0b57d7670437b53ef5d41cd599ff792e8c7f3

    SHA512

    8a6386576cf1990980f1746d0725e96f11c5fe1ab42417ba53b676b93a34a0febde803f02325bda7ebce8fd18f6fa27990fa7d67762ec994200bde61d94443ea

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\94PW68LC\logo[1].png

    Filesize

    2KB

    MD5

    af0e30e95e95a16e4e7191bd0f3f6512

    SHA1

    3d456de56d836300b7d93a599f681cbd70fb514d

    SHA256

    1928f02bffc464fe66e4de6d111b78bc788da8e374e6531023cec8aa92bcec24

    SHA512

    22c28fff6aa28c3c77b08bfca89880df55e999a01892668900d7b5b465ff2bdf1604488fa3055b85f0aea1d981d3e8d77ee443f87c10e2d4263fa095119de8e7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\94PW68LC\web.assets_common[1].js

    Filesize

    1.0MB

    MD5

    d139c1c35633cbcfb78858a1df2c6af1

    SHA1

    51a56ee19a48c00a764d408f421023588744d126

    SHA256

    a184eaf64580a2f73078246afdc79970d8a6b42b3816c3b47785da3e30ab9289

    SHA512

    8f2f9ba418ff2ef67d5563214acd25ab62fb88da69380d7033986c90ed90f7b386f0c795f10a4d687716ad44c5b23121ff17ac9804c4b0272b207ed94a2a1b95

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\favicon[1].jpg

    Filesize

    97KB

    MD5

    eb629cc28b65bb3ca520ac7b1014d755

    SHA1

    4de83fa46d3622e620fce94b37395bf7fb69c5ae

    SHA256

    95af02edc6f600dcdaab515166395c9be4cc3d05a15a2a56190187c7ad82d13c

    SHA512

    57d19853b00058353ed9fe0e782ec63e7c2f1f861dbe66a2be990fe9c488907df6ea0377602979656d6fb236976b67f820ff5a860c3c596b864b61ce615c5743

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\fontawesome-webfont[1].eot

    Filesize

    161KB

    MD5

    674f50d287a8c48dc19ba404d20fe713

    SHA1

    d980c2ce873dc43af460d4d572d441304499f400

    SHA256

    7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979

    SHA512

    c160d3d77e67eff986043461693b2a831e1175f579490d7f0b411005ea81bd4f5850ff534f6721b727c002973f3f9027ea960fac4317d37db1d4cb53ec9d343a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MWIURFX4\web.assets_common.0[1].css

    Filesize

    112KB

    MD5

    16ccefc9998dd6c9a430d4a3b7ca6515

    SHA1

    c3116c0ee2d4721287c3e269f92e6a7d10d47da6

    SHA256

    d06a4d1709fb7abb3b8c1d5065d38e1399728b770a6610a378e1996b08c9cbb2

    SHA512

    f3e908cae4349900d52ed0600bfedb86e3c7fd6414cabc2ccb7250e52d20c510d756efaa3b70ce161e895ff3a1310fff3349826a81459732231df7bdb12e8429

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TQFWGWHN\web.assets_frontend.1[1].css

    Filesize

    14KB

    MD5

    64d2bc31bd1c9fd02de8bf4475f06a16

    SHA1

    20762147556a63ce7d8b0d2f582c0f6c6ab9edd3

    SHA256

    2c534bde951fa41d804f46552f571cc7556fcb7c2a5a0da6591469af71ee6e94

    SHA512

    86eaee692a3652e3c3717b628f1aadc2225ab0e4198a327caf134a438b7dd0df6022ac505aae70e17ada438d56b945a24a30345874d61bbcc9317a6a4197d847