Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/09/2022, 19:00

220926-xnpnfsbgd8 1

26/09/2022, 16:07

220926-tkzsgacdhq 1

26/09/2022, 15:41

220926-s44ebsbca5 1

26/09/2022, 15:29

220926-sw34lacdbp 1

Analysis

  • max time kernel
    571s
  • max time network
    422s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    26/09/2022, 15:29

General

  • Target

    Users/kmlarsen/AppData/Local/Microsoft/Windows/INetCache/Content.Outlook/W4YE5R4Y/☎️ Voicemail Audio Transcription.htm

  • Size

    13KB

  • MD5

    743bce526b069f0c70069210fbf399b1

  • SHA1

    884b1d100def065ba2964f81bcea919a44a3a2f1

  • SHA256

    2dbd2d653764003082326aacc9b1267075039f95446517cf6560a74785828e16

  • SHA512

    e0b79bc1cb7be72282ce7373957c1af7f3e2333efe60b055a0acbb3fd6563da7c39e1a0520597797f99d7f28b898e19f2957103a67cc954c549964fac24c26eb

  • SSDEEP

    384:KbcrRYCh//If1GdYxNAPoIIklxYq/KxnppHltlfKRLWcwgWwaThTZbKob7/:KbcrR95Qf1EYxNAAIzlxYGKxnppHltlj

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 30 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\Users\kmlarsen\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\W4YE5R4Y\☎️ Voicemail Audio Transcription.htm"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1944 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1716

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    340B

    MD5

    119c88c76c817ea0b5a23aa70cf60aef

    SHA1

    3656a1dd533e2ebc59e7c1d3a89dc91a8e48fe20

    SHA256

    51187f2f0a7300901246ce0c9923345e292a38dfb16aa335f0edf5032bddb369

    SHA512

    f007d707fd1533b63bcd182c6ae126691c50022b1f39b1dee9e7a75112ebb8baddf7a652ff931644ecc3b50f7c97da78123e05b20ef3bcd96f115eaa8f7d7566

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GUMB3WUT.txt

    Filesize

    608B

    MD5

    ae28c8d719c150dd0a756196fe18b398

    SHA1

    ba0b29d3b1b950992356bfb9568523aebae62765

    SHA256

    5dfd9a4b85e358dcfaea97279830366121402eb456ae9cf8b963af815116d563

    SHA512

    56821e0463134e0580d12da255a5c8ee49e8596d569819e633eb2d8c22dc3f13b918bb21a9223b28157ea5cd00394f35abd67198956a138df154383b038179e5