Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2022, 20:55

General

  • Target

    31086e3edf2f7ba07784d28974af817b5f14ff48c298a70e896a65ef878f15eb.exe

  • Size

    30KB

  • MD5

    6e045aae034186d910850136570fea60

  • SHA1

    5144db0c64b877a2417ce0d16fa78ffb6fcfb012

  • SHA256

    31086e3edf2f7ba07784d28974af817b5f14ff48c298a70e896a65ef878f15eb

  • SHA512

    ff3572eef94f502389da0be080134e38376ecc492b39d55e83e01968acb964869f43a6f40ab72d352c4ba5aedf4f240316181613b879e694f998776b08426089

  • SSDEEP

    768:i0En7YPFpSESsMr2bc765DmODZZPZB52jI:CMECc25DmQn

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\31086e3edf2f7ba07784d28974af817b5f14ff48c298a70e896a65ef878f15eb.exe
    "C:\Users\Admin\AppData\Local\Temp\31086e3edf2f7ba07784d28974af817b5f14ff48c298a70e896a65ef878f15eb.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.php
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:112
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:112 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1464

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D6O4UUBF.txt

    Filesize

    601B

    MD5

    ff15cb6ffa00c2af37344a3ccd0181c9

    SHA1

    fafd02f01c90959a6210fb1c6ff02679f1cabe5e

    SHA256

    4c583c79fcb388ad41d6722ff603668fe57cc42d0c513fc8e588c9e4ceda9e25

    SHA512

    34e05de734d0c55cf5e496e373db26bfbb7dc153f3d1db065757b0ed32bb53965c4518a0dcf61fe3a2569ea5dca4bb2992dc937c1ed079445661ef214b539fc0

  • memory/1488-56-0x0000000076681000-0x0000000076683000-memory.dmp

    Filesize

    8KB