Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 15:10

General

  • Target

    https://cl.link-ag.net/click_product_link/20ca3c/24e91216/?redirect_url=https://relayhere.top?e=YnBldGVyc29uQGV2b2xlbnRoZWFsdGguY29t

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://cl.link-ag.net/click_product_link/20ca3c/24e91216/?redirect_url=https://relayhere.top?e=YnBldGVyc29uQGV2b2xlbnRoZWFsdGguY29t
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1092

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    60KB

    MD5

    d15aaa7c9be910a9898260767e2490e1

    SHA1

    2090c53f8d9fc3fbdbafd3a1e4dc25520eb74388

    SHA256

    f8ebaaf487cba0c81a17c8cd680bdd2dd8e90d2114ecc54844cffc0cc647848e

    SHA512

    7e1c1a683914b961b5cc2fe5e4ae288b60bab43bfaa21ce4972772aa0589615c19f57e672e1d93e50a7ed7b76fbd2f1b421089dcaed277120b93f8e91b18af94

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e89f6b4852bbdfecb505edc1101933d2

    SHA1

    0b0178d9ac65d6137b54c2020b5248d6caa628a5

    SHA256

    84ccf40c7975a723089e7f141df3655133f832678e77f1b3d71b055cd4ee5a98

    SHA512

    cd82df35217ab9ac0bc65f0e7e5cf5a22e6c7cc8a3ad22b4cc8b012c7088ceba474f768afd2c1e9ad01e3448f90f57bf12b447ca5f0ace3d437eb9a3e9642a85

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cd4c7cc59a55743ca4826ba9f98b2134

    SHA1

    35e7937b57e7b4870f90cdd88d4ee5aadc65edf1

    SHA256

    c06c3a92e70ab889629bf8a93b9c87feed3ad621d8767749bfaaae88ca76354f

    SHA512

    607bb78a4462d730a6d1e0851584def3eba1dbc105b8a1c3510008498a08415dcd3af8a56b45c7c9409473d7598ff74b76859e6a370d21bf5b4d20ab403b3b1d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    bb5eb7aefef4b5130787db93d0cdf804

    SHA1

    9f4c00ed67f108af638404d901ee6d8064006363

    SHA256

    e3faaca50d0ffeb36666d4da8a40fccb2ff99e12a13de5fa957f7feadc384f97

    SHA512

    71a7dd438d66ba93e9bbfcc2245bef0a122bdb599789a29656397e1b3164b874f466290e73b3894a025e34e8032428ddef9002ccb33835028add706f6affa35f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OUI78ZM6.txt

    Filesize

    606B

    MD5

    69fb77eceda5b6c445cc82e283ebbe06

    SHA1

    e6cf4a3f6c0a2824fb58cc7808eba1e84207c57c

    SHA256

    063bda2168f2d9ef28136e707d56844e63083c564b6e4c2eb779d3078144f520

    SHA512

    576af44d31f57cbeabefb2c74d97359156ddc12d0592cf2774b85817266c0a6c3a0a0e8579bee28c7e3927ee5e67a685f744d7bd59f7bb6c74553f855b47bb0f