Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/10/2022, 13:42

General

  • Target

    wp-asset-clean-up-pro/assets/icons/icon-cloudflare.xml

  • Size

    1KB

  • MD5

    a6f95823344b1b66f56a9eb699384d5d

  • SHA1

    b2c33f92ffd27c2678823f6a2df2bef4b60dc284

  • SHA256

    e0edf50a3b4ce9018914a131a8250f31837d5d3cb08ece7f805c4aac70593436

  • SHA512

    f83c69d85fd3966de6b6f89cba9c532188d532d8a50eee8c86c1fc2bc3c5f3a7730446237104adb230a2830f2274887c939cc13ddc0b419c18a5d17f2a815316

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\wp-asset-clean-up-pro\assets\icons\icon-cloudflare.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\wp-asset-clean-up-pro\assets\icons\icon-cloudflare.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4112
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4112 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2056

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    635fcc1aee365eda7128db61d981aa5c

    SHA1

    a35b851b0af54180a91566b2ec2e50f21a85a54c

    SHA256

    5f2300980b866ce4c808c8c5b5383a7777cff9eff3b5468b9a3a5d175f552700

    SHA512

    7f1400556575d86c8243c6be279d59fa35cdd400d7003d40c25852a0ad203aa053fec1b7f45107b1f66ac505deb47a2341a71642ad9f7f0e8c4bd57ebe43d918

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    4fff6678ae44efe7f543dc130c4cec8f

    SHA1

    aed4678e2295df05e1097f23587fd26dd28656d0

    SHA256

    fd1bdf04fd8e9a9f06d3b3d9fc0573ec9f80fdebb56a9a794ee5653475ab716a

    SHA512

    cd11eccd86a916519e42890dd063c433cdfd9444125a32e2458bbcf7b8f44c6277a7d134f6411325a70e7d316e5f7bf1bdee3e76a620103c5e331f4f70803c7e

  • memory/4772-132-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-133-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-134-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-135-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-136-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-137-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-138-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-139-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB

  • memory/4772-140-0x00007FFCE8AF0000-0x00007FFCE8B00000-memory.dmp

    Filesize

    64KB