Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    177s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/10/2022, 14:03

General

  • Target

    https://qe2.greshamonline.net/Authentication/ResetPassword?clientId=gBOIE4xYb0mwF3aAtjdBOw%3D%3D&statusId=p3iWcOz6CWsjy0FGwL4qbQ%3D%3D

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://qe2.greshamonline.net/Authentication/ResetPassword?clientId=gBOIE4xYb0mwF3aAtjdBOw%3D%3D&statusId=p3iWcOz6CWsjy0FGwL4qbQ%3D%3D
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3980 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4848

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    6a15e3564b9eb382fe5534f59d6fccb4

    SHA1

    911dbc1a988c2d6816beb0c21c4ea5402253b884

    SHA256

    6b478c66c9a2024177d4a478ccea9a82f3162aa87a5125a0dc3750c920bdbc62

    SHA512

    2801f46d495eed08dbb10e73ccda4828faf4ef6b1ff3ff45ce8d73331e692381c25417d15c958f8c3f9c6932300cd0e66b1aad6bb5a92e2bf27b338b6d245711

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    38359cf103be8d1e2bf6c7c8c43e06d0

    SHA1

    f0271197030e9a39e46709163898c0a0cc696e5b

    SHA256

    4f1c1c12e9cf4901ee5f1ad25b9bb4b42322b8b7c2a9bb1471924c15eedf3779

    SHA512

    40a421166ea9982b32ebef5fcde373f183039f7fe38a6c50e19fc121c627173c0252c9e3cc954889b38f2992fc5624e3787a35880e9973bd396757a470e834d5

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dqptnfu\imagestore.dat

    Filesize

    1KB

    MD5

    901e61f6785d8b253c2196a10f312798

    SHA1

    b692092e7606fdcd4a89505dc3e80f648baaaf9b

    SHA256

    864cd7120f9b8a7b4294e6eb08868c4665bcce22af6a933e8c14612de382858b

    SHA512

    b619e03d488093d0c357735906ccf44e1b9897b45e420015bd8afcb38ddd327d2be751e42b9e32a6583d34b4ef39d12362c26bbd2d6c32a6f21d03a8063e669c