Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/10/2022, 21:11

221027-z1n9kaddh2 10

27/10/2022, 20:55

221027-zqrlyadfcq 10

27/10/2022, 20:47

221027-zkwnpsdfap 10

Analysis

  • max time kernel
    194s
  • max time network
    186s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    27/10/2022, 20:47

General

  • Target

    http://gitlab.com/oxx980710

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://gitlab.com/oxx980710
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1672 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:576

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    3dcf580a93972319e82cafbc047d34d5

    SHA1

    8528d2a1363e5de77dc3b1142850e51ead0f4b6b

    SHA256

    40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

    SHA512

    98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ad0f9e8dd149e41946adc26c51aee35

    SHA1

    fce72a191b7bc298804b5475a6ea3a3348b8522a

    SHA256

    3cce0b1bc169a550ea7658d7106f31a647018cc22edbe7917d6f2894d48a45f4

    SHA512

    9cfd9bcafe444ef6e635a71ccebb5ab03be9061188811c953cfb1aaef7478ef8a7c1bc3f77ccf3994518fcff1b9a49ed1afd1d6a43140743142afeb681d314d1

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\309axvf\imagestore.dat

    Filesize

    5KB

    MD5

    3fbbea4136325280f741005f6dd964b2

    SHA1

    f73ef5b7cff7949198eb6de2091fcf810513dcd2

    SHA256

    f599799c882310dd197d36b16a9f11ca0c2b5c2126ea3fa226c3fdbd4e02f440

    SHA512

    ab47ad3bc6843ecb5827d99b423fcb5bbf169b5b5b44acbb666263a4ebe4c4171e0ff4d10772b8f7f28af4b0578fabb22243e0da00d035a2cab899f375d3724f

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I62B0T8K.txt

    Filesize

    603B

    MD5

    9cd3e17b76606c64d83d7ae68df8211f

    SHA1

    3627fa4ea506173d0ca0f60831c937d6bd210103

    SHA256

    e51f692a667240ad2274ceee46aa5aba56555f9d7a10d28c7e2582065aa3eb9d

    SHA512

    e979d9a2be29ca75bc82a0ada975e41029ec61323941c5d1378feb9143e9fe2ba036ca34d3fbb1b6fbbf4adf2cc89e16cd0f31bdd2bd4ee2eae5d08a9cb43dde