Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    98s
  • max time network
    177s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2022, 16:52

General

  • Target

    https://l.e.allegiant.com/rts/go2.aspx?h=157506&tp=i-16EB-Fu-4wd-B5EDi3-1o-70Wp2-1c-qCzy-l7ndr2xLVk-6wL0Q&x=7xc.neoeduca.cl/LG#amFtZXNAZmJjZW50cmFsb2hpby5jb20=

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://l.e.allegiant.com/rts/go2.aspx?h=157506&tp=i-16EB-Fu-4wd-B5EDi3-1o-70Wp2-1c-qCzy-l7ndr2xLVk-6wL0Q&x=7xc.neoeduca.cl/LG#amFtZXNAZmJjZW50cmFsb2hpby5jb20=
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2016
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2016 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    3dcf580a93972319e82cafbc047d34d5

    SHA1

    8528d2a1363e5de77dc3b1142850e51ead0f4b6b

    SHA256

    40810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1

    SHA512

    98384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    4caa6ba2dcd1119de405fb32ae270dbf

    SHA1

    6c729b60d248b980fa9ed5dbc373bf4e60ac81fa

    SHA256

    c1e05362e3f572a012f53813c439b4527479264919f7155ee4e7ccb4f5e57e25

    SHA512

    c3d927c609a98886737e3e128146726ca397ae9faf5b18958a68c2455e924b5c98b9a51592f33365d3ea948a81735e5d03db0edc38cac354791fd22284c75898

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4TR04CFU.txt

    Filesize

    604B

    MD5

    d20f1bbe20ca20d9855e39526f9627ff

    SHA1

    be65689734fd8b14e1d008002cb269b1c06c30c1

    SHA256

    d9dd8affae4946667f9b098fa85cb36a0f6cf834840908a91f4091bf74586cfd

    SHA512

    59cd4a2dac0e460ea1327e39ca826e547fe356b1461227bfcb8de98e09afec64b51cd53127b11c805ce1ceeb1bb416cf6f5c5b0951078a921f844731d7d7dd24