Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    55s
  • max time network
    61s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2022, 01:02

General

  • Target

    http://cu005.www.duba.net/duba/kisengine/com/1335/kxecom/vipapp/officetemplate/packages/17701fb997cd16b16af448a6be3660e8

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 32 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://cu005.www.duba.net/duba/kisengine/com/1335/kxecom/vipapp/officetemplate/packages/17701fb997cd16b16af448a6be3660e8
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1504
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1504 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:792
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MK8YK3QV\17701fb997cd16b16af448a6be3660e8.txt
      2⤵
        PID:272

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MK8YK3QV\17701fb997cd16b16af448a6be3660e8.txt.wq19vb2.partial

      Filesize

      164KB

      MD5

      85acdb9034af34fc946d17174d77c25b

      SHA1

      f11f157c1db4cb1953f812b9bd8bb8313be9fb5d

      SHA256

      a3d845a09878baba9704b19579e9bd32795e2f1bccc2d7c51f0eee42b0b293d7

      SHA512

      3c45fc01b2944c853cbce02fdd7e9711aec39063c1b776226b8522e5d467dc38d129aa98b078cf5cde1ed9e32cfafea61693c5bc10319de51514bb1325de6d55

    • memory/272-56-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

      Filesize

      8KB