Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    186s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 07:48

General

  • Target

    使用说明.htm

  • Size

    2KB

  • MD5

    f167320d5d11be52e7332b943ccf0bf8

  • SHA1

    aa265bc6fb9043ac4729a5bc8aca338be0022e2c

  • SHA256

    6cff52f54f3d9c0de6e0b231d3cc06a4ea8ea4c15fe19e20f57da2ad77369bd9

  • SHA512

    f94dea5edefe16b06c7fe2366ac24001fc7ffd709a5971bae9bee5fc12164310dfc460c733ab48f83396dcde318d7948ff961d007bdbc78bcd8aa9a9101c899a

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\使用说明.htm
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1236
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1236 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:472

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ba78a08684beb19d975f60d7abc5a8c1

    SHA1

    596c9960124c43343a7d1e699545f5e602d683c0

    SHA256

    76ceffa42e8a3b3ddd0f6284a11404a71a3c70a6912b688268427fc202d8ab2b

    SHA512

    6bc00901aa6c770e1c6156222e0cdd3c4a4a02bc24f5305f83fc81f3fa765d2e86b0deff9412dde49dc64284257fa604cab2cb6182afeadfbd6e02b1db846fef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c209dfeb8b0a2b8b25e13fd7f2109849

    SHA1

    b18fc3a10a31f895d2c52d0f2520ddb4156c67b0

    SHA256

    e73cf4c57ed68e6c16bfd4e08b700e6a4c564fffb65195fe25eaac798ba04d34

    SHA512

    3b390c851c4bbf167183e2e902c6001489311ccff87df89d8263f1d327d1487cb928648d0b1fbc26a1c66bcfac27e74757927a9a76c77fce8a4e043ed5ac20fd

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BF5PV9WA.txt

    Filesize

    608B

    MD5

    b5bae673b4d2b99d1ba094bf11c78af3

    SHA1

    03f3ff3d4f5fb2bcacc0820b4249e23d60a01ebe

    SHA256

    8923d6a6cf6f440f64e0143fbac92c5f62d443a61871ef4cbbda285f0eeab47f

    SHA512

    120cda5617a4540c9df4b717cc78c6ecea666dc14e71ad51769a7e07a4d4cd073620975f0a6d69a8ae256441d16ddf65c922d3edc517a7fd3c230ef5a49f32c4