Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    177s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 16:19

General

  • Target

    f2ec7e4bcec2d100ae9e25de370a9cf25dbf4e7b7fef1d78167f0f1fc82dc771.exe

  • Size

    1.3MB

  • MD5

    2e2fd6082568c93ade97aa2b0f31212c

  • SHA1

    0b423738a12de1cbcdb3419939b7285e0d1c53ae

  • SHA256

    f2ec7e4bcec2d100ae9e25de370a9cf25dbf4e7b7fef1d78167f0f1fc82dc771

  • SHA512

    14fa151c6589bb05df14a12f6cd8d9fb13afb36fd13d348d5b33fef6b125a35b1b9c9c31548e218d38c63a610106c04cd3701394d539d1465f8cf08e1c8b0a84

  • SSDEEP

    24576:szYXUoX5ji1wa11zOA4JyOQCcg9RequgezwzJkpCECZOdkNd+FCEsgG18bwd:FkAjELjwJ/QtgRuPzwdeVk+01SEd

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2ec7e4bcec2d100ae9e25de370a9cf25dbf4e7b7fef1d78167f0f1fc82dc771.exe
    "C:\Users\Admin\AppData\Local\Temp\f2ec7e4bcec2d100ae9e25de370a9cf25dbf4e7b7fef1d78167f0f1fc82dc771.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1628
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1200 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1884

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

    Filesize

    5KB

    MD5

    d9759e951c2918be831f2c7f49c2764f

    SHA1

    9f37419b16c6047daa368dc434cd8e4b7a4ebdf4

    SHA256

    1fd20ef037a2738cd5000f68bdc7cb24c08acad82432db82c91f237251d5484e

    SHA512

    64c85286293e727fef409ca9b0499c8981745842eaccb88eae737ac674ff20c8ec8a7e5c1bbaa3b1ba834623975b5b67714596f7739de41d9bf6353d3ee0b9f5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\TRD5HT4N.txt

    Filesize

    608B

    MD5

    4ea46f79a0aa25446e10d809b4abc3a5

    SHA1

    5cd640ef83e54fbec0c9b191a521b879e9a04dd4

    SHA256

    8289693a43fd0670f56d8137c7cfd922c148cacfa7f4efba4ad5123a746adf4d

    SHA512

    509b7c9aed2eff56c2599110bc55e4018185cee787034afdd9d5036071284e63c22527f90f9be3a023f753269797e2655a52a02f5c1c83e14f8e507cc59eb52b

  • memory/1628-54-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

    Filesize

    8KB