Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    191s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 11:41

General

  • Target

    fe1b0398a97686d5538a9922e81b4cc3518332bf479d5d644f801bfad14089b0.exe

  • Size

    1.1MB

  • MD5

    34e35c911a4ea707fcf1f1047c998a61

  • SHA1

    ca9a16f65a67733cc1bdfa9c0ea4ececba95a80d

  • SHA256

    fe1b0398a97686d5538a9922e81b4cc3518332bf479d5d644f801bfad14089b0

  • SHA512

    d8cb8b1e5e56ec79583f419d10ca7ec7c0d77e51b7b20403d6df1b61ab7c88545ec2a5ad6e0deede461b9aee191112f92a5cede951181bc1c067155cc6bd71d4

  • SSDEEP

    1536:y01fkUy48TqafeC8KbxZDxX7mKtHEBr2h25NACTARjc7P8RvegSU0fh:118UyR+weCrFZDQKCr2h25NCj0P6vwfh

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe1b0398a97686d5538a9922e81b4cc3518332bf479d5d644f801bfad14089b0.exe
    "C:\Users\Admin\AppData\Local\Temp\fe1b0398a97686d5538a9922e81b4cc3518332bf479d5d644f801bfad14089b0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1440
    • C:\Users\Admin\AppData\Local\Temp\fe1b0398a97686d5538a9922e81b4cc3518332bf479d5d644f801bfad14089b0.exe
      C:\Users\Admin\AppData\Local\Temp\fe1b0398a97686d5538a9922e81b4cc3518332bf479d5d644f801bfad14089b0.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fe1b0398a97686d5538a9922e81b4cc3518332bf479d5d644f801bfad14089b0.exe&platform=0009&osver=5&isServer=0&shimver=4.0.30319.0
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:580
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:580 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:112

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FENEV4D1.txt

    Filesize

    608B

    MD5

    bb0811079f586e16cbca2c09376e542f

    SHA1

    4cbabf2a22a0bed304da64cf2f3ec7dbced510d1

    SHA256

    f44a4e16ec72745e14740f167a4aae9c8c5cc57880afa74027efa1fe4e1e0a3e

    SHA512

    a48d2e39801cf19ee3b53e6772ebd0ef6ef7171539101fee51a9ca170cda0e0db44e1c309cedd91a766df3f9766f88be721a579b7367db8e9cde21e345cb624a

  • memory/1712-56-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1712-57-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1712-59-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1712-61-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1712-62-0x0000000000400000-0x0000000000412000-memory.dmp

    Filesize

    72KB

  • memory/1712-66-0x0000000000402000-0x0000000000409000-memory.dmp

    Filesize

    28KB

  • memory/1712-65-0x0000000000402000-0x0000000000409000-memory.dmp

    Filesize

    28KB

  • memory/1712-67-0x00000000766F1000-0x00000000766F3000-memory.dmp

    Filesize

    8KB