Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    249s
  • max time network
    355s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 11:02

General

  • Target

    9d97ff80e8242afaeb6c3bb68922fdcc08638b548272c0fac76357cb09cf7824.exe

  • Size

    123KB

  • MD5

    b39940061d2447f0a540529663d47fee

  • SHA1

    3001629764db29162603afc950e5d047abaf7ebc

  • SHA256

    9d97ff80e8242afaeb6c3bb68922fdcc08638b548272c0fac76357cb09cf7824

  • SHA512

    edff241233bd07b560329131ededb54bc41244e5b69fdfe83068901a8b3ff9296b90f5fbc4c46dcec7551908af6ba1828f2bfe13f5e1d8dd8598de846b45e97d

  • SSDEEP

    3072:mK6xkMtbYAaH2EOCLb0An/VtdcOJrclgTjJ:jeztbYACECdLSKjJ

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d97ff80e8242afaeb6c3bb68922fdcc08638b548272c0fac76357cb09cf7824.exe
    "C:\Users\Admin\AppData\Local\Temp\9d97ff80e8242afaeb6c3bb68922fdcc08638b548272c0fac76357cb09cf7824.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1644
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1812 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:916

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\MXXPU517.txt

    Filesize

    608B

    MD5

    9c8332b95507b8839efa48daebf18647

    SHA1

    5f81ba664eff25869f17fdfcb8ef20be08f4ddb2

    SHA256

    7b48d954030907054a2870d9ce493af3656d40933983a19e1d88c08be26dcbef

    SHA512

    61afae52935a8bdaea06b9e15c74aad0212d374d71d0bb535f22b31a3868f2618d87a8e4c8ee4f5cf0a66f4a9c3d5028e37fa4cd33c756dc30127f37397ac0f4

  • memory/1644-96-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-56-0x0000000076581000-0x0000000076583000-memory.dmp

    Filesize

    8KB

  • memory/1644-57-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1644-60-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-62-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-66-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-68-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-70-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-72-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-74-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-76-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-78-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-82-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-84-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-88-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-92-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-54-0x0000000001D60000-0x0000000001DAE000-memory.dmp

    Filesize

    312KB

  • memory/1644-94-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-110-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-100-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-102-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-104-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-106-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-108-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-112-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-114-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-118-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-116-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-98-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-90-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-86-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-80-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-64-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-121-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1644-122-0x0000000001DB0000-0x0000000001DFE000-memory.dmp

    Filesize

    312KB

  • memory/1644-55-0x0000000001D60000-0x0000000001DAE000-memory.dmp

    Filesize

    312KB