Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    187s
  • max time network
    191s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 20:50

General

  • Target

    b6a445a04bb212b1c172f7562dbc4ce3112eca752eb69c5005ab62f13c05e442.exe

  • Size

    766KB

  • MD5

    c95b228d5864587001cd4313f1f09df0

  • SHA1

    55d728f8215206dc2a1450efe0081f71ba707966

  • SHA256

    b6a445a04bb212b1c172f7562dbc4ce3112eca752eb69c5005ab62f13c05e442

  • SHA512

    48841517cbc5263b13b1b7265ced27201c7a92595c2624fc08368025dd98d3cf087ab16e1c1ef9d3c7dca5d6427eef69f9f2e3cae644d32e5a2761104b2c36b3

  • SSDEEP

    12288:stlYXUCqWjajNRVdKzVCqkxTQjbgA9N7e8hRENKaLQnmHEK92Cla0JxmpLAteOTs:szYXUCNjajNRVdKEqkV3+NPhRhmB92CY

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6a445a04bb212b1c172f7562dbc4ce3112eca752eb69c5005ab62f13c05e442.exe
    "C:\Users\Admin\AppData\Local\Temp\b6a445a04bb212b1c172f7562dbc4ce3112eca752eb69c5005ab62f13c05e442.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1192
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -startmediumtab -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1900
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1900 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1376

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\lwrmjt1\imagestore.dat

    Filesize

    5KB

    MD5

    733638436b75d054bed62d84cd729a4a

    SHA1

    778db4543dcba08d9006f5f513940dedfc09ac1f

    SHA256

    37be284d8cf2ac75a0ceffe38353dc3900f19822cbf7421d3f3e3510a336277a

    SHA512

    1bffc4257af516d048a4ab8d708837d97ac3c5ebba927ae5cb88cd7e055db741b081ffb9085809f96cb155cd5f9c8480507c701e7f7d2403fc023eb949fae08c

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8WRALEYA.txt

    Filesize

    603B

    MD5

    797ba6641008518865ae8027243f2468

    SHA1

    5471ee1ac39b804f514e2f55d568c603b8e30cf6

    SHA256

    cef5f41f7c320f162c189da2fccaa76d82c724959dadd995dcd78186b6939797

    SHA512

    6950a03e0387d95b8e5108405dd85a47398f4f036facc04f9272f98b361462b1007d89a9a0f82545f15b9b62b441b0882f4fd2dfd38807b5703650663a5e7ec7

  • memory/1192-54-0x00000000762F1000-0x00000000762F3000-memory.dmp

    Filesize

    8KB