Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    68s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/12/2022, 12:49

General

  • Target

    https://github.com/NET-FrameWork-x64/NET/blob/main/NETFramework.zip

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/NET-FrameWork-x64/NET/blob/main/NETFramework.zip
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2128 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2072
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4540
    • C:\Users\Admin\AppData\Local\Temp\Temp1_NETFramework.zip\NETFramework\start.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp1_NETFramework.zip\NETFramework\start.exe"
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3076

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      ef882f1932c9dd68c8afda2ebc27364b

      SHA1

      4593fc073e078220e8d3e5fb6cf205430119c058

      SHA256

      5144288105e9dfc259e9526551a92ff8f2edf2c15f395c4b3948930139bece23

      SHA512

      abed9efc412039e8364507af7c857e2bb88ded864ef4d7754e6b4ea4ea750217954a672efb3a6c663498858e5c7660a33b02891f0f0d2b11a9616bd7c138931c

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      434B

      MD5

      85ab411902c3da30da263b023e362276

      SHA1

      604d80259be0eb5932fbeb39bd839279728d112c

      SHA256

      376fa0925d3842a578291e2589e763f695c731d17da775dfb37b691ae3cbea4c

      SHA512

      e582bf38a0c581b86500a3b39b0ccbf1b951d9305075be860a233d47e2d32332f202ce153aba19fb3451853e03a6eb11586b59cd8345d7151e91030af0d87993

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ckj4gk4\imagestore.dat

      Filesize

      1KB

      MD5

      e94327f5b744beaf7d16273951a9b205

      SHA1

      b53273a636a90c3caa842ab4f7ab3ce37c442fe3

      SHA256

      96cf0539318d619515351ba953740f7709ae25b5a1af654319e6ce3e54dbe7b3

      SHA512

      044801bc5133c6e02c6c4d0097da2059a8760ade804bb95bf80d9053385f45aeb5e2202245efe2c351b9d9397bff0a0df83ed2d7952bad041b06ebac9cfff878

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\ZX6MAMIN\NETFramework.zip.yit75er.partial

      Filesize

      158KB

      MD5

      6ad0d1cb0da4f71f25c64871b027f274

      SHA1

      31f2a1359c4109c11da58acdb1e13f8172c4158c

      SHA256

      3389836d9b94dc5f1e6b73f313b09516bbf74df96965e33fcf0e3b5888220f3e

      SHA512

      3ee5f42795814972a0984f2f7a5ab3d3ada13f529df741d611c07deb24a7353620de6e4ab558ba0d13b8357e19bf4e802164b878800ad4bc3271b0b152f3c082

    • memory/3076-134-0x0000017B375C0000-0x0000017B375E2000-memory.dmp

      Filesize

      136KB

    • memory/3076-135-0x0000017B1E960000-0x0000017B1F421000-memory.dmp

      Filesize

      10.8MB

    • memory/3076-136-0x0000017B37AB0000-0x0000017B37AF4000-memory.dmp

      Filesize

      272KB

    • memory/3076-137-0x0000017B37B80000-0x0000017B37BF6000-memory.dmp

      Filesize

      472KB

    • memory/3076-140-0x0000017B1E960000-0x0000017B1F421000-memory.dmp

      Filesize

      10.8MB