Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/Cliente.xml

  • Size

    8KB

  • MD5

    5bfccd164d7c1fbd8d104b3c5c96223e

  • SHA1

    9da5fce34ae97f82ba691e510af94def32f63039

  • SHA256

    e950470b23a031ce90ec79b3b1e855e4be5ccf963b8c0cc9f8ac0a2edbe69954

  • SHA512

    dcebca242e1e91cd9248124685687e8bfc56ffa1a5ebd15448ff45aa71f2fcefd77bce10dff5590dfa5bddda82f39b598d8b91d7f220dbe7ffdc1d6ed805e148

  • SSDEEP

    192:t1DwDuDlOm/eaWeyjffsFZNwYIwYSwYAsMN:tpSAklfqMN

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\Cliente.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:800
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\Cliente.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2368
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:4968

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    feebdeb66396c1429087147c6f4d1c9c

    SHA1

    534bc007a73b82907430879aec6a9446dca29de3

    SHA256

    b8d05a0b29633e03c89f89c8c8a35f48acffd59e68decd368548268e9acc805f

    SHA512

    a7ec18f848b7f4e47e9dd7bc73c76bb3ad98f164606b0955c4060a72b8e71d0990fe3c1d24a60cbe9997036770aaa66d6d0c8e834f519fafde228056887ca154

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    72c44edcc4b84895fcf41de2bf3ca532

    SHA1

    411198e26c91cc81bd93752ec84941db3cdc588e

    SHA256

    64d1619820ad1ef2e3e7254741617b3af254cc7a74b1a9b0125b83ef0a849267

    SHA512

    e5b52f84fe5d5b54207bd11af1848a270789e87dd0419fb7ca566aa66a47bd6ed45c1f94b48caf64caa2a3f4ca6065d43e18b61ac6ac533d656f89cb620d3e72

  • memory/800-132-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-133-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-134-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-135-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-136-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-137-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-138-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-139-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB

  • memory/800-140-0x00007FF9D1D50000-0x00007FF9D1D60000-memory.dmp

    Filesize

    64KB