Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    90s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/ConsolidadoVenta.xml

  • Size

    11KB

  • MD5

    7ead2c5fdfe329e66b81a80b37af392e

  • SHA1

    3b2149532ba52bf03be4a5b2831456ba945a4b21

  • SHA256

    9d9ccc2dba3e8604203289ed79c654f7938962cbbdfce14833a3bebbcb1fd028

  • SHA512

    ccf29e8e5cdcafa0dccdd6d7eb297791e736c5fc4c79d56b3b3c60ae82304409c9e9d6f6d28b78f17396108f7c6f5ae4eaec995a879abfd25ea33030e5b343f6

  • SSDEEP

    192:SrDwDuDlOwDyKP2EohaDDWbJrXakJTAZr:CSAkA2EohaDDWdXwr

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ConsolidadoVenta.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ConsolidadoVenta.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3548 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1340

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    feebdeb66396c1429087147c6f4d1c9c

    SHA1

    534bc007a73b82907430879aec6a9446dca29de3

    SHA256

    b8d05a0b29633e03c89f89c8c8a35f48acffd59e68decd368548268e9acc805f

    SHA512

    a7ec18f848b7f4e47e9dd7bc73c76bb3ad98f164606b0955c4060a72b8e71d0990fe3c1d24a60cbe9997036770aaa66d6d0c8e834f519fafde228056887ca154

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    09c527c69a7156f4c3d62de15078d413

    SHA1

    0d35370a2370fab772f09e7be61f1aa91022ed78

    SHA256

    3ff06aeb9544f011fafebcd4446bc4bdd48e109f49e0fbbb46b82ad8c4d39593

    SHA512

    dfe6b6c7ad21fc7cdab62d895d0e9c8b6bf7328afb8c0d388a469cd7815ffdd1f2f6d0e808b4b567d7742baf87da45c1e7dddef13985c85fa6f518211f21db6c

  • memory/4788-132-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-133-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-134-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-135-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-136-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-137-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-138-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-139-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB

  • memory/4788-140-0x00007FFC21EB0000-0x00007FFC21EC0000-memory.dmp

    Filesize

    64KB