Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    77s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/InventarioValorizado.xml

  • Size

    5KB

  • MD5

    b30a78d54e371166be237b95920b0dfb

  • SHA1

    da79089e43678bf189a9da1e0f47ab529b857a3f

  • SHA256

    961c3821cdf4630d728cecb8a7d79d1a339f452db336d18b13a95aa4a5b5903d

  • SHA512

    74c2395320ed6b82395a4682d3f11228802e105cebfc13f3a7744374616eb80bc0f46d62ab15e0c13dcddd14396b4ee1160376eabf5c7663f7bd0f84199b0ac2

  • SSDEEP

    96:TxlxAjUGSfDWnDuDlO/n4oQZZSGvWbmsCIUh7Jo:xDwDuDlOv4jZZSGv4nC9h7Jo

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\InventarioValorizado.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:624
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1348
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1348 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:960

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\45NI8MU3.txt

    Filesize

    608B

    MD5

    5c9b7288aa5fd10ad7ed994f8b637387

    SHA1

    40e62a5c883fe439e46d9b68a323341138211a84

    SHA256

    bf10e38eddc1b8fadb899c742a1f0f6916073f37fa22e6e35218e4fa145dedfa

    SHA512

    fba672e1d7d5a8fcc85f093efb9ac9ef7e87b257615621a3dddcb6876ea532d81a356fbe656319ef4013c27b6699641f132a8d6ebec78155e026169fe0e1210b

  • memory/1648-54-0x0000000075811000-0x0000000075813000-memory.dmp

    Filesize

    8KB