Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    105s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/KardexValorizado.xml

  • Size

    9KB

  • MD5

    2b1f604ea002ce4e3c93b3462637a855

  • SHA1

    33d8dd4a8b51077177271f99161631329c00e0eb

  • SHA256

    c225ab59d035e039128f7c6e1d0a02773156ccac5ed910d6f5d214f4e14a74a7

  • SHA512

    e4cfbcbbec043840c346b1f073bab80bf5293295fb711bd5b9b06d29168530573f2c07b726b126ae520e4e1f56f8fec6e4f04050ca922acdf08c3b2af11ccb01

  • SSDEEP

    192:XgYDwDuDlOVSyo/4XQKGsbj7p5fwj2TYlpMiwY0EV:wqSAkH7Gsb3p5fwjU8R

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\KardexValorizado.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1012
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2028
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2028 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1692

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\R7Y7ZU50.txt

    Filesize

    608B

    MD5

    93cfcf288e0819b805257d522f4fe7e9

    SHA1

    397181c216074ae9306c5422cde368aa7f78746e

    SHA256

    fe2a58e8fbaa4af157355f8aa5cf6eb64980633521b47d53dfdb15d587305f82

    SHA512

    262cb1adc0023d12a1b561070a3d95600d99a7f603364f3297348b626dc6629d926b9743f44956bcff804847f3b827c552b5d3b5e0ccfcefc93ed5203e61d007

  • memory/1464-54-0x0000000075B41000-0x0000000075B43000-memory.dmp

    Filesize

    8KB