Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    74s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/KardexValorizado.xml

  • Size

    9KB

  • MD5

    2b1f604ea002ce4e3c93b3462637a855

  • SHA1

    33d8dd4a8b51077177271f99161631329c00e0eb

  • SHA256

    c225ab59d035e039128f7c6e1d0a02773156ccac5ed910d6f5d214f4e14a74a7

  • SHA512

    e4cfbcbbec043840c346b1f073bab80bf5293295fb711bd5b9b06d29168530573f2c07b726b126ae520e4e1f56f8fec6e4f04050ca922acdf08c3b2af11ccb01

  • SSDEEP

    192:XgYDwDuDlOVSyo/4XQKGsbj7p5fwj2TYlpMiwY0EV:wqSAkH7Gsb3p5fwjU8R

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\KardexValorizado.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\KardexValorizado.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2652
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2652 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3580

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    feebdeb66396c1429087147c6f4d1c9c

    SHA1

    534bc007a73b82907430879aec6a9446dca29de3

    SHA256

    b8d05a0b29633e03c89f89c8c8a35f48acffd59e68decd368548268e9acc805f

    SHA512

    a7ec18f848b7f4e47e9dd7bc73c76bb3ad98f164606b0955c4060a72b8e71d0990fe3c1d24a60cbe9997036770aaa66d6d0c8e834f519fafde228056887ca154

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    2cb16491bb00ccd82a3877a3564fad85

    SHA1

    d9400e1214a20ef54220b760736a1fab1e8778c2

    SHA256

    ec909a9a8d2c9d9b557d13d90b9476015aa57b88049ea9b33fbcc4d356848ae4

    SHA512

    61173a39b0c4461e134980da14cce24874552d55b94c8d87d19c50bdb1e43c585ae214bb063fafc846caee2203b13759d41ca6a4854c90b4a73a00fe3baaad77

  • memory/3340-132-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-134-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-133-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-136-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-135-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-137-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-138-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-139-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB

  • memory/3340-140-0x00007FF80BCD0000-0x00007FF80BCE0000-memory.dmp

    Filesize

    64KB