Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    98s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/ReporteCaja.xml

  • Size

    4KB

  • MD5

    6004da1a6a558e2fce38531938cefde3

  • SHA1

    7f470e19a3982788eb7cc3d07188b6b96d359a17

  • SHA256

    d347765345bb03642e12aa3cb09f04e1f09657a9e60bea2abc72760721cf93c4

  • SHA512

    bea8d3224faf9211864e95a81d8a753a35a73ac43757e04d26899579f71a29065612dbd453912e4a33db4897649fd893f1c0ca44c3d495e47053ed795eeb9260

  • SSDEEP

    96:TzkxGGS+EPPmfmgjwYMIIHODm1cfIK1p1c+WriDOs3pFVk6:NPPmfmgjwV51cfIK1p12ri7pFVk6

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteCaja.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1080
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:672
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:672 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:568

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\W3GGHT6F.txt

    Filesize

    608B

    MD5

    86124ac16e00bcd266ac7d4c1899ed85

    SHA1

    e4bf65cc7d7d5a63f258e8d6bc978fb8af6bd045

    SHA256

    14e472367a08c5d437819fb17f0a1968b941b372c25dcf61915ab6f455ba8062

    SHA512

    5d5b50cc10978f4ee0d88d3159ab2db5d93e54a516c0742dad637d18040a67fddaaf38f0d3501c4f0f03fb22642686ea4e9dc43ad473651614563b63861a8833

  • memory/1748-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

    Filesize

    8KB