Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    73s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/ReporteCaja.xml

  • Size

    4KB

  • MD5

    6004da1a6a558e2fce38531938cefde3

  • SHA1

    7f470e19a3982788eb7cc3d07188b6b96d359a17

  • SHA256

    d347765345bb03642e12aa3cb09f04e1f09657a9e60bea2abc72760721cf93c4

  • SHA512

    bea8d3224faf9211864e95a81d8a753a35a73ac43757e04d26899579f71a29065612dbd453912e4a33db4897649fd893f1c0ca44c3d495e47053ed795eeb9260

  • SSDEEP

    96:TzkxGGS+EPPmfmgjwYMIIHODm1cfIK1p1c+WriDOs3pFVk6:NPPmfmgjwV51cfIK1p12ri7pFVk6

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteCaja.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteCaja.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4700
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4700 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1452

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    feebdeb66396c1429087147c6f4d1c9c

    SHA1

    534bc007a73b82907430879aec6a9446dca29de3

    SHA256

    b8d05a0b29633e03c89f89c8c8a35f48acffd59e68decd368548268e9acc805f

    SHA512

    a7ec18f848b7f4e47e9dd7bc73c76bb3ad98f164606b0955c4060a72b8e71d0990fe3c1d24a60cbe9997036770aaa66d6d0c8e834f519fafde228056887ca154

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    afdab8b7d65571d246baf0c6aa8b3b41

    SHA1

    5738eda0401c24c142fd2e0896a7d75b0093d99a

    SHA256

    dcfd885f30174dc862b869476d49ef65d0cbae6ebdd74b541d5012f34ceb75c2

    SHA512

    c32f32e9320c8b5ad98d2d6a7de395aca7173738b1db1246b21388e730289e33ccbbff783f3056a194f16b4f829215b8eee736d58335e91107cebddf8e07b816

  • memory/2072-132-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-133-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-134-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-135-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-136-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-137-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-138-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-139-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB

  • memory/2072-140-0x00007FF84E110000-0x00007FF84E120000-memory.dmp

    Filesize

    64KB