Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    127s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/ReporteCantidadProductoVendido.xml

  • Size

    7KB

  • MD5

    29cd928e06e4587c0fa49bc244d9d962

  • SHA1

    bc3a71907c24e3f47abdd47aa2a6b45a0d5a4c91

  • SHA256

    55b675c10124877161883c30ee4cfe8b594568f1e452118a529a78c31181b689

  • SHA512

    e73834b1258706211295fc63f50d747b092594cacbc9cdc96e94bd3e2bd60c8e560999809c49f10929530aadbdafbc1b2e71565f51dfa08808972a2620d32efe

  • SSDEEP

    96:TblxGGSfDWnDuDlO/IDBPZRx+7v3kcaTsQvnFvfGZzf1+Y+vIkoWnfW:cDwDuDlOwDBPZRxGv3kca5217WG

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteCantidadProductoVendido.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1944
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2040 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2028

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\P5LPR487.txt

    Filesize

    608B

    MD5

    07377a78a4a24969d75412d1a9e2b019

    SHA1

    d4af1c77ebee96c01308737fe93fead6d243bf66

    SHA256

    4787f14d93afd047006a5f21970565950205614d3c64a51b4015025a7005c446

    SHA512

    0ff01fb8e21b8f410494cb75f867cedc9b3b304f16c7c18941f417813f364b51959ec506182b88f15a8292642af4e176f51ac42cf2f63df2d37c6cc0124a0131

  • memory/1508-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

    Filesize

    8KB