Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    86s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/ReporteCantidadProductoVendido.xml

  • Size

    7KB

  • MD5

    29cd928e06e4587c0fa49bc244d9d962

  • SHA1

    bc3a71907c24e3f47abdd47aa2a6b45a0d5a4c91

  • SHA256

    55b675c10124877161883c30ee4cfe8b594568f1e452118a529a78c31181b689

  • SHA512

    e73834b1258706211295fc63f50d747b092594cacbc9cdc96e94bd3e2bd60c8e560999809c49f10929530aadbdafbc1b2e71565f51dfa08808972a2620d32efe

  • SSDEEP

    96:TblxGGSfDWnDuDlO/IDBPZRx+7v3kcaTsQvnFvfGZzf1+Y+vIkoWnfW:cDwDuDlOwDBPZRxGv3kca5217WG

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteCantidadProductoVendido.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5024
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteCantidadProductoVendido.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2000 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2092

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    feebdeb66396c1429087147c6f4d1c9c

    SHA1

    534bc007a73b82907430879aec6a9446dca29de3

    SHA256

    b8d05a0b29633e03c89f89c8c8a35f48acffd59e68decd368548268e9acc805f

    SHA512

    a7ec18f848b7f4e47e9dd7bc73c76bb3ad98f164606b0955c4060a72b8e71d0990fe3c1d24a60cbe9997036770aaa66d6d0c8e834f519fafde228056887ca154

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    08a0a0ad24bacee399a3101c6daf801f

    SHA1

    e34da6dab9dd8e00f3bdd6b812859277609264dd

    SHA256

    946efced03ad40e8a06c039224c71f3efd3921b6ef8b2ec1aefe045c5d0b8517

    SHA512

    8d5e33dcddbf0130ce712afd398e56ce610d6872bf425e1b1a46417367ee1162f3dcfbef1d5d39d4d7ee052653072430606c88f2b249e3336922b5ff7e99e266

  • memory/5024-132-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-134-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-133-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-135-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-136-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-137-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-138-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-139-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB

  • memory/5024-140-0x00007FFA91030000-0x00007FFA91040000-memory.dmp

    Filesize

    64KB