Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    128s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/ReporteDetalleVentaDiaria.xml

  • Size

    11KB

  • MD5

    f437bef02d8da2fad26e19b3730a548b

  • SHA1

    aa22e2c1b4b0fdb41f106cbb9eba500042373347

  • SHA256

    508ba9c7626a5e89749b3da7c896a91a486c42bd6de7f1bbac4eb8fcc354450e

  • SHA512

    6b217124aa4d54638ad072fb68c349b162ac5af58e6b152ec2b5e0d96624663034f3cf4f3b15e38447a9cd46d1a1f61ac0e029b257f9601e2b1d1a7cef21684f

  • SSDEEP

    192:tdDwDuDlO4b5CzNY/D0ZFyP/V9uVykYvXpvd1DPol9ThVBX:tBSAkMczu/D0ZFyP/Xu4kYvtY/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteDetalleVentaDiaria.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:892
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1116
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:844 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1984

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZHUE3VBV.txt

    Filesize

    608B

    MD5

    0a2d12c176c570678dbf07c8b7e4cb95

    SHA1

    836638e2014bfa14892f5209d202267ddf124e59

    SHA256

    7adbf5feeb7a68ee9242392afcc45dfe4b7b3c66aa12285340021c273b0f7415

    SHA512

    a13d255705efdb5b19b5b9be5d827f5a8a5b643fa377daca2669c2bdd6ace857b7bf980ea498ca07fccaa36e3605b223514e225a580f87075e71befe48cd8e7e

  • memory/892-54-0x0000000075141000-0x0000000075143000-memory.dmp

    Filesize

    8KB