Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    131s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/12/2022, 04:39

General

  • Target

    Instalador SisFarmacia V4.0/src/Reportes/ReporteDetalleVentaDiaria.xml

  • Size

    11KB

  • MD5

    f437bef02d8da2fad26e19b3730a548b

  • SHA1

    aa22e2c1b4b0fdb41f106cbb9eba500042373347

  • SHA256

    508ba9c7626a5e89749b3da7c896a91a486c42bd6de7f1bbac4eb8fcc354450e

  • SHA512

    6b217124aa4d54638ad072fb68c349b162ac5af58e6b152ec2b5e0d96624663034f3cf4f3b15e38447a9cd46d1a1f61ac0e029b257f9601e2b1d1a7cef21684f

  • SSDEEP

    192:tdDwDuDlO4b5CzNY/D0ZFyP/V9uVykYvXpvd1DPol9ThVBX:tBSAkMczu/D0ZFyP/Xu4kYvtY/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteDetalleVentaDiaria.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\src\Reportes\ReporteDetalleVentaDiaria.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:952 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2184

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    feebdeb66396c1429087147c6f4d1c9c

    SHA1

    534bc007a73b82907430879aec6a9446dca29de3

    SHA256

    b8d05a0b29633e03c89f89c8c8a35f48acffd59e68decd368548268e9acc805f

    SHA512

    a7ec18f848b7f4e47e9dd7bc73c76bb3ad98f164606b0955c4060a72b8e71d0990fe3c1d24a60cbe9997036770aaa66d6d0c8e834f519fafde228056887ca154

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    0c83d71dda70a22367ef81a5b2575db7

    SHA1

    eda487151c4425d57225a5d40c95febb914fb585

    SHA256

    898dbb8328190dadf3339091f648fee14298d471eb1e0cff2e00aff6d0c49b60

    SHA512

    1988995bea44e15bdb962e8eb7a561da1108d94bcf3b04defa2fdbe48231dd6d7e32005a6887a630b36d627246cc2aaf02e5fb2d97d2c84602e68b562bc73d47

  • memory/2252-132-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-133-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-134-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-135-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-136-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-137-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-138-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-139-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB

  • memory/2252-140-0x00007FFE83C30000-0x00007FFE83C40000-memory.dmp

    Filesize

    64KB