Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    68s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    02/01/2023, 18:17

General

  • Target

    Version 0.12.10.2.12893/EscapeFromTarkov_Data/Managed/NLog.dll.xml

  • Size

    294B

  • MD5

    43c1102beda1959e319c8f966b9ae91c

  • SHA1

    57b1ab2baf9955c82006bfb20872f0d1bd86dc99

  • SHA256

    a8cbfd608d70bb3f398d8ce1923ea756de2c4cd016754903bb5fec441b765d7f

  • SHA512

    b37eae918dee12a17124d5e6ffd5c71170717289c170dfc6a06a1455f4c8c35018b45f885ea4b68ff135c8d0e3f6652f3e58b2515de120cb3b526b892ed1abed

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Version 0.12.10.2.12893\EscapeFromTarkov_Data\Managed\NLog.dll.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1152
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1652
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1652 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1688

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\J4JBKN3B.txt

    Filesize

    601B

    MD5

    99d4ac36687df5feace28be24e4fa978

    SHA1

    7321172dc929b7376608ab9a74a09e4bdd86242b

    SHA256

    2eee6e7d431b74a4e84a0b1a4cd67fbe5b8b3d769bf8703743539cf01b518172

    SHA512

    373e55144d0413af81442ea5acf1a7f516d3a72f24a96445435d1242d99651beaf15d73160f5d13e21d62630035b226c1fb95683a96c9841a9f4d5eaeb09d138

  • memory/1632-54-0x0000000075DF1000-0x0000000075DF3000-memory.dmp

    Filesize

    8KB