Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/01/2023, 05:45

General

  • Target

    http://canarytokens.com/tags/images/about/r4wn3tu71ie20r6ptdlfc4iam/index.html

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://canarytokens.com/tags/images/about/r4wn3tu71ie20r6ptdlfc4iam/index.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3388
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3388 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4200
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 448 -p 228 -ip 228
    1⤵
      PID:3604
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 228 -s 1772
      1⤵
      • Program crash
      PID:2052

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\3mhxqpl\imagestore.dat

      Filesize

      8KB

      MD5

      07c0ad4759dbbf867e251e1cfcbb14aa

      SHA1

      bcb779d8232bf521a3f0ee63595ff156b85971be

      SHA256

      25f7fb890197564919a95f113c021f09745a58aeb99930ed8e1375e2340768e4

      SHA512

      38d36afe1c1bd2047d97ca57612b27ec637e126f9237332ab77a94d99c052e45828c09fd4ae9750281413648533538b144bd5bc59f611e2f9e50884095a3a860