Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    09/01/2023, 19:46

General

  • Target

    lifeshareok.org - ACH Receipt.html

  • Size

    167KB

  • MD5

    ea5c7b90ffe89a778e6e8129cce8fe8f

  • SHA1

    836a29a950f350470a7cd556c5463b805e1272ef

  • SHA256

    82a79693d92cdb9b3b5e12d6a2b867e1e1976631256242f4eb3692a2c3033f77

  • SHA512

    d5fbbba7336d046cd0a7d5630bf7588ebe14dc523ae54500c013bbe000cf5b01804b25420c4234887a700323048463b891ba695a1bb53e352dc18fee2f8d17b7

  • SSDEEP

    1536:6n63sTT5Uxw6BaZReI9B5POziz23hpgzF/TgfinmwrZjO4XM4XQOdxxoeoHpEyIf:6l

Score
1/10

Malware Config

Signatures

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" "C:\Users\Admin\AppData\Local\Temp\lifeshareok.org - ACH Receipt.html"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1896
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" "C:\Users\Admin\AppData\Local\Temp\lifeshareok.org - ACH Receipt.html"
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1932
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1932.0.1171227331\782121131" -parentBuildID 20200403170909 -prefsHandle 1172 -prefMapHandle 1164 -prefsLen 1 -prefMapSize 220106 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1932 "\\.\pipe\gecko-crash-server-pipe.1932" 1240 gpu
        3⤵
          PID:728
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1932.3.1442469229\1663810101" -childID 1 -isForBrowser -prefsHandle 1580 -prefMapHandle 1656 -prefsLen 156 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1932 "\\.\pipe\gecko-crash-server-pipe.1932" 1760 tab
          3⤵
            PID:1692
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1932.13.290086914\1464160300" -childID 2 -isForBrowser -prefsHandle 2888 -prefMapHandle 2884 -prefsLen 6938 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1932 "\\.\pipe\gecko-crash-server-pipe.1932" 2916 tab
            3⤵
              PID:1664
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1932.20.2029704974\1756887122" -childID 3 -isForBrowser -prefsHandle 3364 -prefMapHandle 3360 -prefsLen 7643 -prefMapSize 220106 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 1932 "\\.\pipe\gecko-crash-server-pipe.1932" 3384 tab
              3⤵
                PID:2068

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads