Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/01/2023, 13:00

230111-p826aacd87 1

11/01/2023, 12:34

230111-pr3qgsca47 10

Analysis

  • max time kernel
    332s
  • max time network
    334s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2023, 12:34

General

  • Target

    http://steamunlocked.net

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://steamunlocked.net
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1292
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1292 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:764

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f62ec966be81535946264bfcc7bf70f7

    SHA1

    107c53647e299592d2d7d5c04eb70219ec309197

    SHA256

    207bd3dbea50923df2aef2d702e5f9856aff3445846b48d1d237fe62c78b61bd

    SHA512

    b8fddf068d76da7ca69087490b3efc387cd6af134940f7e3be7fefa4b42584d4eea2bde92924370646e1c24eb4e3e53137867edd4fd6eeba8e0c1f314942d9b4

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t9o3c8r\imagestore.dat

    Filesize

    852B

    MD5

    7b8a8078299adcd7d230209ce67746c3

    SHA1

    2ecd6ccce6ada57b4deb3a411dceaf7cad6ad49d

    SHA256

    a38b72d5d8c0d98e90632d7dfe423faf1838f3a29f4b5e73b437806caddcbf43

    SHA512

    f3bd48ad7b5a7ad35b99099ee610d23ec8b260a3021133374dd3b6535b7342c3bb33484315ff8968a4d4d554cee124a9107414c98a0debe573e69da59eb967b5

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\O2QLT20S.txt

    Filesize

    608B

    MD5

    5aa7e32396b807201afd0524410ca9cd

    SHA1

    5d204b09848849e3ad050fa81891dd371299ecaf

    SHA256

    43ef9042786f5d791c2982f19d553cf154780e4b996cff8bc9f557f1b37ea4fc

    SHA512

    9e1543747f09845c876f9a34861e368f0932fd25407e9de22d1ba27f2bd194f340ff93709e712a143fdc993eb7b8727ed7d5d3c3a331f5c44f948b207839dbed