Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/01/2023, 15:26

230111-st6fyahc2v 1

11/01/2023, 15:20

230111-sq37eadd28 1

11/01/2023, 15:14

230111-smrn7sdc95 3

11/01/2023, 15:12

230111-sk7yeadc88 1

11/01/2023, 15:03

230111-sfc78shb61 1

Analysis

  • max time kernel
    150s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    11/01/2023, 15:12

General

  • Target

    https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:288
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:288 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1664

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    340B

    MD5

    07635cd5697a1676af8a345e0ebc69d0

    SHA1

    6fda20e364fa28f51428a776ace806bbf0ea3f4a

    SHA256

    645afa63fbd93a967aeb4e1f196d2dbbc8b9de2e90c0a208cc81f8ec178e0982

    SHA512

    77470637ade1d1e706eaa5857494dd4dc516534444d323d54a91509df2efdad2964712efc9bd482daf2db88df6e804b2e62dcc8461e08e7491086bc36583b4b4

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\1evexod\imagestore.dat

    Filesize

    5KB

    MD5

    77e3fc9c6eb0f91cd721cc5d3dfdd2c0

    SHA1

    91625507bcce6d0e605936455d3a95a18deebe32

    SHA256

    7e3353eac445a111d252d7686c043fe54cd10e3afdcb49469d20cb1efc124589

    SHA512

    4c06dad3a15b0d49c1e99b05d011be7ee6511633546f312350d5caac7b71e63757fe06cde2792d479b4f46c608a354f8436a44c22009ebd9b0a0ea3959ea38db

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KIV9VAXJ.txt

    Filesize

    606B

    MD5

    8aceb5e94137d6fd135e9260c288b7b0

    SHA1

    d5f1834ada7f0327690f0f7ab851a4136159bb1a

    SHA256

    896f1df82f5aaa4433b466836129d4c7122ff9b1def53c2225ac3221047509bb

    SHA512

    b708ba5a79ca5067225d8fbb18d1247c63cf06b06ff4c2adabae4911f08b5e3792fa7c2b7f3b1d8439c6591e24df4d1b72cf543f3e75abc6bd5a777baa4c160b