Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/01/2023, 15:26

230111-st6fyahc2v 1

11/01/2023, 15:20

230111-sq37eadd28 1

11/01/2023, 15:14

230111-smrn7sdc95 3

11/01/2023, 15:12

230111-sk7yeadc88 1

11/01/2023, 15:03

230111-sfc78shb61 1

Analysis

  • max time kernel
    79s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/01/2023, 15:14

General

  • Target

    https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://github.com/LeandroCostaAnalistaTI/Ferramentas/blob/master/Planos/Ferramentas_UsandoRoot.sh
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3124 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4700
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 472 -p 3756 -ip 3756
    1⤵
      PID:2012
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3756 -s 1748
      1⤵
      • Program crash
      PID:4780

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\xyoggsx\imagestore.dat

      Filesize

      1KB

      MD5

      e200e45a4bd94487ca17b747689ef9e4

      SHA1

      c52500bb0f6086f957669588fbac6c314cce55c2

      SHA256

      276c178885e22aa1f54b70ba74a6d66541caf1bd18e49b89598fc53c59ef1af3

      SHA512

      5e81f7dd6389520673cac24c276ed2e24476d0088f5e53ea40e9c04d86bed8815805a6860b149b1cdf42b72486ae0a1c44bdb8c2f4e039f89e4f1ed01f1ddca9