Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/02/2023, 08:17 UTC

General

  • Target

    http:///root/sample/a5dcae27cc6ff19482d237475c3ed2158cb6f128

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http:///root/sample/a5dcae27cc6ff19482d237475c3ed2158cb6f128
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:976 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4808

Network

  • flag-us
    DNS
    151.122.125.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    151.122.125.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
    Remote address:
    8.8.8.8:53
    Request
    d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
    IN PTR
    Response
  • 52.242.97.97:443
    52 B
    1
  • 209.197.3.8:80
    52 B
    1
  • 209.197.3.8:80
    260 B
    5
  • 209.197.3.8:80
    260 B
    5
  • 209.197.3.8:80
    322 B
    7
  • 209.197.3.8:80
    322 B
    7
  • 209.197.3.8:80
    322 B
    7
  • 93.184.220.29:80
    322 B
    7
  • 209.197.3.8:80
    260 B
    5
  • 104.46.162.224:443
    322 B
    7
  • 104.80.225.205:443
    322 B
    7
  • 204.79.197.200:443
    ieonline.microsoft.com
    iexplore.exe
    156 B
    3
  • 204.79.197.200:443
    ieonline.microsoft.com
    iexplore.exe
    156 B
    3
  • 204.79.197.200:443
    ieonline.microsoft.com
    iexplore.exe
    156 B
    3
  • 8.8.8.8:53
    151.122.125.40.in-addr.arpa
    dns
    73 B
    159 B
    1
    1

    DNS Request

    151.122.125.40.in-addr.arpa

  • 8.8.8.8:53
    d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa
    dns
    118 B
    204 B
    1
    1

    DNS Request

    d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.5.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    1817d9f8c83af5a97f742f07f32fac7e

    SHA1

    fac61ba5502036b356304703939a905467a7bd04

    SHA256

    07448a3b03c29db66b8782361cc553ad689bc75964c8070d2cd795d0c03f5268

    SHA512

    b9a071c1eb497a26f837c6826b6c7372cf1403d68a8b7adf1251f069492ec1539199303d13fd46e2fb85692b193ab87492624ed34a51b9cfc92d67ecbd638686

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    f9c1eb7ea81f0c1998a966c8c3278250

    SHA1

    60b2dce9cef7f2e6197152fafd27b6ecbda4b59c

    SHA256

    63e283b3ee06b8570af88a188588221b8751d08ae49acd0949acf519602e1c98

    SHA512

    f614c9b8be75d326f914dc84a9c4ceafa52a28c4d2c3626e2bfb280226be3b8ea4605a83ff54fe0a1c31e0faa972386774701114138df695c453f4a6e4e304d3

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.