Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    81s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/03/2023, 15:02

General

  • Target

    documentXXX.html

  • Size

    221KB

  • MD5

    51307941145d46d180bc778e8e0227d6

  • SHA1

    6029c4bea4041bf301b96f978a61a4a64a7e9f15

  • SHA256

    7ca6c781fbb29e51994470a99240969d98b6183dc2e0b9c7a579354d6630c702

  • SHA512

    b5d0a1ea8e1761dcff97a4994605b732354f8388e8dc012cf542fd6fa37a00d4ce6a8afd53632f65a631b0f0bbf18668b7a769dc5f2c99081ea3732ebaf7f0c7

  • SSDEEP

    3072:LgV3X+Ch9t4xRz0cmIY/Oa8uclVCFwrsxi4QFRyQ0gnTt+o:w3X39t4x5TmIVaOvMfQFr0ghH

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\documentXXX.html
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:636

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    35ad1d3b099e050b63530d552a3037a9

    SHA1

    a41adf95bf82e981994cb143f03a4e490d0c301d

    SHA256

    53b02ee67065d1fd9d950b7c57338b74e0bf510a7a8ebd3f644ee718f235b016

    SHA512

    772317dfe6b966e5f850984ccb8638699ea4aaac5b693539a5f6dab47ef9cf159dfd1777ed07f21252f6f24dd8866b987c17372841f0fa1f4ea9f98030f365e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    96691c485f21d02fc7af5fdb5a8becad

    SHA1

    cac4ef2a9c5e2e560a9ee51384c10066d437f3ca

    SHA256

    40724d2c4961b81bf69078f538c9499d918046930888873ad5d5a5386b5d2db5

    SHA512

    28d5dc214d7fef4424d88e2a8b50dbc8b777ed639cd22bee6217c892a333ee6d6772bb0274df48a62a2425c19f25985c9e26b49bb2a8ec0af2980d5364fdb0bf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee