Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/03/2023, 10:50

General

  • Target

    https://esignature.odp.om/omandatapark/app/emailsign?link=y2WNao49414Li&tenantId=cd3ad3f8-94b1-45a7-ab04-28b95e0180cf

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://esignature.odp.om/omandatapark/app/emailsign?link=y2WNao49414Li&tenantId=cd3ad3f8-94b1-45a7-ab04-28b95e0180cf
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5104
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5104 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:4416

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\T1506RIB\esignature.odp[1].xml

    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\T1506RIB\esignature.odp[1].xml

    Filesize

    170B

    MD5

    594cf6e0ef56c3bf059d67c389498692

    SHA1

    3370e37d324d9c66fabf413e870545d85442d688

    SHA256

    2059323abe2cb2690740fe8b22fa850aacbd1f59aa87c8ebee7e150921fe8fe5

    SHA512

    4c53412610394fc6a780b9859d642bf8d8d3f46227194e243bb7be85d23656e474bfb686e3acd64bd7786ba740be89b4ef9257e587f792f7185706406ceeb9b8

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\T1506RIB\esignature.odp[1].xml

    Filesize

    373B

    MD5

    6a8b168f8ca0a12038b719bbf6b07983

    SHA1

    79539eef7e1723fec26eecdaa9eee4bb65896db2

    SHA256

    d18d6ecded234f3d840cd74017635f08fae575d088bba3ec7e064ae02edcd0b2

    SHA512

    a806ef55135559b6e5c0e4f61945c47c9492ad75329f839c45d3f8c680961b9faa59be2c4ec3d584b0c4998a7eed966e806e5766f3a201f95f39dd89ba30c8f3

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\T1506RIB\esignature.odp[1].xml

    Filesize

    774B

    MD5

    5eb5fbaf312a060158b85cd0af91941f

    SHA1

    053bf76cf3819d493037acaca3be0b76d484e75f

    SHA256

    7563998b1d7ad46500f7a2ad981987d64a5aad969649d9a22d7d0eb6c3cf7a6c

    SHA512

    08505fb56d3ca416269c19031935043e9f5f74946cf5e098c90f1310da7e60395955dcdb11246b0e1c873efbdaedbcf9703212556763560d3c70a8321909c634

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

    Filesize

    593B

    MD5

    daafeac3f48c843457712b906fcfb0af

    SHA1

    72f74cb9578cd36b02040d1463db9bc15b10af0c

    SHA256

    390ae4ba9a618febbe52fe5e899bc4f78f165fe5aadbed8f44b9cdb8e93e6a8f

    SHA512

    ce1596810e64d3030462125c7681291fafd6d8bff718e21600417b8e89edb53d1dcb6ad929f8734fa2417f6cb9926fe4837092b5b433c7ceb4be59554682c3e0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\favicon[1].png

    Filesize

    409B

    MD5

    5165a2a1d3f9518d08422c0ab6b79df1

    SHA1

    26a0afb25d9b59241419b4994c42bcc8e2b8fe44

    SHA256

    67bc0be1f03a3cd4f4cfa304628447ca7b4cac13921e1be4574a7513839762b3

    SHA512

    4b8bad9bea32d44b1bdb69b396bbaeb47d1d3814ec91e375e5dc968db9a4e0f759c9cad0503a4cf92934d97e416f3956abf4da3dc826086aadf42d251df957d8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee