Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    78s
  • max time network
    86s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2023, 11:36

General

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand microsoft.
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://brighthardwaremart.com/jj/auth//fnesqt3/[email protected]
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2144
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:3540

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2EVPX1DZ\www.google[1].xml

    Filesize

    99B

    MD5

    eb574a85160800fe8ddb5507329fe98f

    SHA1

    4127f65d42e2367bb19c69923968ef80b74cd29d

    SHA256

    facc6404ef4d05796e129c57064bdd63b9a7ef099165ad44fa585f48621069f9

    SHA512

    f223db2fd5dcf9bde986d853072ca5c329582a0621cf17066b4f11fd971b3f934c717549af2bed3f743b4ecacd6613eecc3e46f2bae9cd6f7bc55b58d48fc136

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

    Filesize

    17KB

    MD5

    d0e9df0400358d19a2a0b5ceb8600431

    SHA1

    416d1fe2668fe86b9062dc9414dc2f258be9449b

    SHA256

    7fd4a7475a910c5dd9dd6c9af233b0ac3293ad567af422b2df6a6635350b1fd0

    SHA512

    c990be22bc45cb21f9898132834dd6a18b69141c0f52cd15ef9d7610cc1af9ee3422edd08d12e677dc9fd1177d1a023e12476c8b50dbdc221e920a54cd421536

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

    Filesize

    17KB

    MD5

    9fd6a8b960e34da6877f15c3678aeb7b

    SHA1

    ba3695632ca6f658661c317cd16d2f79e3897658

    SHA256

    76082ffbc825783e70452b2f7be686b69cf5a41556a7c8ca5cddd2f7d33bccd5

    SHA512

    6707a1b7cd984d822efcf0095656bb11625b08a21c8ef0f22f0c6e6fa7154e5c68bc45144a893de8ec0a6d0ba963c8ea3abed7493d7952ca046e7374f2cf9e90

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

    Filesize

    35KB

    MD5

    a5dfa8b31939205316bdc97e7d1e7131

    SHA1

    5b889c44f30da02142f75760d0916257ea8cddd8

    SHA256

    b1f496241ef7f966ba45d5632ad549869ecf3c28d9d7c70af9d81005368aadfc

    SHA512

    06a02bc77e7738a504366ae59aca49ec486f0e4aba4fe70d6cdeb457133fa4f4afe589caa55692a0f872c4f1040a4bb1fac9ecbf98da0795ac49bc0df91fb3f7

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

    Filesize

    53KB

    MD5

    8faa3eea74582963da045809e11ae32d

    SHA1

    9ff88b6c62d881bfc19c91a413d2db63232ea674

    SHA256

    5c91691ec1bd898e1b72759489b9f94b7e27975b00729039bb6850b4159d9df7

    SHA512

    9a83e54e9caf72f83f172b1ee6d93baa89ac395a1edf68d37f4991f52d81d8a423974e14eeca099c627470e764bce6100bade8d7e591ecba14e7aa67f22aee3e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\bootstrap.min[1].css

    Filesize

    118KB

    MD5

    ec3bb52a00e176a7181d454dffaea219

    SHA1

    6527d8bf3e1e9368bab8c7b60f56bc01fa3afd68

    SHA256

    f75e846cc83bd11432f4b1e21a45f31bc85283d11d372f7b19accd1bf6a2635c

    SHA512

    e8c5daf01eae68ed7c1e277a6e544c7ad108a0fa877fb531d6d9f2210769b7da88e4e002c7b0be3b72154ebf7cbf01a795c8342ce2dad368bd6351e956195f8b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\bootstrap.min[2].css

    Filesize

    137KB

    MD5

    04aca1f4cd3ec3c05a75a879f3be75a3

    SHA1

    675fcf28f9fbf37139d3b2c0b676f96f601a4203

    SHA256

    7928b5ab63c6e89ee0ee26f5ef201a58c72baf91abb688580a1aa26eb57b3c11

    SHA512

    890415fa75ed065992dd7883aed98bfbdfd9fa26eec7e62ea30263238adca4eecd6204f37d33a214d9b4f645ad7d9cc407d7d0e93c0e55cf251555a8a05b83ff

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\jquery-1.8.2[1].js

    Filesize

    259KB

    MD5

    3a316818411b5a80ef878dc5c8483950

    SHA1

    a0f48b6ad5322b35383ffcb6e2fa779b8a5fcffc

    SHA256

    cfa69516375e27e56519cae71f28818e0e52515b70e705a600d1db459998335a

    SHA512

    68cce216cf4af7c89f85d141cfcb16d448edc1f542314b6e2031789480ecf0921acd91b20d3cd70dd5af89dc2cd2d27f78bca2336967fc2e8d72fa76a996ed7d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\recaptcha__en[1].js

    Filesize

    402KB

    MD5

    d845a78faba657b37df89294db2eaa41

    SHA1

    871848d88f11d71e85f245957bd6c9bd93f29f10

    SHA256

    c5bff966f57c4e61aabbe35e5ce3ff49e5f370233d790fae7263789a9b842362

    SHA512

    ce3d53bd964508a40ed1702144dea6be58b0ce6eee082fa42e834998dc8f1eb018616587e339c35b2d7212ff53e33ec860cd8e55696f63993a518e988edae5ad

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\style[1].css

    Filesize

    10KB

    MD5

    da466f7f49a0083677dffa6deb04ff16

    SHA1

    56229a95d3b045a4ac397516b080fea2cae04879

    SHA256

    18369f4d03f6b6835da2e385997fb6d417dd7663f5834523193c9d63b8460328

    SHA512

    57e567863c990dae6cbcaf7d0c10cc888d74a0545916309259827c6b16c7a3fc78177241bed874c5cb50529e64eeea54d46489a1a88e49dc60400f1c25e91f8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\ConvergedLoginPaginatedStrings.en_VfIPK_64tP1dRcjOzguXmQ2[1].js

    Filesize

    35KB

    MD5

    55f20f2bfeb8b4fd5d45c8cece0b9799

    SHA1

    0be0d5bc479f6855967cfcbd35ee8872a902be00

    SHA256

    d5a4c4f10aca63d1ec42a00ece6f80d5541b1bac17b8321e00470ad0436bbcee

    SHA512

    b097c97173e45654f85aecb329c718751e705451031501d488686772662c3e90aa0d09a6dd35df2662eb46743a965169c11fc605352d7b699def6b843e993662

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\favicon[2].ico

    Filesize

    16KB

    MD5

    12e3dac858061d088023b2bd48e2fa96

    SHA1

    e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5

    SHA256

    90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

    SHA512

    c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\styles__ltr[1].css

    Filesize

    55KB

    MD5

    83f90c5a4c20afb44429fa346fbadc10

    SHA1

    7c278ec721d3880fbafaadeba9ee80bdf294b014

    SHA256

    952833e41ba7a4b64c31a2d7b07dde81bf5bbacf5cbb967821cfe459d0c4a0d8

    SHA512

    4f0d19678a6758e67cb82652d49ee92a3646c3b4b68b93253c3e468e88506bb8ad78942d7be244b390bdd29a0d00026ad561c040c1b557067edc7887fe7119ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\Converged_v21033_Ouf1esRqI-5-K85Q2hruAw2[1].css

    Filesize

    108KB

    MD5

    3ae7f57ac46a23ee7e2bce50da1aee03

    SHA1

    150159f85a646f3f4cc88115bd0d3ad6db66f14d

    SHA256

    257d51dc38cf3695b024433ffcb6d66e3e21db0660ef379f9c3006b5602c82d6

    SHA512

    6c55af8dd5ee5113a252bde0ebe40b0e7a2c988f6339c46275d717123a29c239d53baf3ce76d6a63c42166ac0fbdd5eac15f38f1e8d43fc294cdd348baa005af

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\LZ0AI98S\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg

    Filesize

    3KB

    MD5

    ee5c8d9fb6248c938fd0dc19370e90bd

    SHA1

    d01a22720918b781338b5bbf9202b241a5f99ee4

    SHA256

    04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

    SHA512

    c77215b729d0e60c97f075998e88775cd0f813b4d094dc2fdd13e5711d16f4e5993d4521d0fbd5bf7150b0dbe253d88b1b1ff60901f053113c5d7c1919852d58

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\ConvergedLogin_PCore_mo0wzivEVfcijAxOx6lCrQ2[1].js

    Filesize

    394KB

    MD5

    9a8d30ce2bc455f7228c0c4ec7a942ad

    SHA1

    65667abd9d829613e67286a1a43b15f777973ca4

    SHA256

    e3ebfc5cdd3086af3cc08f53e07dbf2acfa9b3654bb6d7de6903cbf49b739141

    SHA512

    ffa67e77decd1ce0c586fd3a0656877d6e56276c2e7c73e06884c230e0f0d191ac1212383481f610cee3af373c7872a7fb94da6419c211506661fbdb7e37bdec

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\jquery.min[1].js

    Filesize

    84KB

    MD5

    a09e13ee94d51c524b7e2a728c7d4039

    SHA1

    0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

    SHA256

    160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

    SHA512

    f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S64KWKX9\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee