Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/03/2023, 00:53

General

  • Target

    https://www.facebook.com/nltradepub/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.facebook.com/nltradepub/
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1240 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2384

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O6C3NAZO\m.facebook[1].xml

    Filesize

    138B

    MD5

    1baa6ee5092eea484aa05a065342c9dd

    SHA1

    68f67833e28e182b8aea997d1ed1410c1f7d4134

    SHA256

    140c379e9ab493589667d35b3aaed37c9c7d2c68c5af3b9405fca0d4e3e91613

    SHA512

    0e74ab7744bc5a7b303d634f9632c17fa37eb49974b60d8cb12b1940cdc3f610c55ea8392ae73b2cae1299efd0c2467bd73b9cc37f6137cdcfff47d4adb4cb08

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O6C3NAZO\m.facebook[1].xml

    Filesize

    418B

    MD5

    8614bccccca15fd4a7585922a5eafd3b

    SHA1

    0a8f2bfe5793e5d30a4567d241ead63733a7e8f8

    SHA256

    e072dc869c566c3067a0ee0e73de4643648592be5435e531fd02a573198a4383

    SHA512

    5cf2d86e1fd6ab0529046d5d52b625dc83e315b6ab265997067048cf4985fe05e5c6ad2c67a193487ead378b1a4cbf05c1f3379d444bb61ad988cf9ea6e3cc23

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O6C3NAZO\m.facebook[1].xml

    Filesize

    953B

    MD5

    5d1b8d825cc41ad9898084b149ffb6e0

    SHA1

    26978e8cc2aaacad496aceca052d2a1f409ec992

    SHA256

    3f90830713f919a888314c33d511abdd95c4c0bab976cc9f3014ad928d388f30

    SHA512

    f43a59bebb2db4b323e5441ed1035d5bed5fff6cf7f171a1872392007db17befa13edfe599c99e97b4923a47aacc0f477bd9daa9450dbe6129a9b2c9589f0e98

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O6C3NAZO\m.facebook[1].xml

    Filesize

    711B

    MD5

    7289ed464286e1d03cf07a235c0ec857

    SHA1

    9e9fbc646b2e2d2e705f221dc43f0a8efc0464e9

    SHA256

    81a16c3ab4cf754dfb7b2334f652a74867168d0b3c68006e9e887abd58d99e22

    SHA512

    f0cf4e55c81b5a0913252929331c10fdbc510262e7245de96c271e1b2bd1f3314b0bce24fa1599d11a85c9afc42d0166b381140ab652176b7423fa8bd61bbeed

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O6C3NAZO\m.facebook[1].xml

    Filesize

    514B

    MD5

    9d38600beeff180957f4419e5109fa5f

    SHA1

    9e2ae6210f52c9bc7dca170411548583968beb63

    SHA256

    d198150036cb95f4c7642ca4f919b1d58ad7644d736bf435c21072268fcf10b9

    SHA512

    d77559c2f789a8499b06c43c9973491d487d61d8403582d2b678a28d138e073b4c7a8244f63b8c1a799a26ba30123ff73624569fadfe98d7c553cb6bb3027663

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

    Filesize

    6KB

    MD5

    a83d167ce6a9634e600bd4156c562079

    SHA1

    374ab8cfec7cf4b9f6b87cfd7473998c1c4771c6

    SHA256

    389afd5c82f9dab337a4bbf01894c6a670b85e18ca522300d1b132816872ca04

    SHA512

    b277fbcd7899edf151fcc63b41018f36b8174ae5f00e6708fd446a1ec467b22a1fe1d3ca640b18a519b4cea89d6a155dbfa5da7e60ee5f13e12588c0bbedb0b3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\gB76kJXPYJV[1].png

    Filesize

    6KB

    MD5

    389dfa18be34d8cf767e06fd5cde4ec6

    SHA1

    47b751cffab47d076816c63ce08d3e84600376ee

    SHA256

    3c45ce612f41b1e7936e7cf5b235047344fd3146d1630e342f186d1d1e8e00d5

    SHA512

    c4db18f636ad85e87f93a208fb4b02b528659ba367e51cfa6d7826ac1159f445a85fbca8d12ac67556e8fb5208dae24ae309e783d50feb088ef0e9f47ac19430

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5AN3FZ97\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee