Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

1

URLScan

urlscan

1

https://firebasestor...

windows10-2004-x64

1

Analysis

  • max time kernel
    80s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/03/2023, 16:01 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://firebasestorage.googleapis.com/v0/b/far-away-56420.appspot.com/o/index.html?alt=media&token=de08148f-e847-4428-a5a8-927b55af35dc&next=https://dawn-morning-3614.on.fleek.co/?token=QmXFRR3fkeofUy2QQaEoZMJngNiBv14VUvCDo7tTHqBrKj&ci=shrihari@securado.net

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
    adwarespyware
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://firebasestorage.googleapis.com/v0/b/far-away-56420.appspot.com/o/index.html?alt=media&token=de08148f-e847-4428-a5a8-927b55af35dc&next=https://dawn-morning-3614.on.fleek.co/?token=QmXFRR3fkeofUy2QQaEoZMJngNiBv14VUvCDo7tTHqBrKj&ci=shrihari@securado.net
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4720 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1688

Network

  • flag-us
    DNS
    firebasestorage.googleapis.com
    IEXPLORE.EXE
    Remote address:
    8.8.8.8:53
    Request
    firebasestorage.googleapis.com
    IN A
    Response
    firebasestorage.googleapis.com
    IN A
    142.251.39.106
    firebasestorage.googleapis.com
    IN A
    142.250.179.138
    firebasestorage.googleapis.com
    IN A
    142.251.36.42
    firebasestorage.googleapis.com
    IN A
    142.250.179.170
    firebasestorage.googleapis.com
    IN A
    142.250.179.202
    firebasestorage.googleapis.com
    IN A
    142.251.36.10
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    254.49.247.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    254.49.247.8.in-addr.arpa
    IN PTR
    Response
  • flag-nl
    GET
    https://firebasestorage.googleapis.com/v0/b/far-away-56420.appspot.com/o/index.html?alt=media&token=de08148f-e847-4428-a5a8-927b55af35dc&next=https://dawn-morning-3614.on.fleek.co/?token=QmXFRR3fkeofUy2QQaEoZMJngNiBv14VUvCDo7tTHqBrKj&ci=shrihari@securado.net
    IEXPLORE.EXE
    Remote address:
    142.251.39.106:443
    Request
    GET /v0/b/far-away-56420.appspot.com/o/index.html?alt=media&token=de08148f-e847-4428-a5a8-927b55af35dc&next=https://dawn-morning-3614.on.fleek.co/?token=QmXFRR3fkeofUy2QQaEoZMJngNiBv14VUvCDo7tTHqBrKj&ci=shrihari@securado.net HTTP/2.0
    host: firebasestorage.googleapis.com
    accept: text/html, application/xhtml+xml, image/jxr, */*
    accept-language: en-US
    user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
    accept-encoding: gzip, deflate
    Response
    HTTP/2.0 403
    x-guploader-uploadid: ADPycduk8uy72xRXc_uuMx1nrVgMfdrtVPU3Ery3TPyEwyZvTwW0INvaL3F0sr8ESPNSrY_XAsXFjDraLqXU0LNzp4K59A
    x-content-type-options: nosniff
    content-type: application/json; charset=UTF-8
    access-control-expose-headers: Content-Range, X-Firebase-Storage-XSRF
    access-control-allow-origin: *
    date: Mon, 20 Mar 2023 16:01:50 GMT
    expires: Mon, 20 Mar 2023 16:01:50 GMT
    cache-control: private, max-age=0
    content-length: 73
    server: UploadServer
    alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
  • flag-us
    DNS
    106.39.251.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    106.39.251.142.in-addr.arpa
    IN PTR
    Response
    106.39.251.142.in-addr.arpa
    IN PTR
    ams15s48-in-f101e100net
  • flag-us
    DNS
    35.36.251.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    35.36.251.142.in-addr.arpa
    IN PTR
    Response
    35.36.251.142.in-addr.arpa
    IN PTR
    ams17s12-in-f31e100net
  • flag-us
    DNS
    34.146.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    34.146.190.20.in-addr.arpa
    IN PTR
    Response
    34.146.190.20.in-addr.arpa
    IN CNAME
    34.0-26.146.190.20.in-addr.arpa
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    67.169.210.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    67.169.210.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    234.238.32.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.238.32.23.in-addr.arpa
    IN PTR
    Response
    234.238.32.23.in-addr.arpa
    IN PTR
    a23-32-238-234deploystaticakamaitechnologiescom
  • flag-us
    DNS
    97.17.167.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    97.17.167.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.232.18.117.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.232.18.117.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.197.79.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.197.79.204.in-addr.arpa
    IN PTR
    Response
    200.197.79.204.in-addr.arpa
    IN PTR
    a-0001a-msedgenet
  • 142.251.39.106:443
    firebasestorage.googleapis.com
    tls, http2
    IEXPLORE.EXE
    1.1kB
     5.5kB
     15
    11
  • 142.251.39.106:443
    https://firebasestorage.googleapis.com/v0/b/far-away-56420.appspot.com/o/index.html?alt=media&token=de08148f-e847-4428-a5a8-927b55af35dc&next=https://dawn-morning-3614.on.fleek.co/?token=QmXFRR3fkeofUy2QQaEoZMJngNiBv14VUvCDo7tTHqBrKj&ci=shrihari@securado.net
    tls, http2
    IEXPLORE.EXE
    1.8kB
     6.3kB
     21
    17

    HTTP Request

    GET https://firebasestorage.googleapis.com/v0/b/far-away-56420.appspot.com/o/index.html?alt=media&token=de08148f-e847-4428-a5a8-927b55af35dc&next=https://dawn-morning-3614.on.fleek.co/?token=QmXFRR3fkeofUy2QQaEoZMJngNiBv14VUvCDo7tTHqBrKj&ci=shrihari@securado.net

    HTTP Response

    403
  • 20.189.173.2:443
    322 B
     7
  • 209.197.3.8:80
    322 B
     7
  • 13.107.4.50:80
    322 B
     7
  • 204.79.197.200:443
    ieonline.microsoft.com
    tls, http2
    iexplore.exe
    1.2kB
     8.1kB
     15
    14
  • 8.8.8.8:53
    firebasestorage.googleapis.com
    dns
    IEXPLORE.EXE
    76 B
     172 B
     1
    1

    DNS Request

    firebasestorage.googleapis.com

    DNS Response

    142.251.39.106
    142.250.179.138
    142.251.36.42
    142.250.179.170
    142.250.179.202
    142.251.36.10

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    254.49.247.8.in-addr.arpa
    dns
    71 B
     125 B
     1
    1

    DNS Request

    254.49.247.8.in-addr.arpa

  • 8.8.8.8:53
    106.39.251.142.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    106.39.251.142.in-addr.arpa

  • 8.8.8.8:53
    35.36.251.142.in-addr.arpa
    dns
    72 B
     110 B
     1
    1

    DNS Request

    35.36.251.142.in-addr.arpa

  • 8.8.8.8:53
    34.146.190.20.in-addr.arpa
    dns
    72 B
     168 B
     1
    1

    DNS Request

    34.146.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    67.169.210.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    67.169.210.20.in-addr.arpa

  • 8.8.8.8:53
    234.238.32.23.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    234.238.32.23.in-addr.arpa

  • 8.8.8.8:53
    97.17.167.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    97.17.167.52.in-addr.arpa

  • 8.8.8.8:53
    200.232.18.117.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    200.232.18.117.in-addr.arpa

  • 8.8.8.8:53
    200.197.79.204.in-addr.arpa
    dns
    73 B
     106 B
     1
    1

    DNS Request

    200.197.79.204.in-addr.arpa

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    a03e3db17abda2b8279c2f4f37ee6cbf

    SHA1

    7470b2553b06790447cec18717a4bc02a24478d6

    SHA256

    341afed6144ebf64136cff435d5654f8525faf997a72e2492fcbc522f3858942

    SHA512

    4c93121cdbf94cd152f6e0f602c9acd5256073536e4dad930a0e1fc7656c5a1132eef1dd53d19c16979329d46916eea454cc65e578667dc8572e38ec5c4c4d44

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    434B

    MD5

    c382c3fda6bf1dc5636d5a73d29f7ec1

    SHA1

    b200f52981d658dbc294f6afb6066edcf0aad81e

    SHA256

    515321d8a9aaf8427200d100fdad88ab149e2e29122cc15b72ab0b7920949d8c

    SHA512

    aaeb1a57d86fff837d5cd71bb3a30e2548bd7885036ce4a8112aad1a0b73a6739a87e41c87b48b91343829238b2059e8e32194bc91f28fa9bd34f7d83d3586a9

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.