Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    161s
  • max time network
    192s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/03/2023, 14:34

General

  • Target

    http://ctldl.windowsupdate.com

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 51 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://ctldl.windowsupdate.com
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1048 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2132

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\69C6F6EC64E114822DF688DC12CDD86C

    Filesize

    779B

    MD5

    9384ab7f52e0e78d1d16a44577f4a394

    SHA1

    ef6bd7d905251a84fc9c8855677d7a374e00a381

    SHA256

    805a55c4aa3a02174c5c96e8a7ad2c47f45b151cb87a3a6f89da7cc17b4a4fc8

    SHA512

    9f8a0786b55f02c0279e9bef90068a34c2cc2713b103a47fbfa13825942e0835d25c2f837bc34b2f31859fa14c888a403c6b30926ad2332ae6ef9b222c1fd8b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

    Filesize

    1KB

    MD5

    8461a037b38246996c5f98a64b5fd918

    SHA1

    db8bf194f154ebcdedf9b0a8a9adc62d02dff008

    SHA256

    c85675b72791f932ebe52b51bc13dcb761a469b1fbde881c6c4ef6ba93a1b36f

    SHA512

    1ed13f73bd0e64d5609764ee65d642d3c9b658a117616e8e3ed4149b546695183f10befb51f24d471f134ddd02fd3068ea88cf949fde9c8be19bfaddff4a3880

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\69C6F6EC64E114822DF688DC12CDD86C

    Filesize

    246B

    MD5

    1d0a8fff50703b3cd0fe946b73338c38

    SHA1

    633e6b3d767e71019a59bb52d8b6113eabcfc5c9

    SHA256

    e4d2f5fe958ddde3f31f91abea08e6b1e513c7cdcbe45943510efea353679204

    SHA512

    33dae570c6cacf93fc5b0216f4f17a10b796aaaac7a94cc34272c4aea82544b195638809048af9b230e9cd3da3f587be29de291e4a30b43114bf65539706924a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

    Filesize

    446B

    MD5

    547f11cff38547e339fce7db2f170104

    SHA1

    29e08ba75092883ca517d4657fe83748e66c6009

    SHA256

    9a15a886013369c0fed80ece3001f45e2bd2ad78456ed04aee547cde87e44f55

    SHA512

    bb9bf2a0e5126be7cf082d4930ffe0d18ec7a085e200e0cdb21e0af25eade1d1db6d5f3e6e77fabab63f9e1134d44cff3bbf3e84e29ffdf3271f7fc326b6821a

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF627.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\9afmek3\imagestore.dat

    Filesize

    771B

    MD5

    dd138b9d370eb20445293c742e32a943

    SHA1

    2d3398aadb0bd69b9937991ce0dd081a4840fab5

    SHA256

    ea2b29235f5d3454f55a9a0d180d6be449ad9bd05ef6895ebbce9a7c90fb98d1

    SHA512

    912681aead8dd81169b9b4b8268f0a561dd89fd53bbe0285be9607947219ece7f84e4d30cc487245beb0959f1343fa903c544fc074231ffa946c06c118c0e789

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\SupMDL2_v4_69[2].woff

    Filesize

    33KB

    MD5

    c6de87ee555ba9c32f8b95b2253963f6

    SHA1

    4f1e0fc053f1bd47bf515155405e15dba3f07a79

    SHA256

    736cbd05debaadea59f6eda99c3d8f7a7c586ad70a4a342b14ba8eb11a95a480

    SHA512

    012c96fcd366d76d33154cb9a3cd227c77252969ca1c0785044bc59dfff190dcba34bde9b230cef57675f650845ceaa3167561796142c34812af8dc73097ca68

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\OffSMDL2.4.50[1].woff

    Filesize

    43KB

    MD5

    4c6c928daf19e2a06faf12bd2f002d2e

    SHA1

    027d4709db809d9e9b2627b74a152aec29066ee8

    SHA256

    2c9728c235211d8956826af42d99936b409536e6027e9162835731d5b005d462

    SHA512

    62445364d9696d1ffa4bacb49b6d04d4d2415d3145b628885d48348c233a11fa336c5de8133564c541d73152950b33a3661f190d3f86a326ceff13cb0d52005e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\favicon-32x32[1].png

    Filesize

    631B

    MD5

    fb2ed9313c602f40b7a2762acc15ff89

    SHA1

    8a390d07a8401d40cbc1a16d873911fa4cb463f5

    SHA256

    b241d02fab4b17291af37993eb249f9303eb5897610abafac4c9f6aa6a878369

    SHA512

    9cbcf5c7b8409494f6d543434ecaff42de8a2d0632a17931062d7d1cc130d43e61162eedb0965b545e65e0687ded4d4b51e29631568af34b157a7d02a3852508