Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/05/2023, 11:57

General

  • Target

    http://bmciinter.com

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://bmciinter.com
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1436
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1436 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4388
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2316

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    4d4c41a739d238ddd5b28db912dc86e0

    SHA1

    98f90e5e1a6a74c494934ec329e6436dbb4c18fa

    SHA256

    b5217476958327aeea3a359176435e25e1c198640e0054b6020816978603e3c4

    SHA512

    a7695c8a2aec55bfa58224d5b4f35f430e85f9b49272b2d165ee69dab60156528127888236bbfa597c79d5fb1eb7f46b9aeb1bf10e099e86b9ecb7c12bfd7ac4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    2c6ef50a9852abb05ea312f034fe45c6

    SHA1

    5d8cd6276c27de515a0ca7a2f8a220a48ac9b836

    SHA256

    85ab5feba298e1a1e73652596190a6ce4e9621c29886d047f0abe26e5b0e01b8

    SHA512

    b8a9af5dfff74a2e7ac71954cd6f032ccdd63dd3a79c2d3e2a6a8a94661e995cef82aa84e860f38b2d99abd7204004334b06c37e779664076f8845919b6df0e0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\37XPJIJM.htm

    Filesize

    38KB

    MD5

    cb74290262b9266d81c411fa66b48e6d

    SHA1

    a024a822aac2b25c08140f8dbdf166a0a6b8ccde

    SHA256

    82512ad1f8b9d26fac456bb7cb10a2d4b05723d9485df8783271b3fed9e5dc18

    SHA512

    bed74bbe5e26247f10ebeb5e3c1eca90b6840e1ba33107dba545b7076d0821efbabfa6ac2a2e8fbe30fe74b491b0e2b827ae6366a2e7ebd50a5086667c6b1c2b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\font-awesome.min[1].css

    Filesize

    30KB

    MD5

    c6c087319f7719b178fede3b49914372

    SHA1

    7ac7dde1ea30f828c43d16b4b8aad98e64f7dead

    SHA256

    db533ec3fb887ded84555643f0db790ac31be5d84bc215aeb9c001e04551abad

    SHA512

    da349ae221f5ec2caff800e599eb742d7cfc7278c1a4f98a79845c217c46909fc2ce045cdcc32b8bfc50ab522ccdbe8901247309e7ec73071fea2faa90d6a96e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\icon[1].css

    Filesize

    173KB

    MD5

    b4b234808a4e217693d3f5e3f3ffffec

    SHA1

    15639c25ac0bcd89ad8b98c6038e2ccc5b334af4

    SHA256

    334d3f46f3283ee2cc4f844658776be443ba985669670a83dbaf91c8c96895b1

    SHA512

    4ddfe09f01eac1198df48624d997c2f154464cdf2f4bc2141ca7f367b26c68304e8ce10fbf462aa76694b5e0bd5dfdba8dce753449af3decc800dfaa054cb1b8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\material-icons[1].css

    Filesize

    970B

    MD5

    c5941eed2e20a509114128aab1e96edf

    SHA1

    d45506350e35c369dca6d1ed299b3688e590db8d

    SHA256

    afb727c828f3957ada8e546f9bce9c9c733bc1d2f09a83eb47f2114302cd9f2b

    SHA512

    4c14c94f4c86c4797b2451002f5bbdc14ce8d1e2be1bd643ebfb426b5615574312d2c0aa4e48ac809f4e0ba0b74c415c382f9dbe2be9d486c6a7e73a07458c16

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\script2[1].js

    Filesize

    85KB

    MD5

    54e4342acbde0623b132e12305156cc5

    SHA1

    ca918c5eadb25a37e927344e30b73dbcb7016471

    SHA256

    ae8f6e44fe7f5a979c2310e963b233bab4b53f02a6555e3788f66855e805b55f

    SHA512

    89876882be3f368ebe01e4459cecff951ca91717423a56015069d0f21fbb9f2778fb3a620943163d9097f2dbfab90dcd84dbab88c8502da7dfc4ab4e374b198f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\0P80TOLA\translatehid[1].css

    Filesize

    1KB

    MD5

    24eca4a5427da09b5d1ebf67e028e4e8

    SHA1

    f5c90943d79c1b3530ccc73400f3c4e37ca08ea2

    SHA256

    172ee054c44adc86e07051442aa32d5b69cac07293e6050ae588c5d7fec8513b

    SHA512

    62a21c576d20da4e2fd705b5616ef784596621b58f7817458018c5f271e1f20c3e6ba9407414c7522c6037a52e866c1df554d561a43123535cb34b7145237e6b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\bootstrap[1].css

    Filesize

    131KB

    MD5

    67f7f12314244388c5a7e3a156453023

    SHA1

    d4f868439e021b4dab3cea01a75da8daac2e5af8

    SHA256

    d373e88706b6f5eeafd5360520fbe35949ea529fa3b54e08b75213d9ce6af6f1

    SHA512

    02536dd5f888c08ec6e165e49577d3cfd1f6dae85a30c247216591d57d195f604068db4925f4deaf129e274125c14e8e5ebbc793c4cc016c38d020b73f89c375

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\core[1].js

    Filesize

    507KB

    MD5

    9b179715e46e073a22336e33cae6f91a

    SHA1

    fd30ccb3782098c9960826591daed488f2939496

    SHA256

    5051082823d774bc6f63fc6174a16c5c784c3df18d001b15b7793bab1df8adec

    SHA512

    ef4cc87b6ec42492f91e6bfb357a8075ebbb8d6492a22e307364cff31b8c8253d501fcc9ff4a16c00e9a6c597e682a9d11928219821bcb83f054405285f1de75

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\cr[1].png

    Filesize

    1018B

    MD5

    94a0efd0409736cfedc13a1e41939698

    SHA1

    d89e9956e9563e6535fada4eed341f38fa428f0e

    SHA256

    2534fb3fb9b067eb80abd4a76a3ee6e6792b95e14d42fb79e174f0a1f5c0d5c8

    SHA512

    7af67874da8d5ce6e06c5f26597d48f71689c5811e422147be759563ee6e863232fbac116ce3e1ef9cc9e38633b4137619d8157a2ac583dd05e0d2d19f0d6525

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\cz[1].png

    Filesize

    647B

    MD5

    075668841196305723fc6967ab05da7f

    SHA1

    5b2a3602fec03b29548c0d2accf3bf5b5ceef18d

    SHA256

    ae540453158b9dc0946700835c2b47b1819350805619b5461220de5d6962b803

    SHA512

    6084885b2c3b067edfdc6f3cd5359d314daac83233390fb2a59e34e92e4ef007cb62f7180091ff55b26c2805ea4bc1bfa60343c314916b064c4cc19b74670844

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\fonts[1].css

    Filesize

    102KB

    MD5

    348231591b568e03df0a08b34570ca62

    SHA1

    5d17beebbcace98362132c865a8a0fa10abf8487

    SHA256

    103d79c037daa1f282b1408e1d80bac4e7e116514b4f34f7381ca57a9dc5ac99

    SHA512

    6aece962420c84364c92784bb738d1a92d96798b36dfc3d70ea6cb490cd67f994c60ccd5dac239d1ed9816c1d95b89f67df151487ab01d926a070bfb28d0f412

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\pn[1].png

    Filesize

    508B

    MD5

    ad186f9e2a0505cde6ce1c5d2618b34c

    SHA1

    17f00e98b2ac9220b7f22242206b95f183c7d740

    SHA256

    ce48182f64372239f53e219fc2ccac01fbddac9b46ec6606811670fbec171fdf

    SHA512

    7d8b8ff0a426e564549cecbcf8582a834d503be4a69ab41bfc6e4aa19321b81a0d8deb93e67721e4968c224de5ad60e686034b168c897b97628d88fafed71325

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9YACFB9R\script[1].js

    Filesize

    16KB

    MD5

    a8407ec179bcdcdf3d1a37394f5fd4b0

    SHA1

    ae8d29038c2e47f8d59fe7b90cb693c03e477f44

    SHA256

    bb714f74c8b1049ae5ebca1c10b1ed5a8f820b1a3584bff746bb60c50a1b87a3

    SHA512

    27a8e073aeb48f151479f7b5dd126d8d4d1ed9d3601f5b1c552f0cf1475053ca2925260f14b91c59516d4357df19778766a02ccefd5741c6a147dce905cabd60

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\bootstrap.min[1].js

    Filesize

    49KB

    MD5

    baaadea4492b059f284187d75af46063

    SHA1

    7326bf5e023f871afcf6ebb18cb89109f81a7708

    SHA256

    0e25895d7caaf355a53d19c37c69a06198f668e5422b211d27597ed93983b80b

    SHA512

    b56367cd0554d9e5d12103e2be34e304433b898db5d78439a4e04845168e413d90875024e3c5583cde3ed8aa68989a5c7ab37aa51163e65fb72e7c50d1db587d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\css[1].css

    Filesize

    22KB

    MD5

    999945c0004e47cd5efc9554cd3a791c

    SHA1

    4757ccaf95370f498cb5803730ed7e9e61b7922d

    SHA256

    d0b74c768fff24cf5f4ffbedff350a186f002e8d9287e41335cc1e56f2136ddc

    SHA512

    12854b56673069498931bf6c9ef0ecf8af70fb64378b700d1eaae15cd95aca1638c0f7f3974242b1ed3328c9092be4717504ee65687500897f9e1e6a1c0d6d89

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\fontawesome-webfont[1].eot

    Filesize

    161KB

    MD5

    b791bc4e305c2cf98d49c5999e984158

    SHA1

    1ae26708c46fa77251df48a004b2d612ee12e926

    SHA256

    4a71b096caf8836ea740d49f8c70a86868a2e538bbd2051eda3541bb78bc7113

    SHA512

    0f56f81a841c0b9187816e89db805caa12dbe5b45d79e6e35d2551b90b4f2b11995a1bcd1cb3033214bbab699e29c4a992a47f4ffb6891cf8d49833ed3aacea6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\fontawesome-webfont[1].woff

    Filesize

    95KB

    MD5

    fee66e712a8a08eef5805a46892932ad

    SHA1

    28b782240b3e76db824e12c02754a9731a167527

    SHA256

    ba0c59deb5450f5cb41b3f93609ee2d0d995415877ddfa223e8a8a7533474f07

    SHA512

    9c776dea55a01fd854ea23b3463d9ac716077d406ecbe8ed0c9b6120ff7e60357f0521ab3e3bf9d4e17ca2c44a5d63ee58a4e7a37a3d3f26415a98d11c99e04f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\hbicons76e5[1].ttf

    Filesize

    39KB

    MD5

    789a2f394b39fb5292b53dc82448bb03

    SHA1

    5c07c4e697d398e89b281f8ee8b3f86b4d47fcb5

    SHA256

    a3326f70b992f67861c0563638aaacd58b1955c58e679095c8f2e663f011bb1a

    SHA512

    5d3fc37eef18664bac9b3d9d152e787ea6ae4dcd9c18024f5ab54ad49a488880485b6ea5443f80e23f13b92488f7b21cb6a4ea26a7c92361e2eca23e86273243

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\m=el_main[1].js

    Filesize

    212KB

    MD5

    65e406a4e552a1459cca4d2892d6af10

    SHA1

    1af68ba195849ce5b21f38e5949b9228e89f387b

    SHA256

    2415d1d63f7771a9cee0c20f469fb65a2f6e976319428a703d9a440334b0106a

    SHA512

    632c9b6b68f6d2e39715d84f1180c0aad03b649e986093710718a82be981f4c7ddb900d3cbc9350447ea4c63c9c4bd8e7ec5ec994f0aa72f18484e8267d70f6b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\m=el_main_css[1].css

    Filesize

    22KB

    MD5

    517f4e13e58623c0532c46f45b310498

    SHA1

    64ee5ca1d1f13caf54e92c59d0abe8578dd3ffcc

    SHA256

    fb2b5e29615ad2725a5f92f216f1c17d469492869e0e48986f7bbb9537266cc2

    SHA512

    4938291b8af7e579df0d584a9bd106c70910e5d404dd3b968a8d7db0c2c5c8ff2953bfbc5d2548701f92c606212b64b55df752abcfb56bcf8405d50d6ad51849

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\main[1].css

    Filesize

    404KB

    MD5

    a399ee5d640b9287346f263945ab0567

    SHA1

    d51454cedc9c0cff2e4ce51ae0b48b3a8734031d

    SHA256

    96e89fc10d07644cfe632eaca6f269c833774601b8cea2fd36da8ead64c9e773

    SHA512

    ddfbaaad64adb4165f210107928cf0c44bd8f913e552211c9331c7af9c0fc9c3df8d8c57632f73c969cf0c4e2d445c5bbec7fdadafe1d4c4f90c86ce7a5607b5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\element[1].js

    Filesize

    77KB

    MD5

    5f3c6db35c359b646069aabdd4657e4f

    SHA1

    1d743622a6957ad09ccc33216876e6ad736e75e3

    SHA256

    4db0e3215394df8032deb91b4599a5521d211b9d8866d113b56c7c90782746ca

    SHA512

    b346678900e30b42cf42ca460ca8274775815da4726f8616be92dc489f01fe8cbb1c37405c32575c584b3419973bf6507f397b68317c761bf4f82975edd19412

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\formcss-contact[1].css

    Filesize

    27KB

    MD5

    9e39814d97bc3aa459efed244c60a98d

    SHA1

    22bfa1c6a758604a342195b98d7e0673a995c27b

    SHA256

    fcb3a317f6f06e0f0d9b26ea87583718d7d98cd2f81af157ca3da4e1f220fe0d

    SHA512

    6a080ea57ba38bbf44996cac83158e97afd69daa0730c057c8a8d3f3859ab1db3111f4f3c0bdd740f8d8b5e9f8955337b3cfa69ad32f6297ff17bfab5e9b1908

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\jquery-2.1.1[1].js

    Filesize

    82KB

    MD5

    e40ec2161fe7993196f23c8a07346306

    SHA1

    afb90752e0a90c24b7f724faca86c5f3d15d1178

    SHA256

    874706b2b1311a0719b5267f7d1cf803057e367e94ae1ff7bf78c5450d30f5d4

    SHA512

    5f57cc757fff0e9990a72e78f6373f0a24bce2edf3c4559f0b6fef3cf65edf932c0f3eca5a35511ea11eabc0a412f1c7563282ec76f6fa005cc59504417159eb

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\muli[1].css

    Filesize

    14KB

    MD5

    795e978a7d0fda9ae62a0fd0c6f7a785

    SHA1

    5b25e294da8c6f2497d083eb3b0d59d9eddd6176

    SHA256

    abcebf5d362eaaff82bfefd66bb40c758982dd74d1b70f3c7cf34e3c5df204aa

    SHA512

    d9608c44fc47e92cd29b6e47fcd88b915374fc7a49e416ee84e1da27217fede4d9a1b966384a60c5e0727aadb44c7e99b1cbc210d0d7be9251f72a5fb241eacf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\slide-1[1].jpg

    Filesize

    115KB

    MD5

    31c6ee9eab9fb8ffc11a9ef2d15b7fb7

    SHA1

    b0cfad5d57dfde3b9e7230b17ce6277faea6a63f

    SHA256

    37fccedc8a7566d5475cea6d917effd9d23ee5ca824aea6bc0cb09dc0b2b2756

    SHA512

    4ee8e9f96e34b41786d4c613dac019fd8c0d3b5bc585a8bcd6bfec351333b4252d86e4ce67757fa39b2e6d274b9dfe450514d6d49f129fac42f3d82fc384248c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\style[1].css

    Filesize

    81KB

    MD5

    e67da02aaebff268755e78923f7490c6

    SHA1

    c07e5fae8d741f663879cd4e9f3beb3c47dfb258

    SHA256

    93123443129b1350b42bd396156fe24b321c8eb83944f046040635af73591d38

    SHA512

    882feab377b48bfc34dab0b916c9bd7b3b48a4a8e97d1090fa68905121db97a85f824ee804cdb7f137b8014a8e07a11c6e18d0dcd17281ed8c029b39d9047606

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\themify-icons[1].css

    Filesize

    17KB

    MD5

    ffad9f4235c718cf2778b499b9285121

    SHA1

    3564b2b3dfd216ddfb26832e056d3b85b69a6663

    SHA256

    4527b778fbf06b55e236dad7adcc5cc3eae453428ed754a6f4c51e014198f247

    SHA512

    b12f7be74d10a237f62ccac5be6ca07b54540e8e5a18a6902942a642a712514902ca9d9b96fe1ee3c406c173c5a08bf986e2b9a2849b14c0bfe7ff4cb67960d9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G1ORIWBN\themify[1].eot

    Filesize

    76KB

    MD5

    2c454669bdf3aebf32a1bd8ac1e0d2d6

    SHA1

    df12a0942cf1933f0915fe3d910fa2379f092d83

    SHA256

    dff415daec911b65dca5be02071a1825b75508ff158de5b8d85976957db931cb

    SHA512

    106c027bf31ac1d0705a9be9b3ccb8562b38b2229b0119dafdbcbea2273e66624f3cd7a7afcd394985f2f22248736ef08962c9182e7bc0f59cab7f8a878478d7