Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    164s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2023, 14:43

General

  • Target

    http://download.windowsupdate.com

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://download.windowsupdate.com
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2744
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:448

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

    Filesize

    1KB

    MD5

    841785fa29e2c9c554cfde87bcbda6b7

    SHA1

    dcfd3c07636dbcea62a23e20d60e268e476a24c9

    SHA256

    4f072540751d954745f9db3db8ddb93c122a52700fe4bc5ecb977c2c48c52562

    SHA512

    e9ff84cd3b073e01cd68e70c5e5e9b99f062b552e9641f21c3273497526d158f88baff8a3b08098bb65c353c3f2af8acd8cb3d14079f853ea1bedd655178fb6c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    bd71617256882953841a8337a4dd5d5c

    SHA1

    d9b47492fafc72a5fbca10c56229fe6a2757331a

    SHA256

    8f2693e8b656256ad2faa63c3421eb6f1a4e278d2e2e3cc97d5acd5642f97ba2

    SHA512

    2d40d636e04523d2095e6896f24a911c523d581b93d486af41275b3b6dc94e05bf5e4de8e2c8479886e4c3f2ff87215fd25c028846ba5a868258875dcca3fa2b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442

    Filesize

    446B

    MD5

    6a6c1d839e97888d1d9aca08a0005170

    SHA1

    d42bf83741bbe2586ccdff8a9f229840d8412501

    SHA256

    7f3eaa145d1ee341162826e7a26e9d8bea854d1106f6ec1e8c09a13d8e6065e6

    SHA512

    a29c0e0773c4eafab7995d1b06bd25cd9b08228beb86afff7cb2f279e008dc300d530925da51f4c37782b16b8372fe2e0f80a977cf4c61b2e22fcb89ae911508

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    d6322d030de8b6d0f4bca7c25161a74e

    SHA1

    03db243f9418da9b42cbcbaf2ade03e1745e2a89

    SHA256

    cbf20ef5c9c83251397e6ebff59da69ac0ef8277c30ad157601580ee2ebb2d32

    SHA512

    8619b38c0185723f86dc73c0c4f1e79728550d3c0dea8716c5a938b774401ee90bdedcb3926271a91a20d4386498ac1d23eb6a17776cf296383b7ca1ed40edb2

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4N00Q62V\support.microsoft[1].xml

    Filesize

    17B

    MD5

    3ff4d575d1d04c3b54f67a6310f2fc95

    SHA1

    1308937c1a46e6c331d5456bcd4b2182dc444040

    SHA256

    021a5868b6c9e8beba07848ba30586c693f87ac02ee2ccaa0f26b7163c0c6b44

    SHA512

    2b26501c4bf86ed66e941735c49ac445d683ad49ed94c5d87cc96228081ae2c8f4a8f44a2a5276b9f4b0962decfce6b9eeee38e42262ce8d865d5df0df7ec3d6

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\4N00Q62V\support.microsoft[1].xml

    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\cz9baam\imagestore.dat

    Filesize

    771B

    MD5

    b6622618950f8b302f1e9ed2a536317e

    SHA1

    7d95755f1ed10d0a59d96d0e83ef7777b983ba82

    SHA256

    6dadaca47e470277013c3d2d74be1ee83b8d38dd7e251e6a24e926e1cc895886

    SHA512

    355df913ff29da505c9295264555a9866919b73efad30d987694a0e7cb7097d63a0a953f1d23c1a1dc683c0caeb5d15f38a33021341034a03c9e1bae0013426e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RPW4GWWI\OffSMDL2.4.50[1].woff

    Filesize

    43KB

    MD5

    4c6c928daf19e2a06faf12bd2f002d2e

    SHA1

    027d4709db809d9e9b2627b74a152aec29066ee8

    SHA256

    2c9728c235211d8956826af42d99936b409536e6027e9162835731d5b005d462

    SHA512

    62445364d9696d1ffa4bacb49b6d04d4d2415d3145b628885d48348c233a11fa336c5de8133564c541d73152950b33a3661f190d3f86a326ceff13cb0d52005e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\favicon-32x32[1].png

    Filesize

    631B

    MD5

    fb2ed9313c602f40b7a2762acc15ff89

    SHA1

    8a390d07a8401d40cbc1a16d873911fa4cb463f5

    SHA256

    b241d02fab4b17291af37993eb249f9303eb5897610abafac4c9f6aa6a878369

    SHA512

    9cbcf5c7b8409494f6d543434ecaff42de8a2d0632a17931062d7d1cc130d43e61162eedb0965b545e65e0687ded4d4b51e29631568af34b157a7d02a3852508

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RUOQG7D6\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee