Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2023, 15:07

General

  • Target

    http://td2-desktop-api.timedoctor.com

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://td2-desktop-api.timedoctor.com
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:620
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:620 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4356

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    bd71617256882953841a8337a4dd5d5c

    SHA1

    d9b47492fafc72a5fbca10c56229fe6a2757331a

    SHA256

    8f2693e8b656256ad2faa63c3421eb6f1a4e278d2e2e3cc97d5acd5642f97ba2

    SHA512

    2d40d636e04523d2095e6896f24a911c523d581b93d486af41275b3b6dc94e05bf5e4de8e2c8479886e4c3f2ff87215fd25c028846ba5a868258875dcca3fa2b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    35e4a4cfe7b2acd62ad0f1564ae8bfa4

    SHA1

    9b906e84570d31c0f031511a7a3b37456e7f13ee

    SHA256

    457e07688ce0fccc1335901cda7490b9776c519bb0d4b6d5295b6e69fac07139

    SHA512

    bc288e96facf64c19ea2e2e3a759b341b6d2d6fc78c6fe03797419980b5935b4fcdbbfe33a7a7af825f2af776c8af8aaa8a8710041b5f2e77ba9776734b270f8

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\dcpq11e\imagestore.dat

    Filesize

    786B

    MD5

    594b26b3abb2fd0d96c381c7019c8420

    SHA1

    ed5b8f57fad27ecb7dfb050b6f9528cb7fd0499a

    SHA256

    9df85f0d5fdd1b895504c54dd7f2abbd81415f8bb71b07444bce8c1d9fde3fea

    SHA512

    902aaefc52bad360eb3c7ac0e31eb278a121c9fff084df39b1afe2b8a8e6eeadc0484d8e0ab1003ff36488e70cbdbee71cb910fa00785c59f16c1f13a65ea5c8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4HAJQ22Y\favicon-32x32[1].png

    Filesize

    628B

    MD5

    40d4f2c38d1cd854ad463f16373cbcb6

    SHA1

    8ca50b59019f7f17c65b77ea4f90a1b1a46ac0b6

    SHA256

    3ed612f41e050ca5e7000cad6f1cbe7e7da39f65fca99c02e99e6591056e5837

    SHA512

    c65ec846e78d2ce2311f1c737177e28744ed9de83069d2e003b1a9252dc1dbca960cdda75d1d217a3772cc66e2db1562a8eb50d0d5cbad4663d2f3515286fbeb