Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1605s
  • max time network
    1611s
  • platform
    windows7_x64
  • resource
    win7-20230220-ja
  • resource tags

    arch:x64arch:x86image:win7-20230220-jalocale:ja-jpos:windows7-x64systemwindows
  • submitted
    16/05/2023, 06:00

General

  • Target

    en-US/gadget.html

  • Size

    2KB

  • MD5

    f194283e5fda623172149df45a6f9116

  • SHA1

    95ce9c023d045b4faf3c7dc3573e38961e1c7d1f

  • SHA256

    4ff0c8ed3be351519040e7e3519fe4811dd87898504cf650c2b70195df2c8ce8

  • SHA512

    b0695cd4a549face7309955ca49e9a620fd3491a263c4394fb049025beb0fad3cc09a639f2e6d8f0bf68f434d9e86b0820623390d3855bded00688a161740840

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\en-US\gadget.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:916
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:916 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:612
  • C:\Windows\system32\msinfo32.exe
    "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\Desktop\InitializeApprove.nfo"
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1140
  • C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
    1⤵
      PID:1468
    • C:\Windows\SysWOW64\DllHost.exe
      C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
      1⤵
        PID:2020
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0x528
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1756

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

        Filesize

        62KB

        MD5

        3ac860860707baaf32469fa7cc7c0192

        SHA1

        c33c2acdaba0e6fa41fd2f00f186804722477639

        SHA256

        d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

        SHA512

        d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

        Filesize

        344B

        MD5

        7c576e7ff741e0af3fd4e63dd7b2ef62

        SHA1

        5f62107e23f8013b50a3019ba529b560a622ce30

        SHA256

        5f4e52cd91a3529477436bebb5ef23ffeb36fa7e7e74959e176e12f3962ece23

        SHA512

        9f1e773463ea86ecbc110c6dec8a6c54bcca9d804e17e74ee1362b6983f36f0e48e176808f9dbc43690e7dbf64fd75c7281e82f5dd62d546cd302e19f052e572

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S7FIT0B8\suggestions[1].ja-JP

        Filesize

        17KB

        MD5

        f0e8351230b562572b4b315a1a55004f

        SHA1

        1cc73361100ce15353f2571a03a5d5a364be87d2

        SHA256

        650de9892142b102c0cd1f9deca25f93d83c0bb8b5434580c77dd4214a82e1a5

        SHA512

        3d7dd1a72a000041fe308828c714ac48c463e0022cad3495296d0eb72a0fc85127b3c46cdc0015da25d41e9d22eba887980c301663f37ad86e7ccbc452934d46

      • C:\Users\Admin\AppData\Local\Temp\Cab73EA.tmp

        Filesize

        61KB

        MD5

        fc4666cbca561e864e7fdf883a9e6661

        SHA1

        2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

        SHA256

        10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

        SHA512

        c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

      • C:\Users\Admin\AppData\Local\Temp\Tar7615.tmp

        Filesize

        164KB

        MD5

        4ff65ad929cd9a367680e0e5b1c08166

        SHA1

        c0af0d4396bd1f15c45f39d3b849ba444233b3a2

        SHA256

        c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

        SHA512

        f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

      • C:\Users\Admin\AppData\Local\Temp\~DFEEA6C139F08D19BF.TMP

        Filesize

        16KB

        MD5

        28f457913e6f3f75530723e605094349

        SHA1

        6a1eb7f2afd343432e0ee08875f92375002d6518

        SHA256

        e07140e2faf7faa2ea63e0865fe5c984a659325547c92974a0aa5bc7ca66892d

        SHA512

        50bd4f464ee148981983231689f0ea2f0c9b51e338206ec31abeff6d6393490c47180c74cbcee2e78df4c54dca8679377a33592d794840b2f5f91bc33650d99b

      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FADZLZPW.txt

        Filesize

        602B

        MD5

        78507f7691a9997e6c22966434c45de5

        SHA1

        bbdcbf37115c722489d235dd3f11929e5629d908

        SHA256

        fb24ac39039d08e9e5fe75de8911a5aaaa04572391382e06e9f6894bd4352250

        SHA512

        0bd4474fe2f532816f9a1b1ace31693e3cbc63581bb1d43af0827cd1351e043b7f75a27b3cab7e81a07945a66e6711256110cc2fbb17e9f39ac9716d896e5c49