Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/05/2023, 20:56

230516-zq4aqsce86 1

16/05/2023, 20:55

230516-zqq1eabf7z 1

16/05/2023, 20:51

230516-znevcsbf61 1

Analysis

  • max time kernel
    1799s
  • max time network
    1592s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/05/2023, 20:51

General

  • Target

    https://lol.zip/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://lol.zip/
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2004 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:668

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\42A8D58F9A237D75EF41BD5715DB567C

    Filesize

    525B

    MD5

    43968377194d76b39d6552e41d22a5e8

    SHA1

    77d30367b5e00c15f60c3861df7ce13b92464d47

    SHA256

    349dfa4058c5e263123b398ae795573c4e1313c83fe68f93556cd5e8031b3c7d

    SHA512

    1a46f732f5ec8ad2579a2a8cd0d36c8e3dcf056a8614e076784aa26fc6d82157fa539d43fe3c51b3571b7e77a3282edcf4017ec93e5ac3924ab3c0db5dca43e6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\42A8D58F9A237D75EF41BD5715DB567C

    Filesize

    190B

    MD5

    9d32b200742cd7c55dabb0f9350d5927

    SHA1

    a9f218fa0e22ad99146e74cf23cc78cc06b9ba57

    SHA256

    db54f16baa40076f2d1b07a931536393610fa8547de9a8eddd2eb0dd5a14105f

    SHA512

    15f53a888f2a97578c82e33f0ef1f3f49bb4be6ccb333c2e26d0d93bf7ad3da42ec0d121546acc94f4bb245641f012ac4969a666fa697e8d3b70bb46e746ed7c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    3b840d3d01966939da2696f09921f181

    SHA1

    e44111acf82ee43b2c530c23e4e251744fa4e242

    SHA256

    3a99973328d1604c3145ac3ef641077c400516d465a0a9a680a5636224ec3592

    SHA512

    06708201297f0e2caa089b47f6e7813f825af69a6956626095d3365df655fbb32a69f101f2321253cce8ed454d1073cc8b1d2ce469f92a52fcdaff8619b90b15

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    ff41482dcefeb5915349519a59655b54

    SHA1

    c4ee981ac672bce84b102df176fb56ba2848ca9d

    SHA256

    9c647f61068bd4ca7887e6869a179f6913d8bc87997065c0af83703634e37f43

    SHA512

    0340975ed5f7f12ab5216d87b6ac0527ae7751917456fa4519efdbae7351c052002dbecb5cc860c9ff510a015d9ba161f60e61c85574706eb53638a678328aa8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    1e1627a193786dfd3cee01c7857922f1

    SHA1

    e4be44283d1e44ac11b5b412753f822b38bec2ed

    SHA256

    7ef2dea02352f85ab96a58e2c6f7bfee89ebc9ae334e653e9b62aa93f720b203

    SHA512

    38c644635c6e0fc91732b208651160d6f5bfb21c969eeb4b7d45d9979f425f107ace06e3603d7a916524f7334e85c6aa9b80657466c43794daabf0b971d991f7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    1e68ba7216dcba61f78947434fdd9de9

    SHA1

    8baf19446759c376c68ad92e8062238c4113c17e

    SHA256

    cd42e7bfef7f2e92d3a3141d066fbedbce3254be3ab3a73638a95b274e2c3f07

    SHA512

    123334dedf9075006c5ab18d11b51bacbb509fa5c537344d496befb1c30eb05306c1d3db0bb1264a0f7a6eab7f1f581962ec1998fb3a0375a051a89f37f0991d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    91a47dae28578070f6b5fa4605824a61

    SHA1

    7a6210d3005bfc37d62bf76f971dc4f4863e85ef

    SHA256

    2b704dd4885e5881d866f062ca5d7aec1168fd6485b3f2d7b003fcdc678449ee

    SHA512

    b927b0c8145f78fa4f646b7c08f5e1b5909e29664da59267d1d3bf0e9b35ea5e3ae6a808bd43b066acc248cc2c4bf304ad93cc3a05b755cb84b50e9e81161870

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    990fdb8b9b5bc48c0e1aea62c01cad63

    SHA1

    c8ff69c894d685e27fda6d40616e5ad4bc052171

    SHA256

    23f73a84c812d7d94fe2b527009af8a6f3678921e0c226c02beb0ec4866a53d7

    SHA512

    a80c4911c351a552ff150bfe8b105727127f20b39a14abf46b7dd009b81c38a27292d589c3d8d39141639c88e1356e2b2d5d058ff89139e780283b97cd6082d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    ff8be25e0ad0d24891b1a256fe4cefaa

    SHA1

    a490e962d2d4f90f1f8a3c1a4d563b6658ca68fe

    SHA256

    d106ee4e969f316b8c78c1ef17f50965ebb481b7b7efe9a9da36b2ad868753e9

    SHA512

    60a7eab5101962bb2e246cdf102c54f439038466cbdd3377f4be53312b561e1cf9b9ca82f4ba37e6411cbeccbb8d2bc0414c997d1f70926e4f57a5ffef84914f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c58e9d577adb296fefd0c13d0ef33063

    SHA1

    0c5acff45f65ca2d8408299e77c91c50192b9f7b

    SHA256

    97c2e18bbb880873f08039f3d3dbb6ccafcd79fb09faa5e4ffd3a0b713820441

    SHA512

    4908920db96094af96f84ba125fe019e0a0bbe289ec7a609c0d056779487544ad4926064e39d5162e3fac3013b12f1aec1fc3e989afd889f495e05dbe1bfaa2d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c39edf892dfc57047b51a2e0f520952b

    SHA1

    c314917833568439610478c476c0b3c3070a7f82

    SHA256

    6a4b7806215e2d53bb6ac93688e0dfbd58055c79cadeb641445afac869f4e068

    SHA512

    639f15fd7c2825cb73ee7482321531ebde7303c5b1cf032b4a46ce9d6712e7925a85edcbd2221e20e3e97a9d92145965e3a158d77653bcc26a40a7b4e6eebca7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    8bcbd467c25da43f34810153f2af7b19

    SHA1

    9857c95a26347ed9a059031d604ecc09dd0c51ac

    SHA256

    284533fd013443a15c4cc0ca914b0d00fc12cc90d9db267111bdb75551145711

    SHA512

    afe2576c217de31fcfa2ce55b52af3274407d87667a6b634a6363f2764b2293df9420072edff86b5a9f231cb0bec590819260d1702388696f0803e6d150e6ca9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f29c317f60551e50d72d993937aea701

    SHA1

    21bce51719d78fc3d6729e0c00dc8a9f69391c07

    SHA256

    859b58f79627879d4d8b92908e3d275de7ae079a28d06cee13303420833d15ff

    SHA512

    9b00c2c8c9f9479f9bd79bf968d0f739c10242f17fa71428d610234c3968ee40fd7959a24547c0b9343c6baf3923f85d847d878a980b57c2ba74b137beb6e632

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    3b3f4c67f67c59158caf8269c67c2647

    SHA1

    ecd99ab3a5108ebcadf52a7d48189a908d471ec6

    SHA256

    d7725f32bdafa117520ec1eaedf440d31f842cbbd69c7b4505b3dbe68836046a

    SHA512

    67896f42fa9010e4485d689db43e3ce9f63ac29489c7d70be71113be9597f20b2912e2833402c8f92a38f2c9d0e5f419c34f18e16a0385e537115c611a6304e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    23cbd93b3a3832ea72aeab97d8d94cd6

    SHA1

    2a04d614b73814f71b6669e74dc5b657428aaf5f

    SHA256

    651e6d48eceafd06ba6a4053844c96814a15aed9c9f131d691494c23ef047c41

    SHA512

    a2357797b404941d42df5c68f533850d7a2fd00d9948f85602602cd4090ce2619d670e74e9d2b06e7ad83d4398ae0fe484bafb478db7539b41799f29cb46e22a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    46cb74a51aa4a6243970a8fa725b0974

    SHA1

    6228529e706853e8c7183bf49eebe9c240ef5680

    SHA256

    8f655455d9b79a68d300cd5cffaab29cd7007af9f063ea1653a12afa08fc3094

    SHA512

    b3df4762fbeea1254840a23dbd8c5ad6b433ac6795df02dca3072ec44e2952a2ca827e96765311334816a58f10a4685b41efbb330553ea4dc47bd0c474d6f684

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    e2ea7d3d416b688c273cd04153687ef3

    SHA1

    f0a545c27e6745579aac2e8164c2517b203d8df0

    SHA256

    516ba256616a9fd9a48269344008a6309c78a9305358a214a90deec5c862f89a

    SHA512

    45e70854789dee90cadf52217095a2f4207e1ffe063ce0a49e8f14e09668066e1146d7e5753f2c219c07c55b85b2b946ae6ae9a98edf76a5a4502d4e41816d38

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f43863c8b199f99a89a2cd2e15889bc1

    SHA1

    2532e5082c33f8cbcb11284affaee394bc1d26cc

    SHA256

    9e251bef2bd1f8d5e9cd77b952a7284ef979f5894a7be38dd897492f56b584d4

    SHA512

    55733476d6ad25c2a9ef859ee5af772866b390578d154e7428ca8103aed132928ab1c36fe7e56b150c1ddeeed447937cce7cae57851134d6b098079db84ef45f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c9a169b2594b7a0e28a79d73d99f1e31

    SHA1

    2c5acf29c58712a4cfca68d98e02d98ca620b3d1

    SHA256

    20fbb9ec63df853c0078d34b71be6f0ccdb3377471798830bb3537b400988a35

    SHA512

    d52507db62b730cdd6a8566a7aba02d788a977e1d0cf00b6a8ca277b919e2e136b19a31477f2b760e239c0238b482e1a32b843b122e1486381633ba48f730393

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T210ZMR0\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab2CBE.tmp

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\Local\Temp\Cab2D9B.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar2E3C.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NCUY6R8O.txt

    Filesize

    601B

    MD5

    c410b5cc48979fb15c67ad800a60bc01

    SHA1

    398dbb22bf455fff998664ce81621b0b13f7521f

    SHA256

    2479729f108d48e8183051946ae31f2b5116998eb02376b27b657d3e33c247d5

    SHA512

    153512615c64b5a1602b2a98715d2fdf414e13f128288b64f6117089c6f386ff5a4fdd02a3626031d075b39c0f7b244e6c8a2f68bad43bec6aefd569b1fc1540