Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/05/2023, 20:56

230516-zq4aqsce86 1

16/05/2023, 20:55

230516-zqq1eabf7z 1

16/05/2023, 20:51

230516-znevcsbf61 1

Analysis

  • max time kernel
    960s
  • max time network
    1606s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    16/05/2023, 20:55

General

  • Target

    https://lol.zip/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://lol.zip/
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4124
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4124 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2708

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    59077241ce0ac9ac8eb9b9310aad1952

    SHA1

    e55ab1ccbe4d6b0c3cdabf5b8b7b06a2957e05b8

    SHA256

    5ac8fd637c49c033c7f208265b0323fb9a626767da12d460b9d550e4bcb92399

    SHA512

    3b603aa5ddcb00830d46c4eae716f9b4e2493729a21cc6be0d257046ef23f78882446f84aac06572c0cf9a10da0f89897fda8bba078046b84fecd8d6992f59a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    9a38ed55cdf9e0f432ebf4226923a701

    SHA1

    9a3f606c0d0abc5d45518ddbb1dae6a1ce081243

    SHA256

    27d5a992d1ce1e9176969fc95dce9b2cd8654c43463cf9795bd754f203bc464c

    SHA512

    bef5c756a71a0ada36f29c08c25181dcf9ef9d636c477a3f4d6e5117849f71302d7c970e7e1c3bdc2a4d98dfa28d2a9e7b2e40f9cc7a3898a810d749eb4bffdb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

    Filesize

    4KB

    MD5

    da597791be3b6e732f0bc8b20e38ee62

    SHA1

    1125c45d285c360542027d7554a5c442288974de

    SHA256

    5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

    SHA512

    d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6RO0PN6W\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\A3UW3XUH.cookie

    Filesize

    244B

    MD5

    24627f3efa550acdf5e1ea774efd5f5c

    SHA1

    6f14b8c066cee8fe0ad69fdadcf07c5ac970b08b

    SHA256

    0e3c7a568ada3e441959f6a8bf29722657389f78609271cbe5120bca8aebfe12

    SHA512

    bc7c97cff46f2f6ae72bd26ac362d627a201385a3ac1075965bc4666a35c4d47cc02e76ef28e81480308ef503d9d577dda5b94cd98cc9a2b0943355b1a212647

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\QU5777NF.cookie

    Filesize

    611B

    MD5

    99e70ea99698fcc89e81a9171c75aaeb

    SHA1

    f696833fc083c715beff7b28b9dbe2ed16050a26

    SHA256

    899a732fbfbebbad0cc99a32262b615dd9a05c8dabe06a051d22fdc6c8fedbd6

    SHA512

    cc3445c5f986659fb68490742dd7cfca946a63531dafb92d9aef3156586fc5ea7044ec403bb74ac830e967da018ed58269304b67875e046e26f3186391ece3f1

  • C:\Users\Admin\AppData\Local\Temp\KnoB172.tmp

    Filesize

    88KB

    MD5

    002d5646771d31d1e7c57990cc020150

    SHA1

    a28ec731f9106c252f313cca349a68ef94ee3de9

    SHA256

    1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f

    SHA512

    689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6