Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    58s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2023, 06:14

General

  • Target

    ThemidaSDK/ExamplesSDK/Plugins/Examples/C/TestPlugin/TestPlugin.xml

  • Size

    7KB

  • MD5

    61a5e554c6496e41c4300f5fd5078e4c

  • SHA1

    0ac60568eae3ce594b1c9b430440a6ae3f046a59

  • SHA256

    afd5ecde10cd874cd8e82cc837014768c1db3ee68b8de402e05fa31cf86b2597

  • SHA512

    8576e334a1e2f7ffa82e0ebb3559916cda94d6e6e4b2114a16f6568345db2ff28bfa392914ca4470b8b310e679342593d35ccd2efb29809d444b36dea36c2763

  • SSDEEP

    96:tpmzwaGS66LzCa9Nt6gz9a9Sd6AzRa9Nk6ottAipfwpfnpfRp56AebI4:tuw+tCWJ9RHRW9iFwFnFRyAO

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\ExamplesSDK\Plugins\Examples\C\TestPlugin\TestPlugin.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4596
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ThemidaSDK\ExamplesSDK\Plugins\Examples\C\TestPlugin\TestPlugin.xml
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:17410 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1876

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    3fbb8ee33354096d9f116c557a402d14

    SHA1

    f75756c42d45d1047eb04fa54bd7702f5560df4b

    SHA256

    13e2696561dd0955e1d61f7e18166c8bd7a02faf1dbfe04e738b5d68cc2ca57e

    SHA512

    cc21e56f9278282b3c15964b5618d42bdfda83b245d7bf01d12550aabd69a9747d1deaa5a9a9830e6d6a47465f580e21e0a7621cf992b56244ad4bee8779c338

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    e7d19cba0fa40a9cdf9eb0f2ec39df20

    SHA1

    e8b4b9aa5b1fc571bacbb553c814f332dd517ba5

    SHA256

    bba6c96304ca4f426d0c3b289e7d0f4e73758337cbce88b033d260c8eb20201e

    SHA512

    d4082ab8312d80982bf72243e304265430855632c2ed3e8fe58a17bbb60fdb3129c1d909bc14ec5485ef2e6279d397ed35fc5e31cb3535848f9dbb6bb64e4dab

  • memory/4596-133-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-134-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-135-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-136-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-137-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-138-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-139-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-140-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB

  • memory/4596-141-0x00007FFAE9A50000-0x00007FFAE9A60000-memory.dmp

    Filesize

    64KB