Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

viewtopic.html

windows10-1703-x64

4

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28/05/2023, 18:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    viewtopic.html

  • Size

    114KB

  • MD5

    02cb6f948a364d8f506291e7607d3437

  • SHA1

    94a86660c977b8320775fb956c86019a19134531

  • SHA256

    d5f208fde276f07049deaef1d2cc250edf7aefee31928959088dac5a13a2eae6

  • SHA512

    309704112ddf6a02cb51bea330860de11b4e8fdd83ef8dccd5c7d5b14101ee5f0f4cc9ff823ecbbb760cb22cb197817d19cf19dfb04f7cf5af898dd606422dcc

  • SSDEEP

    1536:ptBpwGHx0HCaHCOEyZHiiuA4LHRKGECJAchfqa/3:ptPwLGECJAchfqa/3

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\viewtopic.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:420
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:420 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2704
  • C:\Windows\System32\SystemSettingsBroker.exe
    C:\Windows\System32\SystemSettingsBroker.exe -Embedding
    1⤵
      PID:4260
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k localservice -s SstpSvc
      1⤵
        PID:2668
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s RmSvc
        1⤵
          PID:2556
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Modifies data under HKEY_USERS
          PID:3936
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
          1⤵
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:4856
        • \??\c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s RasMan
          1⤵
            PID:3740

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Windows\INF\netrasa.PNF
            Filesize

            22KB

            MD5

            80648b43d233468718d717d10187b68d

            SHA1

            a1736e8f0e408ce705722ce097d1adb24ebffc45

            SHA256

            8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

            SHA512

            eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

            Download Submit

          • C:\Windows\INF\netsstpa.PNF
            Filesize

            6KB

            MD5

            01e21456e8000bab92907eec3b3aeea9

            SHA1

            39b34fe438352f7b095e24c89968fca48b8ce11c

            SHA256

            35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

            SHA512

            9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

            Download Submit