Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2023, 21:01

General

  • Target

    https://myroqers.pory.app/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 61 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://myroqers.pory.app/
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1548
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2844
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1548 CREDAT:17414 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1572

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

    Filesize

    1KB

    MD5

    b94c95b30cbba65d04f9f41d22d02fe7

    SHA1

    b091f08f06d9408a3e2a554d16cb3d40f2cf37f3

    SHA256

    ae4c5c63f3124cb229f78255c3861188d37f2110785c0f4992c7b28a3c57e8c2

    SHA512

    04e7847ec6b560a369842a3ef93551e939b97ff80e9f6bfd4741433b7556e2c922f431f9e297f6853df1fb7344d6e1ff3e8b9d5e00a1362634617233e3373cb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    78e9b4e882c43acc881d686739d07f2d

    SHA1

    4e6cdb6d30eb906b050697ee001d0d2205e442b9

    SHA256

    c1358626993d7c983bfaccf9759a8a66fd58cb66710d6af0ffe4f187178ddb91

    SHA512

    ca301a71f7e6c85f1fb2e7af0cb3eac48daaa184ce6c01b4209e62ee9958a293eb3276713acbbdbe74fcb989262c31e6719e5c0a6bf53684ed45dcfc231847c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    78e9b4e882c43acc881d686739d07f2d

    SHA1

    4e6cdb6d30eb906b050697ee001d0d2205e442b9

    SHA256

    c1358626993d7c983bfaccf9759a8a66fd58cb66710d6af0ffe4f187178ddb91

    SHA512

    ca301a71f7e6c85f1fb2e7af0cb3eac48daaa184ce6c01b4209e62ee9958a293eb3276713acbbdbe74fcb989262c31e6719e5c0a6bf53684ed45dcfc231847c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\223DE96EE265046957A660ED7C9DD9E7_EFF9B9BA98DEAA773F261FA85A0B1771

    Filesize

    450B

    MD5

    4b24d8327daf316556898255e43bf938

    SHA1

    76db94141d1f6d6df1bce08018357090b8df059e

    SHA256

    3151c0bfeb075ce283d24955657c2e1e2065916e73d25c10be10425ac907f398

    SHA512

    6728ed315e4803b4c62e7eaee7d705140471c25e781a2924bf905ce21efe822a2b7ac797b8271b4eef37a4126f78dbe82517cbf7a1678d63f0bb3d9473015419

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    3eb0b9c2beb49722b5b46dc8a769cc42

    SHA1

    1d8e4406f5ff263168c5b06914dc723442bd5a8d

    SHA256

    5887003625f3ff283a719e5fedc078f775b850a4140a144daad687b6e7d812d3

    SHA512

    322966e3f64c1427d010ec908e68ca6b97ac3768fd7f93641b889da62f68ceac5a2e59c0c270cf620c84f5d2726fb7fe5550aa6129f879ce200bd588f18f7381

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    3eb0b9c2beb49722b5b46dc8a769cc42

    SHA1

    1d8e4406f5ff263168c5b06914dc723442bd5a8d

    SHA256

    5887003625f3ff283a719e5fedc078f775b850a4140a144daad687b6e7d812d3

    SHA512

    322966e3f64c1427d010ec908e68ca6b97ac3768fd7f93641b889da62f68ceac5a2e59c0c270cf620c84f5d2726fb7fe5550aa6129f879ce200bd588f18f7381

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    434B

    MD5

    f743c8c7b78a5388d0bd5c9de33b78a9

    SHA1

    febe9130313bf7ee80165d768f3681359c64dbfc

    SHA256

    a994f670dca0ceebc8b3f30e94aa67c3da3d0087570ad369bc74c2e93a3545c6

    SHA512

    77b37eef8c7759fc188315d8204ee3a8ccfe07aba02af2b3e8b2a6b293f7c1179dacc21cfdd491e0f71dd1fc918f73d8a524519cbb0a19be0cf752f905d23ec0

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verF06F.tmp

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat

    Filesize

    13KB

    MD5

    62cc8f7495c3290028be71bdc90b9476

    SHA1

    1805d3461b4f99fdea648549497793b334970537

    SHA256

    f8fbe0b881e1ef44d420d547e40755a83f9b4b560ada64c1ea05d6f188b4f762

    SHA512

    b6d1f3a6b48e72ab5f2fb579ced0a48c5c46c98b54d85023a2f176fcd8e1c925e377438e29d278754b858d9f214bbec8a247563d0b84a1fcd80b11d1e4c49881

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\osplltc\imagestore.dat

    Filesize

    14KB

    MD5

    b1a185409ac0635b7ca9cfa1c280fbc1

    SHA1

    da80435600bbde3011c768c5497c3edb0d285e42

    SHA256

    1d7f0f60fbdf1e71715ce71dc1e24d6b9fe82580a874fcb12bc773e20d7469d6

    SHA512

    e076b57a0eda56470cf183b757d07bf35c859abac7cfcbe249b94f3f235d90b87d479afd16a8f9cebd231f64f8fd2fec51a89f91cd04684bc166d4283d646872

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\6xK1dSBYKcSV-LCoeQqfX1RYOo3qPZ7nsDQ[1].woff

    Filesize

    15KB

    MD5

    d3f496f9a153071eeb71409a94761eab

    SHA1

    10ed904d12ef69435f91f778826b57726c2357b4

    SHA256

    4669f3a2e03c44031cbb34ee48a7073edd205f5afb0796e9f05415b6f53c2f92

    SHA512

    226b9d3a36d8494b390f39770b7919288759cba16e99f95bc64dc8d41c652fb4c387c7c2910001675e19c4b1b0b6982b84a9367c19d7b7c2dfb319d2ebd0c15d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\script[1].js

    Filesize

    59KB

    MD5

    b4bb898859e9daf0d7f921e23f037388

    SHA1

    af85bb93b4ff0bf9c4077bc23a62d25ebc59f4a8

    SHA256

    104e62731d6c292c8752ae67a472477f65adef0c1af455a0a99a28141d9ce1b3

    SHA512

    e05e5d93bf0bf3e6dda7b57b12e89194e2f7c6d555dab4c9a3fc80dfc37f6f13f7d18e4fa2abe20c3e94f1e5f1410a0db663fc57e0795cb56f796fd123220611

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1IYUAPIF\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j[1].woff

    Filesize

    15KB

    MD5

    78270194dabbe66d21e4a03ff9368168

    SHA1

    2d3405deeb5777925daf14cb0aece6ebf58f6cab

    SHA256

    96f22b128087b997256dccb88e388342882c5384b3ba7ed5fbe0d0b92f7e60e8

    SHA512

    a36f66eff923f4a403f63b66ecd9ae6c53c4517da92bc440be1ec0147a454aaa8c9b6c8cfb0b8bec48073f4f933204628b339d03095fe7e99f20f82c4bf2e5b7

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZMkids18I[1].woff

    Filesize

    15KB

    MD5

    6c4bfcd073e3335747ff5e6b5c19b069

    SHA1

    c4c7861f0a3020b094ea24626d020bd86296c216

    SHA256

    120320c0e5bb2d0af22ea002bb89b74fcd454413a53238cc1eb1ba6e298f7b6e

    SHA512

    2454af4116758b3f3a28a2513cb1a6f5bbedfd5f8bf93c9134aca518aab3624011f8b2e4aceff75a7985cfa4b9a4ab98cb676b8f5b23069e4d847590d2d7bb7c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\6xKwdSBYKcSV-LCoeQqfX1RYOo3qPZZclSds18I[1].woff

    Filesize

    15KB

    MD5

    985537d16d13148b860f13243ddcecbc

    SHA1

    e9a087181649207193954023baf677e7c91c1790

    SHA256

    97f11e1650ccc962ce8474551e0a89dbd21d61757eb400db786a06f098699bc0

    SHA512

    7870692ca848c337c0bb31cbdc87007950b63d42a6e5c6f598bcd52f96c5c06b26bf7f066556ffde22d0d915f03452603605826b1b80b3738e8110f063f44c1b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo[1].woff

    Filesize

    15KB

    MD5

    b10fc4050d2c1dbe1a7c521ae32089ea

    SHA1

    6cc16f805bae4a786b094422df27b05c27ae9727

    SHA256

    f0043e99b06f9efef0bb2a1bc44a9ffb455cd890f9a9fe405bbced155274244b

    SHA512

    c85a581c8474a4b172739aaf30994872e185471884f0eaaf12393337f488f66b557b94e641b092e712fc3c37b6100120cbc42ee427d06f90d429950b3dd6085d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\UX.4.31.0[1].js

    Filesize

    307KB

    MD5

    99bc9aa0341f3d2e67dcc29cf926eada

    SHA1

    cf7b68c4ac0e18e6d41f9127f39d00ec39110e1f

    SHA256

    147a060ca993a9831de1de0aae5206e552350282671c3c25f43428e2d01fbf3a

    SHA512

    fb6c8209eba18925b6b62ec71f3119c7a8a91aef87a9e99372595c6095788878635496aa170957c033f4f4ec915fe9dcb1383624ceeabf4915720d35bcca1917

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\myroqers%252BqfJRrc-faviconUrl[1].png

    Filesize

    13KB

    MD5

    d8fbdbbe5042d36870e8ef4393435d6e

    SHA1

    4ea3af01e5366cb27c40c2ceed5f4b187daf5c6b

    SHA256

    1ad69a01666ac52ae78e2b985513f4e5d7e1910e24f1073dd3b7754ddeb44904

    SHA512

    7d3c576e98aa30cbec84eb499fa89d0590f9d09f8e904c455d100bdd0d38a0a2fac3bdc3948b88f1bc48321e815cbbc0d10fb602c54b85abba53c45b0bcd684a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\S1Q31HZS\nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKfsunDXbtU[1].woff

    Filesize

    23KB

    MD5

    d02389840b3f2b007c5e88505823d120

    SHA1

    898ec4cf97dc1616793ff8139b59068710e06016

    SHA256

    f4b6010ed9325b4354a43c4ac78305ccb1019c7af9caa2c9746174ea1c3adf3d

    SHA512

    b99c4c78bde2bd25392539dff1235ca03789ba584e6b7fa2477a1df9cdc052a896b03959c85e976878b9b669804a85488434ec17700948f83b5a74318bd7d7f0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\6xKydSBYKcSV-LCoeQqfX1RYOo3ik4zwlxdo[1].woff

    Filesize

    15KB

    MD5

    7af7d3e65e69435892ef97567b07bbb2

    SHA1

    588ae6e6c1ec59515629acec0359fb3a3fc4e59f

    SHA256

    2e6ace04cedde28d7117a7ab3ee4934bdce6f0b269b3f30ffb4e2e06b1fe91f0

    SHA512

    240b2da8031166ea368cf361231785b426ff7e6f7d61053e34238502c2ce9ad12c575ccf48f25c485cdcad4a4c66efe178c190288f4dcc0cb9e267f4df4e5f23

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKeiunDXbtU[1].woff

    Filesize

    24KB

    MD5

    63c51fcd6a5e8079e74128cf99696333

    SHA1

    477b5ae33fd67d65808ae6ed2abe0f4f4de3ac92

    SHA256

    7a4a9d3b6103c69ff73eddbb93a64307ffcac622c72a0ad6edae3248fa68906b

    SHA512

    b45b0061b2a604d75af590228aa9665f55d5df3f5c4a7a37203c6aafaf48598746f8d96b65f0da6c1732a497f02d477c31cc87407fe79c87a86314821e4b1b55

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TUIJN6ZA\rs=w_16,h_16,m[1].png

    Filesize

    532B

    MD5

    9c010932b3f160a44a8f6c54c0719eb1

    SHA1

    9a7ff40bdbb15dcde596758a91bb62170792a285

    SHA256

    be33fad08931ab945b98c997b81f22e1bc44be86ca7d122d39a1c6975d100470

    SHA512

    4f07b70fffcea1979e8f2f403b73cc20b9e6f1ec89336b20d0e935ecee1fbb09d23def3c4219fc6af18760cc0b5b590f729ce9653793b474084a5d4d876bac32

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\nuFvD-vYSZviVYUb_rj3ij__anPXJzDwcbmjWBN2PKdFvXDXbtU[1].woff

    Filesize

    23KB

    MD5

    d03183901b9b03fbeeab68aba2ce73f3

    SHA1

    3bffd6b9e1fefde05e7956a3b2eee5e6d88f3315

    SHA256

    d795ca88c5413ed157502439c693bf1fbc0e5cb93813378a3de51b6a300ed960

    SHA512

    54d42e89c5d72a9ef8da7a3e93c3413cb1b54637f9b7c971ad0a4b5cf9bdfc4ab78c8c0f0ef31e15552d2b94679a342f57a917b504515b095f09a9cf957888fc

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YYL8D8JJ\script[1].js

    Filesize

    11KB

    MD5

    f9b15494214d239816355488960f05ff

    SHA1

    296ecac384c555a2598a861f947d8a054d27d0ac

    SHA256

    49f5ba7217b18fe9510a828a26eedbd69a01584f918f807eaeaf0b96e39eb368

    SHA512

    35162eeef686b2c7a7dca5aaac710c24ff8b032df58d13303acf09ab329954bf1d4afa98d40972c14f2a2f533d25b2aa3cde1a70547e59005fd10649a3934292