Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    63s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2023, 17:55

General

  • Target

    https://storage.googleapis.com/cezayin/miliano.html#PU1BeO3sL6.aspx?fPLFRSccrkTncy7ldcdcV4ddc9tzDkRl5cbbb5c

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://storage.googleapis.com/cezayin/miliano.html#PU1BeO3sL6.aspx?fPLFRSccrkTncy7ldcdcV4ddc9tzDkRl5cbbb5c
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4628 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2244
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:3084

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      471B

      MD5

      080320bb3fe7e7f860019942e6f77f9c

      SHA1

      2d6f3813b1ed7972c01df6330eb3b0c30339eda9

      SHA256

      9eb11d5a62c35054e50d193211638a08c9b94d5b360f943df4124e28ab793a6f

      SHA512

      9def7fa57fc58af72dc374f0ca010107585a355ffcb3c1d3b99064a455acf3fe8ed7d42052234fe2d042b5ccda8af4ba16a8b2dd882b01f0be7edb8cf7aa8944

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

      Filesize

      404B

      MD5

      1f48e1f57be092766e5ff8dd782409de

      SHA1

      29244412ab0116fc911948c68c1684ba4fcbf608

      SHA256

      af86b8f6150e7afe537aef70a1c3f4270114046685053ec75f7b612ff0acf2e8

      SHA512

      841acf1b186342585462a82e7f2c61cea1b82fbd2c1cf71359a3fe0046da3ca3447a742c97e2f9dea15b6572c4dc150e28c98e05785900e2a9df8974cd795f74

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\E3AKJ989\ak.torioluor[1].xml

      Filesize

      13B

      MD5

      c1ddea3ef6bbef3e7060a1a9ad89e4c5

      SHA1

      35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

      SHA256

      b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

      SHA512

      6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\GPVLIKPI\PYSSF-2G5M4-CF5QF-HK3F3-LMZFS[1].js

      Filesize

      205KB

      MD5

      fa4c76a7fde62b18054cf7eb8e946012

      SHA1

      b20150066a879d2b78dd3d4908f4acd148ee66f8

      SHA256

      09ebd7f407439990aac227e70da23e1a819e8e30282928e324370805f480bec4

      SHA512

      d72f5d078675c7adbf6bfc1980712542a10668aec9163137a2ec70a5e117f8ffdd0f06a6c4c6636e35c04f2754f33d40c65c59d452afaa8ea4a382f24f200abd