Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2023, 18:21

General

  • Target

    https://www.arcadepunks.com/400gb-coinops-ultimate-unofficial-pc-build-from-ultimate-ops-gaming-its-here-and-its-awesome/

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 60 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.arcadepunks.com/400gb-coinops-ultimate-unofficial-pc-build-from-ultimate-ops-gaming-its-here-and-its-awesome/
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2412
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
      PID:1276
    • C:\Windows\system32\OpenWith.exe
      C:\Windows\system32\OpenWith.exe -Embedding
      1⤵
        PID:1144
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
          PID:4664

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          471B

          MD5

          080320bb3fe7e7f860019942e6f77f9c

          SHA1

          2d6f3813b1ed7972c01df6330eb3b0c30339eda9

          SHA256

          9eb11d5a62c35054e50d193211638a08c9b94d5b360f943df4124e28ab793a6f

          SHA512

          9def7fa57fc58af72dc374f0ca010107585a355ffcb3c1d3b99064a455acf3fe8ed7d42052234fe2d042b5ccda8af4ba16a8b2dd882b01f0be7edb8cf7aa8944

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

          Filesize

          404B

          MD5

          f944b053084befc69aa64621dd2ba9cc

          SHA1

          8dfeaa8032dcbc5c510e73da2681618d05762772

          SHA256

          8dcda424f569fc0e4af8b4475be25dba5d887da8608f743dbb0dcca5019cbac7

          SHA512

          a5ff74e2402001566059831d2264231d3eefdc0d053fa6b51b7fd60881ea28ae728573f16f3ffc3756f7d010cad905b9dae8bcb3b315a053787deceb4fef8c23

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K930TPT4\www.arcadepunks[1].xml

          Filesize

          13B

          MD5

          c1ddea3ef6bbef3e7060a1a9ad89e4c5

          SHA1

          35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

          SHA256

          b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

          SHA512

          6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K930TPT4\www.arcadepunks[1].xml

          Filesize

          24KB

          MD5

          1de119203dbdd5feda626e90603d1cb9

          SHA1

          a0d5c0f872fa9d1e0f27ea32eae2604b24339308

          SHA256

          cbf65448efdd38d953cf4dc4a9216b82b7568dd9470cc2eba3bd8d22efd60eed

          SHA512

          39c6e1568d3215deff5b242012208a9be0a505d208d6720a59813803cec0c9d0130a049e31de2b200863d0a2acb24f53213c64352df3c547ad7c94fbaa61edb9

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K930TPT4\www.arcadepunks[1].xml

          Filesize

          24KB

          MD5

          e8c2f28d6da265fc4802a045804bc41e

          SHA1

          851c1ecfbc76c383ca7962235390f4102d81e88d

          SHA256

          f272026961c79ccb50dd114c61f93b2d6b3f41e4c5020bedb4f45af7a19df577

          SHA512

          7e60316b8fd6a904accc686ec5785b7e0ad961dac080805fd9666d9fd68e84f8a8bb8c3784c6eff41bac126cefff9f6fe5e9be9986bb02abb8c49490931e8299

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\phzg4yt\imagestore.dat

          Filesize

          34KB

          MD5

          7b806b4ed7c1577fe5155326c11f4c4b

          SHA1

          8ee7a9bafe890f5d225218e1d6d4e3d69d88d243

          SHA256

          9cb18686341f609f65cddd45c700b473950e2c7433d3ad6679abea6aaae3889e

          SHA512

          282205562e383b81278babfe52e55b71766429c280a4777bcac83138df68e0084be6123883d45c3dd4c567a4c4deabf1d87720774db2d42565515defe4c64af4

        • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\phzg4yt\imagestore.dat

          Filesize

          34KB

          MD5

          7b806b4ed7c1577fe5155326c11f4c4b

          SHA1

          8ee7a9bafe890f5d225218e1d6d4e3d69d88d243

          SHA256

          9cb18686341f609f65cddd45c700b473950e2c7433d3ad6679abea6aaae3889e

          SHA512

          282205562e383b81278babfe52e55b71766429c280a4777bcac83138df68e0084be6123883d45c3dd4c567a4c4deabf1d87720774db2d42565515defe4c64af4

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\27e3db99799b96f4480677c67c826abc[1].js

          Filesize

          46KB

          MD5

          27e3db99799b96f4480677c67c826abc

          SHA1

          d777da251916c71cddf53845d298abc0cc80eca9

          SHA256

          43f77c0ed4fa48ac32a52b96656bf10d963daecba71fdeeebf1b72d71dec6f41

          SHA512

          f9902e5f463027cb1486bb59d89bd764cc406fcb67ac2c7a6bea3e38f54f0b89f0a7be13d28fe8c1956a7f463c897b3980337bfb3dfee0b6a596a70817280403

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\fontawesome-webfont[1].eot

          Filesize

          161KB

          MD5

          674f50d287a8c48dc19ba404d20fe713

          SHA1

          d980c2ce873dc43af460d4d572d441304499f400

          SHA256

          7bfcab6db99d5cfbf1705ca0536ddc78585432cc5fa41bbd7ad0f009033b2979

          SHA512

          c160d3d77e67eff986043461693b2a831e1175f579490d7f0b411005ea81bd4f5850ff534f6721b727c002973f3f9027ea960fac4317d37db1d4cb53ec9d343a

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\rx_lidar[1].js

          Filesize

          170KB

          MD5

          493fc2fb349be5e4bcbbcc43503cf75d

          SHA1

          36b2e67b7dbf88e1d8aa7a6845f7116781b48de6

          SHA256

          2c3e04a3f536b4a6300aeee8ee1dbbfddaacaf29d9f44dadff76b136fab44e38

          SHA512

          ec853366b0e0b4584a0d46a017b349af98054ec10b05d79298d5f730fa79c289399aaef16e5966a7ccd50cdd14b315039a7a58819c7719976a8173f65e8b29e8

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\400gb-CoinOps.Ultimate.PC.Unofficial.inc.Updates.FINAL-UOG.nzb.qtp7zqn.partial

          Filesize

          55.9MB

          MD5

          be1f85f234efb4532fb98b2345441956

          SHA1

          b05574a22674368e76317d6a22560e2ed43493d9

          SHA256

          e69198a27e07dc99f16185b6a0eb4ec286aad8ceb8d0c248aa97aa7716f37914

          SHA512

          2a85992b50809a788feb45c040ddab52c381ed3b499c97e996a2052af4b9915101b69b3ec7d2353bfd1768d9dbf7f3b8a70c9e6fa6c34d136e060bd0f6e7a2e1

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\400gb-CoinOps.Ultimate.PC.Unofficial.inc.Updates.FINAL-UOG[1].nzb

          Filesize

          38.3MB

          MD5

          bdbfa6ca8c96be074252d987b7f6df23

          SHA1

          e33bc8d985c66fabd076ba35052974c39e84cc17

          SHA256

          a886d96a78d4711ba7cc961f8124401da1566b7f8dcd8361a920c1058d511f70

          SHA512

          d1058c0314b8cae86d5b275ce531e9e71106b077525ad27e04bbf83493db471935ba9bbb68e120abcf7b70c3180942363084b245ed388c22e1e8c7b6dee9e338

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\400gb-CoinOps.Ultimate.PC.Unofficial.inc.Updates.FINAL-UOG[1].torrent

          Filesize

          213KB

          MD5

          5da21eba9dcbb56ca81c533ee62cf5c9

          SHA1

          acb1bbf3bc7c909eda5d540d0b6be7deceec9b96

          SHA256

          26c6d0fe5d16c06a0e67e0fb37efa7d0e3278ec150fd27e846f551768186bfaa

          SHA512

          5ea1cc67e835120da3df227a49b006f36000138f8c5330cce95e7ca109bf77e10cf1a1afc6e37481ce5318c853b5a48dc80098897315fa372d5e30b9643f6c4e

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\f[1].txt

          Filesize

          27KB

          MD5

          582bb9c84477151b241270e46f51243a

          SHA1

          7d96f936a7ae6bbb0cd2ca49d3aa2df6fed66990

          SHA256

          30593b40466e153c1dd106ca0ae6df73f177ca95013a85e22e7af8cd49e88d3c

          SHA512

          a622c885c152ce7259b9ff17888e8a6ef55bb6855f200d79b4576628182102948843dcc2b31d83603404d2efe01bcd4a3a6a2485286e56c54a7eb61999ccf11c

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\f[2].txt

          Filesize

          28KB

          MD5

          ee7eddf2e061c40fee66d9c87e516e92

          SHA1

          80faa42acc776a3e5107a515c7a85db9a9162204

          SHA256

          a91fca903f7f2a3d051f657b5b25baed4e99b6c1e51bfee63737f73ff54f2b7c

          SHA512

          2287bdacea612d4fd8b3cd300ec7c5d0fb147a596d37ced7bd7937ff2add9ef73879dcbcdd38e1b8dc4dd93139c8a916d070b168e037fc489c2c5919581ad256

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\f[3].txt

          Filesize

          2KB

          MD5

          9d80dc591faa66aa075cecf847443914

          SHA1

          84c39f101fbd49030b60b48f9cd7a37dd69ba9e4

          SHA256

          e0b374d64219f25c480983127d46b1dad0d87e14292b621df9205a2c3c5ce98a

          SHA512

          b03a3bbddd8f2111087a453ab7979b8434eda242d40e8bbc552b0bbc99b956d302003731678caefc6fafb0ef8248416db716049f7b37e7dac55498e64d078e0b

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\f[4].txt

          Filesize

          2KB

          MD5

          43df87d5c0a3c601607609202103773a

          SHA1

          8273930ea19d679255e8f82a8c136f7d70b4aef2

          SHA256

          88a577b7767cbe34315ff67366be5530949df573931dd9c762c2c2e0434c5b8a

          SHA512

          2162ab9334deebd5579ae218e2a454dd7a3eef165ecdacc7c671e5aae51876f449de4ac290563ecc046657167671d4a9973c50d51f7faefc93499b8515992137

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\js[1].js

          Filesize

          170KB

          MD5

          8a72705c6e531d1b5dccbe83ca863f3a

          SHA1

          9de5860667d97d0f7e2982bd9b91fab26e278ec5

          SHA256

          b9100ead8250877ee5ef8b9cdd0996819e0b0d51a3bf7b5b376643b3d3b09155

          SHA512

          8f5cd89862899632ebf608fe367035df9aeb928fe54d8e86f0b2fce62569d9d7f80fec5ef95fbfef70621d124bb3de5bd4b47ea237b5038d7fbfbf8de9e48906

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\4VT6R2QM\s[1].htm

          Filesize

          143B

          MD5

          e4e31b474d3e0b577b3c8856e91f8659

          SHA1

          a81311f7fcfa9b6b23a24d4e5c976d5f75b1b9b7

          SHA256

          18088c10e79c926292732af98a0ce470e90f3fbcba4bb4896ab3310c2d94e421

          SHA512

          a07961eb39c4cd4e39ee19e2c675e64e5ba5367daa18e2f76a23772abd62f46b002e6be8fb0f35a70616941178facc8df579c4a68e5811b74313c12806aafae3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\KFOmCnqEu92Fr1Mu4mxM[1].woff

          Filesize

          19KB

          MD5

          d3907d0ccd03b1134c24d3bcaf05b698

          SHA1

          d9cfe6b477b49d47b6241b4281f4858d98eaca65

          SHA256

          f2abf7fbabe298e5823d257e48f5dc2138c6d5e0c210066f76b0067e8eda194f

          SHA512

          4c5df954bd79ed77ee12a49f0f3194e7dbf2720212b0989dad1bc12e2e3701c3ef045b10d4cd53dc5534f00e83a6a6891297c681a5cb3b33a42640ae4e01bbfd

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\c6aefe2f1976071c0b2e145750c15212[1].js

          Filesize

          14KB

          MD5

          c6aefe2f1976071c0b2e145750c15212

          SHA1

          82513b079524689a320e217b7fc4c34e4e0265ce

          SHA256

          02e8733d271fa5d9da4c00a3905c39a680c08c5c2d40f7a57cd9035a3d7d21be

          SHA512

          a3d035c4189ccc14c086e49aece715cdd9e6723a6e8bf5bf30be6e304d708cb17c41956ec1eeaa21bc0cbeea526101421267ea417afd03be2c95bcddb6af60f3

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\favicon[1].ico

          Filesize

          33KB

          MD5

          35970638ab00ad192bd37e65c2e7e2ac

          SHA1

          9bfca389b600b18dad51dd87c3cb76a497d576f2

          SHA256

          938db550aab40cae02e2c19b1ae5a43d658782749d11cd79575c15d888d1792a

          SHA512

          ed75faa6d501b2e1d8a7b8b6cfea7177dfe0fca8d3dd4cc17844e6ac745a91106c6c67b298ff3315e15638bc3b6942004a83d3e4cdd8d3b5713c77b3d15b8761

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\4Ua_rENHsxJlGDuGo1OIlJfC6l_24rlCK1Yo_Iqcsih3SAyH6cAwhX9RFD48TE63OOYKtrwEIJllpy8[1].woff

          Filesize

          26KB

          MD5

          5ec579e39f77190de20a4cb4d7b082dc

          SHA1

          d99f1d73c37968cbdbe44c7387e7474056c4b034

          SHA256

          031c66a54247283c9430caeb5c54a90e5974244c9ccb0234d53b27d4a484816b

          SHA512

          3e11f6d2fa13eecd4fc34b1186a96dad8dacb629c046e606f2dc7cb53385ae9a4e0f3aa950b1698fa188c3e449cbf03423e46f8632b81425d8abcc4b145cb617

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\f[5].txt

          Filesize

          161KB

          MD5

          981d74839b4d501f1ab0c3db0823b42a

          SHA1

          10d9e5b0294e4014d6dcdbd8d15a129fc6488d0e

          SHA256

          46e15f31352ebc0ba3577a9d79e9a403614ad2548150fcb28037c57cd214beac

          SHA512

          2f93d0822bf900f9596eb1d7baa4f24815226f777dc5536219be8e86f9e61c383bf44ad9bbb6a5d0aeb6b1e27bcb219fbfdb677076e3034f1625bec62f0e6ca8

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\kj0lSj8c0voZei3RrUBqDhc-TU2DfgX4FxFYnliAdWA[1].js

          Filesize

          39KB

          MD5

          84736c9195db8dad981b7d93bedd95cc

          SHA1

          2c77a0968f374183216382eaf55df842ba5bf41f

          SHA256

          923d254a3f1cd2fa197a2dd1ad406a0e173e4d4d837e05f81711589e58807560

          SHA512

          41e54abf643447cf560269a6998c31ae74489eed272528e8c295de83dab77ed0fbb70b06d9262543a0087b330281815dbed2b03529d84bb79da310e323df1ef2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\pixel[1].png

          Filesize

          170B

          MD5

          e7673c60af825466f83d46da72ca1635

          SHA1

          fc0fcbee0835709ba2d28798a612bfd687903fb5

          SHA256

          0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

          SHA512

          f1c33e72643ce366fd578e3b5d393799e8c9ea27b180987826af43b4fc00b65a4eaae5e6426a23448956fee99e3108c6a86f32fb4896c156e24af0571a11c498

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\suggestions[1].en-US

          Filesize

          17KB

          MD5

          5a34cb996293fde2cb7a4ac89587393a

          SHA1

          3c96c993500690d1a77873cd62bc639b3a10653f

          SHA256

          c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

          SHA512

          e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

        • C:\Users\Admin\Downloads\400gb-CoinOps.Ultimate.PC.Unofficial.inc.Updates.FINAL-UOG.nzb.nrudcdn.partial

          Filesize

          55.9MB

          MD5

          be1f85f234efb4532fb98b2345441956

          SHA1

          b05574a22674368e76317d6a22560e2ed43493d9

          SHA256

          e69198a27e07dc99f16185b6a0eb4ec286aad8ceb8d0c248aa97aa7716f37914

          SHA512

          2a85992b50809a788feb45c040ddab52c381ed3b499c97e996a2052af4b9915101b69b3ec7d2353bfd1768d9dbf7f3b8a70c9e6fa6c34d136e060bd0f6e7a2e1

        • C:\Users\Admin\Downloads\400gb-CoinOps.Ultimate.PC.Unofficial.inc.Updates.FINAL-UOG.torrent.sme14t2.partial

          Filesize

          213KB

          MD5

          5da21eba9dcbb56ca81c533ee62cf5c9

          SHA1

          acb1bbf3bc7c909eda5d540d0b6be7deceec9b96

          SHA256

          26c6d0fe5d16c06a0e67e0fb37efa7d0e3278ec150fd27e846f551768186bfaa

          SHA512

          5ea1cc67e835120da3df227a49b006f36000138f8c5330cce95e7ca109bf77e10cf1a1afc6e37481ce5318c853b5a48dc80098897315fa372d5e30b9643f6c4e