Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/06/2023, 16:55

General

  • Target

    https://www.mesharepoint.com/nam/903095a7-4869-40ff-92c0-a6f7954bd969/a6eacff3-6217-4608-8ac0-ff8a323a29e3/475ce11f-75dd-4423-b112-cd8a4852c1f3/landing?id=cmZwMWZvL2FoY2VpQWcvbFQrRm1OZmE0ZlRIVDlEUW5wMlJXeXRUT0Y4dmtyNWhmTTg0aWtzVllLVDZTTWx0RFZjeHBVMllENCtramtpcFZzdFlyL2UzUGdWb25IUU9WcXd2bFVQK1Rpa1hBT1hqTjVCYU5GOEZ4VlZZRGpNb2ZVcVp0aHVBRExUcXYyRllsVC9PWlhtMk1PK0hoNEJ3SU9OViszcVNuQWJZWGdqUUd1cis0alp2MVIzRkdNeXRidGFzc1dmQnI3RnE4OCtiVm12aDJSbW82UkwyMDI5VmdjRlF6dnYxSXg0RzVIbTk4TmVLODVpOG5XS3B0UXk4T2c4VHhqejdyYm5TYWJYSWw3amFLNlZibitLNkZrd3ZIVmZTM3ZPaWJCdVh3OW5hWEVaSWRzajFJTk1jKzAxRmFDMUt0WC9uTExKN3NWaE9zNGFkYThXZ3dFY1MvRitFSnpZei95bWhOUVFYL3FZR1IxSk9DZERLT01IdWptN3Rz

Malware Config

Signatures

  • Detected microsoft outlook phishing page
  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.mesharepoint.com/nam/903095a7-4869-40ff-92c0-a6f7954bd969/a6eacff3-6217-4608-8ac0-ff8a323a29e3/475ce11f-75dd-4423-b112-cd8a4852c1f3/landing?id=cmZwMWZvL2FoY2VpQWcvbFQrRm1OZmE0ZlRIVDlEUW5wMlJXeXRUT0Y4dmtyNWhmTTg0aWtzVllLVDZTTWx0RFZjeHBVMllENCtramtpcFZzdFlyL2UzUGdWb25IUU9WcXd2bFVQK1Rpa1hBT1hqTjVCYU5GOEZ4VlZZRGpNb2ZVcVp0aHVBRExUcXYyRllsVC9PWlhtMk1PK0hoNEJ3SU9OViszcVNuQWJZWGdqUUd1cis0alp2MVIzRkdNeXRidGFzc1dmQnI3RnE4OCtiVm12aDJSbW82UkwyMDI5VmdjRlF6dnYxSXg0RzVIbTk4TmVLODVpOG5XS3B0UXk4T2c4VHhqejdyYm5TYWJYSWw3amFLNlZibitLNkZrd3ZIVmZTM3ZPaWJCdVh3OW5hWEVaSWRzajFJTk1jKzAxRmFDMUt0WC9uTExKN3NWaE9zNGFkYThXZ3dFY1MvRitFSnpZei95bWhOUVFYL3FZR1IxSk9DZERLT01IdWptN3Rz
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4196
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4196 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    6776a455f2fbdb44133158e334a7de52

    SHA1

    1541ec3ec2ca8ca3a5b20bb69e2679e039729335

    SHA256

    c6dfc43ed1702124201722fb4f06d6d394c9e6ac34f371a6d186e409fa7b4e07

    SHA512

    fdcad566b8d11ec78e395d0593c3525070e420191ee332e0ab348c3f584a01c9bd10ea8c9bf727cb0a8e2e7b4acae51e28e024bae72d66b50a9e1cce1b1dfb45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    47740eecefaa7e1ab5fe494add8e8676

    SHA1

    1f313efcddc83dbca102ecffed04f5a52e23aed0

    SHA256

    e5a4c9bb2b9cfd6d1c7110c0b910c4a6db349a5c346212b58ad6a5b215189fdc

    SHA512

    123d9619acd6b24aeaaec79c608bfe3bbd4bf7ad58ec316cb5b80ef05e62f64cea03d6936509354f3b0234c477ee87fdaac2ab43178e3a6351b3ba1afcd25701

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U4IULL1L\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee