Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    38s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2023, 16:33

General

  • Target

    https://trk.mmail.lst.fin.gov.on.ca/trk/click?ref=zr9uf3m5h_3-39e02uj-0-964dx3f26dx0kuhk8TDye7&

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 22 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://trk.mmail.lst.fin.gov.on.ca/trk/click?ref=zr9uf3m5h_3-39e02uj-0-964dx3f26dx0kuhk8TDye7&
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1500 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\q7s3h6i\imagestore.dat

    Filesize

    15KB

    MD5

    c015637b36f5f7b5df35db6713dfbfdc

    SHA1

    4f59811921d10e3dbc955a722435c8346e6acba2

    SHA256

    ab3d07e66b7d849d42f863463820168ab0f23e35ff3630d1da2d4a8832e5aad1

    SHA512

    1d2ada777dd0f9dac4133645e34477282e8d8563f812960d544b663a455acf57a4e11890ffee3ffcd79d1f7099d80214a77a94252118a8743cffbb5f06dd553b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6GB5GU8\favicon[1].ico

    Filesize

    15KB

    MD5

    09bd5b5426a668d935e28a5e7b667ac9

    SHA1

    1555b05e7d4be697f795f148d157872361779375

    SHA256

    aeb3b21855f07b7e9e2632483b0a24488a8f294a152e2d64b96c8a4145a55b51

    SHA512

    b57b5eca260f7b5eec154969faacc5224d5abbc922b1f033f0adb667ae77544e0002659ba010216d52c634a1ed2b490c5d1e4a2bf3a92d60ff030f2fb276f5b8