Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/06/2023, 17:19

General

  • Target

    sample.html

  • Size

    313KB

  • MD5

    edb327fcd25cb09099572b21d88ee820

  • SHA1

    0701a1b212be619a33bb74f1eee142a159993dd9

  • SHA256

    558f19a451f468569481439c2abb7249a6e93626e07cb32be0ca724768b09bda

  • SHA512

    d1376a524ed33f8d684c3f70a11ef48bf45e02bddc1378bacbfd622ec2705f200326a2beb3c44f9452a5403d526ae60f3000cc11b6517b8e9cf24f3557d9990c

  • SSDEEP

    3072:+gArwlUi7W9Zo0N9qV30EJ292Rs09R9aXH7ttyrpZkJWZZ87ptt6gTGZrhTHGdrd:+gXE9JN9Ne292i09R97G/9h

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3872
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3872 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5024
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x304 0x4a0
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:4992

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    6a696bab5dbda1f9e3dead87bbdfda15

    SHA1

    efa2517cc9c306a85acce2f45a1b1a4763bc0ad9

    SHA256

    27afd05f059c8af3bf76e14ec650eee55d2d4ef298669efd65ca1acaeb66ac2c

    SHA512

    7bed5bb59abb768ebbf6d597e8b3b14be75cb23b08bd64945bfc80fcb0b9ce155d961c8b67512943ad30895be6201e669c1c0f8481373f2a95a744170e3a9050

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    cdc291ddd8e8a81c39abc5c97c62fb5b

    SHA1

    4b6e3e90a54df9100d66580b658189b0e844405e

    SHA256

    73f522a5e32fb1fcd94db5c7e578a4f236fce7626bebb0b5758269b45595ab17

    SHA512

    594d71241c293b56a122cd1865522bb0e82fafd54583012bcd686eac7b05af7bcd1ec11c52b77d80ac0e3d0bd38743d825207be6ce651bc82607bab143f1c3cd

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H82VOZS\fontawesome.min[1].css

    Filesize

    56KB

    MD5

    eeb705d0bdccfd645d3bbd46dd1fbab3

    SHA1

    066def290f42ed8c00860e573cc880bd46e9ced4

    SHA256

    d01a2ba2805c78957e15a2958135de0f3cb88e95159dd0f6c0a032bd76b1b0e9

    SHA512

    39d11741808e95d8ea504b2e30ab19463f771eddb741196121bf04fd7d2c6f066199ef1e530ea0f2aec077118929a91c05bbfbfbf3d7d067366ed7fb46ef1c64

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7H82VOZS\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee