Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/06/2023, 19:46

230609-yhgakadc24 1

09/06/2023, 19:44

230609-yfw81aea4s 1

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/06/2023, 19:44

General

  • Target

    http://texascrabcompany.com

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 49 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://texascrabcompany.com
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2492 CREDAT:82945 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2600

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

    Filesize

    717B

    MD5

    60fe01df86be2e5331b0cdbe86165686

    SHA1

    2a79f9713c3f192862ff80508062e64e8e0b29bd

    SHA256

    c08ccbc876cd5a7cdfa9670f9637da57f6a1282198a9bc71fc7d7247a6e5b7a8

    SHA512

    ef9f9a4dedcbfe339f4f3d07fb614645596c6f2b15608bdccdad492578b735f7cb075bdaa07178c764582ee345857ec4665f90342694e6a60786bb3d9b3a3d23

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\5224125D27EF794917455960AE5FD620

    Filesize

    503B

    MD5

    602c1c7182b039564bffa4598b1e6498

    SHA1

    21d9b55283e407483eadb32e74b448178e415130

    SHA256

    99d54344ee8329bbeab4c5ed879819552e43031b9913b96210c3da9a8db77fa1

    SHA512

    6ead74962a25a38ef2503f49d807d337be85de3aa94858e42042151f1cda0966bb79e3902e01e98b7df8e978feb76d33fe4768f591656315dc5652d0fc758fe3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    6a696bab5dbda1f9e3dead87bbdfda15

    SHA1

    efa2517cc9c306a85acce2f45a1b1a4763bc0ad9

    SHA256

    27afd05f059c8af3bf76e14ec650eee55d2d4ef298669efd65ca1acaeb66ac2c

    SHA512

    7bed5bb59abb768ebbf6d597e8b3b14be75cb23b08bd64945bfc80fcb0b9ce155d961c8b67512943ad30895be6201e669c1c0f8481373f2a95a744170e3a9050

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

    Filesize

    192B

    MD5

    03767e4feb2ef8b91060ee234c710842

    SHA1

    7f7c5085963061e4c0d64125a0acff8c4615dd21

    SHA256

    0a268e07860f758b496d22696a86e46424c7859f79c16786e50fcf27750930cd

    SHA512

    59f491cfd616eef57622271eb04827f2c70d9fc6e940fadb7865e33abf2d12be3e894941cf62c2c78b1b954797e98ad51ce5d8a0195680a754c7bafc421d6200

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\5224125D27EF794917455960AE5FD620

    Filesize

    548B

    MD5

    de9a168d180dec18312b988d0c734948

    SHA1

    8ebcdae5d784a43981bf6dedd7bdede09ea6ffef

    SHA256

    70823402b6fddfc0960e23343923c771026c5fdeb851ec232c4cec8a7bba6c95

    SHA512

    99ba761bf6b80dc1cde7dedaf43660a833ece34f43c185166d5a592bdf939093d121a72ede4e8d053d61c7d6eb11b3f33351ef9baaedcbe21cdd2314d7173fc7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    dbf62f82030085143313dfc67891276f

    SHA1

    ca348db6fae664a1baac6c077d707d0aaba202e1

    SHA256

    c710004576feedfdeffce00b814fcd389b060b741764d0dcce9eddf0bbd8be4c

    SHA512

    dd53d68e880bd98a605a89e774e6b33e24e78213a010ea5f9b0804267f0dd30d117f01aa985a60fb23685a21aed3405e65d7e8fc562259f915247b703319b706

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\TTLFUYWG\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\G7K6398U.cookie

    Filesize

    609B

    MD5

    039541bb40b0f25a30f9ec6c4e093159

    SHA1

    40a549393c38805626a78e782629281e75f9aa2a

    SHA256

    81733931798ce3637d63544cc0e35e5397c3f92adeb2ac038ea2ac5b3c1b8d2c

    SHA512

    7c735046d788229ad2db9100285a8b799aeade91de7fb167262d549d98d2249dc8e97e02852c972d9b92a356bd7107f792e83f41523fefd8168c0f605fd50a98