Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    512s
  • max time network
    515s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/06/2023, 23:31

General

  • Target

    Incoming Document from Strategycorps.eml

  • Size

    2.4MB

  • MD5

    f144f0861c5ca6f33f505ddff61fdbd9

  • SHA1

    4def2c440c251b3cf7c3d396d073fc2760f18b35

  • SHA256

    d7c0ac6f4c8b0a15d12958255fa1abb8f3e494d6a83918eedeb660e38ef00687

  • SHA512

    29394bef370bcad9f87547201dcb258d381c433044d17f393e28c13a854396b1119a3e137bfbb30a2573e338f4e02bb19bfeb3971bbac720552881fa115650d2

  • SSDEEP

    49152:M4md3HZ3rAcgQLVHUGgVj5Z0UjX5bODib4:o

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 56 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Incoming Document from Strategycorps.eml"
    1⤵
    • Modifies registry class
    • NTFS ADS
    PID:1636
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:4228

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

    Filesize

    28KB

    MD5

    9198ee0f02663c4622167704d5f23004

    SHA1

    72d06c690640da6a84fd8842158d13fa60f5b7b8

    SHA256

    f749b59f55b2fd6f435cdbbfaaae51962ecc37488d8468c3f1e4cdb76ffa001c

    SHA512

    1764dabe5feb97b601f16e082c51d73fee19cdf586a050b812f22aedcbb0e6751d27827bb48283cdd83eab93fdea76b0f25f7397ceb17b5bd3fbb7b52fc1b3f0