Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    41s
  • max time network
    46s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2023, 22:05

General

  • Target

    http://kms.msguides.com

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://kms.msguides.com
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4764 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4508

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\5qy8zhw\imagestore.dat

    Filesize

    1KB

    MD5

    1ca370c6499019614d25b4e6b5c2280f

    SHA1

    47f56127316dfca0cd9f0e16afdba1e0badff12d

    SHA256

    a546a821546f09440b338c926c3bd8ca6936276a01328c174bedf777bdb2bc4c

    SHA512

    0d880f0fc9cf97fa00427e2057a13b085ce2d7e32de8b68c093de0bf020b6ec95836198f6dbd1266c86e7b60714409e74fa1b53a3a935f8b0c578d9a5f47040b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2WIZIJ09\favicon[1].ico

    Filesize

    1KB

    MD5

    9ec64893ef2ee0b935fb9674331355b9

    SHA1

    6deb017a0e4fa4512f55ccaa0b2748bb8b26a68a

    SHA256

    2ef9bf34ed980b19961965ede344433be025ee383721d90921a17350080d1629

    SHA512

    94152c8c8916219a9e37374f5c734fbcd5f9b2d2b3571df408461c5d7e0d1469503d14bcc4958b128ebc19f8acf7cfb4225b7b1ccab7aa64e51456a036eacb13

  • C:\Users\Admin\AppData\Local\Temp\~DF5A3C5707AEA8B545.TMP

    Filesize

    16KB

    MD5

    744b8a2f9a19da2f0072e1ababf91728

    SHA1

    58bea4e317e26921ffcc22c26c522d356954f3f9

    SHA256

    90515f707d2948c33f7a3aaf01418e612760a07392c4b306668268f9a994cf9d

    SHA512

    91bbd5baf40389559c869ff7cfc24414dd6bbed9258cf3c8af00d409ed797f17b612b0519c71bf0c41c3abba85b520e534edb5870cc1a53a94c34319b6dd2898