Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    115s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/06/2023, 15:03

General

  • Target

    https://safe.apps.mil/pickup.php?claimID=3HeSM68UXjBNbFN7&recipCode=RErvHM

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 52 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://safe.apps.mil/pickup.php?claimID=3HeSM68UXjBNbFN7&recipCode=RErvHM
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4496 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2860

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\2nx5ayn\imagestore.dat

    Filesize

    1KB

    MD5

    7dde44f3091c8d83acbfe04e9e57aa9f

    SHA1

    f22dd961cefe7d393daf2c0cc896a41e73cbb977

    SHA256

    d2e3313dbae0b1fec02ca3c6605f2dbcf35cd677303ce15bb3f664906fa5d93c

    SHA512

    dce40169fe284ea4307a1286a9d2adffe3a7770fc6a00bc0af51afb5e0e81d65f38576b45ec992ee3af3cd31b7d623dfe42859d00162b24683b987bc0af21848

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DBSP7ZL8\facebox[1].css

    Filesize

    1KB

    MD5

    c913b73312db39c76aa2ad7a849ed779

    SHA1

    c309904ef448bd9b24fe2c25aff637f964f11b2b

    SHA256

    2a21c988ae7800e11644de2b2ee4d6d98faba98e3693ffcbc663cfd90f9f318c

    SHA512

    6371deffc066889303bb1738f644d069c30ce3c77ba42a7f8d7d772a3aa2aee5cca9c2c2c50933e2efe866d640a4b54942f6035293d8140b4ad59252a50221a6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DBSP7ZL8\favicon[1].ico

    Filesize

    1KB

    MD5

    486373b021971d0a95af04c811799e21

    SHA1

    47216f4da8d00e7df4d5d4c84a019b95a08ec276

    SHA256

    492d59030435c1398699fe177a0d1c859d92cd4e284236974f785ece8988fe21

    SHA512

    e443da9d477b2cc8a765837bb2c065b0370068856bb6d75563f1e6997eb3523e92554e4f7c3748799a836b4455705a1d3683623d4c43f357cea2bdfa8760b5e3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DBSP7ZL8\favicon[1].ico

    Filesize

    1KB

    MD5

    486373b021971d0a95af04c811799e21

    SHA1

    47216f4da8d00e7df4d5d4c84a019b95a08ec276

    SHA256

    492d59030435c1398699fe177a0d1c859d92cd4e284236974f785ece8988fe21

    SHA512

    e443da9d477b2cc8a765837bb2c065b0370068856bb6d75563f1e6997eb3523e92554e4f7c3748799a836b4455705a1d3683623d4c43f357cea2bdfa8760b5e3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DBSP7ZL8\jquery-ui[1].css

    Filesize

    36KB

    MD5

    cbc989726a330f0a62bd2bf5c558d34b

    SHA1

    8559f6fabc9defb4f0201d722f37d2b3615bef2f

    SHA256

    fb3c23420317037756ead571e4d46040e2e48ac5dda8f93fe5bcc16349be16c1

    SHA512

    6ffe7368ad85ebdb81010c0a9ee751b484865f0296b647e2a71c774a0b9c01c97f17e25c269d8e3480e48b19407ca69c8fb9b4e3b3af770b557cc320c396b58b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DBSP7ZL8\main[1].js

    Filesize

    3KB

    MD5

    cd76ac9b42994f1b73787199d7c77673

    SHA1

    d5560e11758030fdc17f676ce4340f66abd1388f

    SHA256

    ff1ab58e9aef946a54b15b728c17ea9d1291d7c5a72c951ae9884d4d7ed9b7d8

    SHA512

    63a87f6d5f2a051ddc41993203e852a12f6d51b3d01d2a43071bd9420b14aa414bf644cc72d68ca267c1016ee42f4d3b9417d7325eed8c78b119a4fcbda0d54a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M199XJOZ\datetime-moment[1].js

    Filesize

    2KB

    MD5

    c64248cf781b5731e3f117f3387b2e97

    SHA1

    827542c56a0af6fa2ead72dfd746be1e61c056a3

    SHA256

    7447c5cbd4d622640108ef72a22d4e0bbcef144e8d5031ea059fb9212336d9fe

    SHA512

    e45222f4f16329f47df9df4222146a77ff5bb8a873d76fe72c4c27a2fd2a0bf68b1b2300d1bffc5f8dfaadef26da03d72c8241d7ebb102e9b080d52c66bd39a3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M199XJOZ\fa-solid.min[1].css

    Filesize

    640B

    MD5

    aced9f868b44a7e24715b55a2e9d4f8b

    SHA1

    59158504870ac81d7a0e041b95b12b9d97babf07

    SHA256

    ff501252a95b1fb13e506c3b42dd0e5277d3f6d1112ca0cbabdee96d485cd802

    SHA512

    a6f9995677f1acd440e1e7a8c48398d0f51d08ae7ca409990bd13ff969060fd3e241d21adeb3a4c9df29e9793f49fa9427bd36d0c75e3583693943d2b2030c82

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M199XJOZ\facebox[1].js

    Filesize

    9KB

    MD5

    b519be4d474a5bfaed4013a1cc1152c9

    SHA1

    0debb0553e72a676a8d3199bb23a4dc6118f8250

    SHA256

    c639576b62bf499ca4675a0f7315e4d1bf6a235e9e4871e7ad15a8d99ae8d912

    SHA512

    4b92bc7eee184f95961ee2dd82b293c2d112277d001cb372275287e56ed2318bda05707dfe1b4f345fff198c2c4142030aaf28e9b1f442945481b2a16b3976c5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\M199XJOZ\jquery-ui.min[1].js

    Filesize

    249KB

    MD5

    faddc3e791b767bd072ea5306a9aab14

    SHA1

    c300cde8d9edb8a2495b0ab9f9caa3ff87e0d3a8

    SHA256

    a5dd2d44b88e2e7073a8e9e83320ce9b8597d7ce4ef63058f5a00b63b4200dd4

    SHA512

    ebbc8cd2d54935bdbedc62ddf673dba730d840346ad7d14fc5d4cbbbe5a3a38723c424a38c97ba71817755ed4d3cb508c84f1647bdf6575adc050e2626632283

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QM3UZKSX\fa-solid-900[1].eot

    Filesize

    95KB

    MD5

    89b584356dc1ab35af50c4417f6af1cb

    SHA1

    d775b9bf2ea3da471494a684baa56e312e906884

    SHA256

    cd5c1c0614b15e1b4defd67112fab23a5d0d2edfddca7c239ecfc24d5cded2ea

    SHA512

    257a77fd9e8f5866970b65cade3f6012dcfd68b4947e709b67c08750a0612ce75711fb89a66cf2144333c8773ec18b6fb11b8e2604a7467bc9beb9d5ac3a867e

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QM3UZKSX\fontawesome.min[1].css

    Filesize

    31KB

    MD5

    bd41d087767ce28e262e7f03ebd734e1

    SHA1

    2f8b935331ea2df9dbd9c5c7c359d56299baf128

    SHA256

    7f17a95025bdd30b9e0a940e06da1328f3ddeff60d299c6bdfa9ad0de4e717d7

    SHA512

    3563fc089c772bf4839c06f4a85aac443db28c09b97cf199b938c5de7bf27bc3a0bb12c132a030e560a23f573c507949e088e82fd9ec20d9117359eca397b245

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QM3UZKSX\local[1].css

    Filesize

    5KB

    MD5

    0201d08a1e3dc537ca7d9703bfe16a82

    SHA1

    160a24145d19d2477c58804a27afa096ed927ebd

    SHA256

    4a9a0384a33fc1320468f4e4a6b453b39a498f162aa9734ca96304e7a4986c86

    SHA512

    ee304a30abbdf52e378aeaa34f75a10dfc74dbcf0fc13fa0008bfccdb081ea5b9f01d4c640b58463bb163c6862afb2cc920edd9bb3ddac61d63a09ad176b97e0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QM3UZKSX\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\QM3UZKSX\swish2[1].css

    Filesize

    16KB

    MD5

    c872f014aa5985dbe1967cc89d7c9ed0

    SHA1

    9ab1394b7079919006e01d714b1defb3d50dd1c4

    SHA256

    ec798298ec018f9bc7e90bef1abc5cb7090459c6ee6d595273bf18c0017e8cfc

    SHA512

    0d51fb1f826b7b8e187703d197e71f317feb2efa69294de6ccea6deb274a2defc805f4821ee45b48d1bffb4af85cfbc2d9c4df0e518ccad64a116495e60d09d9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\jquery.dataTables.min[1].css

    Filesize

    23KB

    MD5

    c9064e4182c7d44f4fa6bc9333af34f0

    SHA1

    876ceee89833d27ca217da550aad301c54ef6e8f

    SHA256

    78c62f0b0bc7b1564c112872e75db7215ec7f6f7a6fd3b046b4fd89d2e34d331

    SHA512

    2d5c76881f5d0ead836f0de95ea5d949194e6511e1334f107035a342831f32b8904030fb1e736c178553d1e4cdc6604275846ee8f19d9452ce63d1a6297cf14f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\jquery.dataTables.min[1].js

    Filesize

    107KB

    MD5

    f52b9ce6e273a68b735cb592ecf687ac

    SHA1

    09e0fdf6a909a789f1a2ca1529aa819089172a5f

    SHA256

    17d56c14300caee18ed4e41536923c8839d09371c47ec2eb19846b4ec2f6c035

    SHA512

    ca9dcbbb2352fa5295129f19956e72f8d1253b8d66a708ab01cb1c6ed177205aed7728c38404c24b80da0cb9d3403f07013b44b80788d08c0449053f9ccce94b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\jquery.min[1].js

    Filesize

    87KB

    MD5

    0732e3eabbf8aa7ce7f69eedbd07dfdd

    SHA1

    4cd5ddc413b3024d7b56331c0d0d0b2bd933f27f

    SHA256

    ce9d07500ad91ec2b524c270764ec4c9a33e78320d8d374ec400ede488f6251b

    SHA512

    41d24c426abcf913be59917591d906318a547661280036b098a2b1b948bcf9ff14f268b140db10956730d64a857a61b81034d888ed7f857419dee6b8d327447c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\moment.min[1].js

    Filesize

    56KB

    MD5

    4df0206be6bf069dfc473cdb34d7324c

    SHA1

    5aa04a8c63f18d11015d4eb662e0d8ec245240fc

    SHA256

    f245805d2228b6acaf776761f150505da40ac4e2998965ddcae7ac8e35366c0e

    SHA512

    1f761beaec6f4692a83ae3ca54f79a909baa87410d632ee621f8324a121fb3c0dd9da8356c16baf855ab939f0cab755c5aabe138c7cc6b6eff13c3030bdd6099

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\VPN0KP4V\roboto[1].css

    Filesize

    4KB

    MD5

    ce15b14a1e80c9ab705472b1e570ca26

    SHA1

    2e6b916d16521b6e62bd48883c3dcee260ddb288

    SHA256

    f4f71588e68fd5bd6a144252c24fc71e9da3c22fd45a635ca90f9e5541f9057c

    SHA512

    745ab2b993cb594853d1063e852f69cce6c416c8d0306fd475db175737250806e9434b8d974ac2ad60b05fc50cd93a859b8d8cd1329b814ffaaf240febbe13cc