Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    40s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2023, 20:49

General

  • Target

    https://go.gkrtmc.com/aff_f?h=q4cCem&aff_sub5=other

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 25 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://go.gkrtmc.com/aff_f?h=q4cCem&aff_sub5=other
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3788
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3788 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1420

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ffzgd5p\imagestore.dat

    Filesize

    1009B

    MD5

    2250b41666a7c4f20cb2aee13b8bde00

    SHA1

    59ec71a49db506f563b8ab747f229259f3abe8f5

    SHA256

    1904bc703a6c3c89b94709987e69fbea0607d6443a8d8a3899075922015e6f3d

    SHA512

    44bd421f9fdb2210b750f910cb31940f8d107a0dd2ec393be7d7516aeed9505e8e6f612d909aa1c57cf9b5527ab392b6609169eb82c4786983002507fa18eaef

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7QVM26BR\favicon-32x32[1].png

    Filesize

    887B

    MD5

    b5e55b31b11919487d51c5461fd2630d

    SHA1

    7e935cabd3722b7be980d8e5111a8b216a510ed9

    SHA256

    5b7f935eebc843a6a71ede1abc9f441878549b1c3a10dd179aa6dc8199593718

    SHA512

    b2523e01c1f6fd62c36fdcf9d21690e20541f71657b25054a47af138a15f89b2ef9c589650bd550f2b5190e85967525bae5e9f803ae0677134f470c47e476567