Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/07/2023, 18:35

230706-w8fqlsdg43 7

06/07/2023, 18:32

230706-w6mfdadg35 7

06/07/2023, 18:27

230706-w34kgsdg32 7

05/07/2023, 09:21

230705-lbqjfabd66 7

05/07/2023, 08:59

230705-kxxdfach7v 7

05/07/2023, 08:41

230705-klwmrscg9y 7

05/07/2023, 07:15

230705-h3aqhscf6z 7

05/07/2023, 07:13

230705-h2e9lsba95 7

05/07/2023, 06:50

230705-hl6fvscf2t 7

Analysis

  • max time kernel
    118s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    05/07/2023, 06:50

General

  • Target

    credits.html

  • Size

    3KB

  • MD5

    64ecc35282113e2de83eb80221a9c379

  • SHA1

    236417851a07204647043cbec1570bd2c86d1b3f

  • SHA256

    98573f2746aafd2c7dd8313b12021da2fc47d7b0111a1a0b79eab18c4730fae9

  • SHA512

    39cbeae68f7ce7d22510c22c6542168969ed789c6ab66d9d41c3d443fe0815c84571b833eff7e4f5139a61b7776114ec7194c1d1d87b2c7058ad5b51381212d1

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\credits.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1320 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1744

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f39cfcc6658efcf66ed386d3326bd14e

    SHA1

    0493494849717a7dcf5f89840ff1a44eea65fe5e

    SHA256

    fdc6a52f59149cff0941c5098903289e63725fcd4a137ae3603978229d41246f

    SHA512

    7ea3845679b6eb2c88df743dc811199928fd4d9d9fdb96148304491c0467db5f51ee61c3aa6afbf4aff312a11abc3662f0f8189985ecc4155c246e6864bc72d8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e3bac9e2ce5a2c4d0529720d55321602

    SHA1

    0940226bf6fb8f13a313e5458d238f61cd06f4dc

    SHA256

    ffd928111b62d80760a81b61eb9c050f3c0e91cbd614635db93292a2d46469f0

    SHA512

    c88d43cfabc812286b93db3e7323c19003e18ab2812896c4c1c2ec40523fc4f28ddb77adf0a05a62aaf3dcb7fbc8a2a61b603b261f11abecc2e2e798f246b998

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d82d596d663aa557c6a529e0c92835cc

    SHA1

    b4102d3a49a8a9b9cb60f26b764e053cccb4eeb0

    SHA256

    94ea7edf9ae8070c63afe4039a227562a258b3c8fb019f2d775602885c926fdc

    SHA512

    a0cb1a579ea1a161971de53877f51a73813eec922be51a72adb4bf6ec21e0474919bfe29fdb51c6e374b36b59a35355889872b85e68c04f8dea074bd5706d7b1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9019002da9184d7118159f5261e22c53

    SHA1

    84431c53fff5b9365958517d648e31bb2391dcd1

    SHA256

    da5c80aebafd9446fc16952330b268e14272d306deddef692ce05eec5f697026

    SHA512

    ddbc3687bbd0d8a75716c211499353699421f731b6aefe6a6cd2fd5abe57b4816ce91b90bb8b413fdd2dde6584f2e2fcaed7971cce0e59074a729e5217d533ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0cfb96fc95c3a7c2e2682c9dddcff89d

    SHA1

    488428e9f548321dbb6c6f7419010901d166ba1f

    SHA256

    83af202e37bc87e1b8ee52bdf975ac9dace6b2538bc93054df0e74d392c78c10

    SHA512

    454c6dc407b3d1a33d8217cbc1dfbfea0457a5c63ee5140be87409a4c5d97125404b058d77c962ccefaa6e010ecf91c74812dad6c1a22d42a2868a3c6873e6df

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5c68e9b129a1e1ec709459eaaa5405fb

    SHA1

    b4a1f0e516a3df855a39eb368c621677592a817e

    SHA256

    4942f1b067b8527bc365f24233e822fcd3815f1b85e41eaaae6b92350452a94d

    SHA512

    a7836b7856dac15c8b46b620bd424d1a2d937d89b8f573858f866dcdadabb18a787a4960ceac4c89390a814f99d1c67b71f99f4ac37c2067e4e866b79ba06303

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bdcf2485c1c41ffcfdd4303ced0ec9c4

    SHA1

    27f3539eaa2eb1d459afb27a05653884d0d9acd1

    SHA256

    4ac9513a75d5ae9c4ef1b593ac5575b95dd69281b8bfa715bec59dca8bfc49fa

    SHA512

    bd08ddf3c2e530d99d0d5a0562c3f06074dfbfb5f4950265017cd4c9842badb7bc02bd18384dd5a2aa225e8a208cf3f787976682c4771d27e08360a65a4332e9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\HZMQ0AZF\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab47EC.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar48DA.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PEGGEL05.txt

    Filesize

    600B

    MD5

    54f456ae6ef857481e1fbaef08197291

    SHA1

    58cf516fbd3d4bd94c2da86f61838d898a23ef34

    SHA256

    504549750f9a61b52713c99ade896d3b8b7683597595fa45f04572d05f72adc6

    SHA512

    4641f0a44497ca5e1ab24567fd4de2c4cdd2ca5e77b61b0fed08930053e9e303fab07d7d9416ba04882e0c996c465d5c9a36103472e2e9e7575f9f461035ac44