Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    206s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/07/2023, 09:12

General

  • Target

    https://co.macrollantas.com/wp-content/plugins/wp-file-upload/nc/index.html#[email protected]

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 33 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://co.macrollantas.com/wp-content/plugins/wp-file-upload/nc/index.html#[email protected]
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:924
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:924 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:5020

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ajlopfn\imagestore.dat

    Filesize

    4KB

    MD5

    00769c52889cac0f320d2a20f4fd0f1d

    SHA1

    6c17d679bdce49246041a972181acc1ed2499cfc

    SHA256

    64c67d8618ce62a1a6bdf61a533dcf88b25cfb8c5e42ec4bd98a635144500d23

    SHA512

    01f0d73f05eb124c09fb29d2b8554f580029f214386d0d5877e0a062202a8cc2ac11ddc2915b580f5e5de31ce717be2fbaafdd5e7f9d4859b83aad1818f0d05c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7T5CRMPS\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\92MHWCYC\bootstrap.bundle.min[1].js

    Filesize

    76KB

    MD5

    0aa8d64e726c4a57adb5c88f9115996b

    SHA1

    901169527507ff9e662cf64d8e361f359308970d

    SHA256

    7e1f1503df765cca5e099891b94e318a2ef95081ba2af1eb6d417cc884bfdbfe

    SHA512

    ef6583f7684bb3b4f91405e7def90d65f9561baa609540c3a66f3b4de4267d283c2a7af298bd86df447b6ace05993c2182ef47ede4b30c25f79a38ad49e70a9f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\92MHWCYC\bootstrap.min[1].css

    Filesize

    152KB

    MD5

    abe91756d18b7cd60871a2f47c1e8192

    SHA1

    7c1c9e0573e5cea8bad3733be2fc63aa8c68ea8d

    SHA256

    7633b7c0c97d19e682feee8afa2738523fcb2a14544a550572caeecd2eefe66b

    SHA512

    bac54101debafcda5535f0607b5f60c2cda3e896629e771ad76ac07b697e77e4242d4f5f886d363b55fc43a85ea48a6bfc460a66f2b1fc8f56b27ba326e3a604

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C7IPBQYV\tccl.min[1].js

    Filesize

    44KB

    MD5

    5c3e20ad749ddb088afc84b1b7ff009e

    SHA1

    c10abbdda3109549150f58c07f304c1d7f8a8d47

    SHA256

    d10c120206d25caa3deafc45a0ed90f2a6ce5290402c4502a68d95bcaeaa898b

    SHA512

    963781aa84e6cd39f0a7821cedd022f4591658467e4b68010c5e404fb6d849c4ee44b8024a70024c7844c0afa8902b857d2ed0e2494e3a4550bf5c73122e8bc6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RM50SD1U\favicon[2].ico

    Filesize

    4KB

    MD5

    c63dfd3f8ed419101171759553b32c62

    SHA1

    d3b9b2553d6f248ecfa79fbc9497078e964a7872

    SHA256

    95a0599fa09ea6a4fe2cf906e9dd73193073ea13f59a07f0db01791dd50332c5

    SHA512

    f746b8ae19b5e29b82bb7e4824d637044c1ea97214dac58d3ef349d5b33ccd986620eadb08bc7009dd65f61aeb33f777a990a911e07e951217b0f076527033f1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RM50SD1U\jquery-3.1.1.min[1].js

    Filesize

    84KB

    MD5

    e071abda8fe61194711cfc2ab99fe104

    SHA1

    f647a6d37dc4ca055ced3cf64bbc1f490070acba

    SHA256

    85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

    SHA512

    53a2b560b20551672fbb0e6e72632d4fd1c7e2dd2ecf7337ebaaab179cb8be7c87e9d803ce7765706bc7fcbcf993c34587cd1237de5a279aea19911d69067b65