Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/07/2023, 18:35

230706-w8fqlsdg43 7

06/07/2023, 18:32

230706-w6mfdadg35 7

06/07/2023, 18:27

230706-w34kgsdg32 7

05/07/2023, 09:21

230705-lbqjfabd66 7

05/07/2023, 08:59

230705-kxxdfach7v 7

05/07/2023, 08:41

230705-klwmrscg9y 7

05/07/2023, 07:15

230705-h3aqhscf6z 7

05/07/2023, 07:13

230705-h2e9lsba95 7

05/07/2023, 06:50

230705-hl6fvscf2t 7

Analysis

  • max time kernel
    100s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2023, 18:27

General

  • Target

    YOWA.html

  • Size

    648B

  • MD5

    00afda385226fc12c0ff63f0fc065278

  • SHA1

    b40143e306c45e09b99f3431ffdb02c0d70932c5

  • SHA256

    e36c965275a591eb12b4eb64bf9d69e59b73526d86fb6bb1ffc2ddec12523d33

  • SHA512

    2ec7d3fa444986a48a7f8ab3707b7e45518bf6408709189a2c2a1fa420e8919612b1136deb2d1dacd7bedf1cf6e3746fff985935aeb92de50808566bb8f6c91b

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\YOWA.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1528 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2324

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    86f82ef9b85863ed011cafa0756df3ea

    SHA1

    fc0164bc5e6b396fda66de1580cbf0cbddf4c4f2

    SHA256

    41e747f62442f095a8ee84aa6d472837aca45ee6a0379e61f8bed38e731cd275

    SHA512

    d60853cc6b28f9ac134cae800bc5d678564e0b91b9252940023a757aab53709b5cc10debf978c1ada1fd23a96786dea4861bfaa83c026cb3a3ff6d68a1d341f0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ed2573e93f20233d1237bf6a65149f90

    SHA1

    3dcaca93867e59a47d5966419afcf87226120dd6

    SHA256

    a27f498b0936f32d941c8f53a6b1982349c8cb5f72e57a95fe0303b0e38cbd1f

    SHA512

    adfe9b535f56969c5e433a05bbb23a152a7e8ad1e92401874afe199939782590ff64675450aae9a572b1ad115832fa205d0a3674b2ad51168808822d7e8c892c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    84515b780e5402eedc95b195bb385be4

    SHA1

    dc83970086e64f216c3a9ae87ffc8b279857ee03

    SHA256

    ed467b57cfaacbd2e3a1ea9f3ae9896a3d6e050955329f2cec02a8334e5dca1d

    SHA512

    0a4888700c8ffdeabfc525f81fc4cdbdfcea553dd904f880dde89e46424d8e20f5f1e1302d60829e2cfb0ef02d9bac4e4e0f6b7c33b31c5e116fb98c370def67

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3fa1ed0792af1d464c8e8fe2bbbf8113

    SHA1

    82ba2f30ab40723ae4fefd92b6905c699779213b

    SHA256

    2bc7946f73935803d328546a74a870d93604bfb6c7e5a5f95f042119484c755a

    SHA512

    955b6f59786f2f8e23492cc8c13283da1c7b502db899a742244519908ca2bd407b91dca19f258d6c3e366c759a600e80db618bb9e33aa95657b94f3dc41c18d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5a7ff6f2575181b858c67136eff248e3

    SHA1

    325d5a387fb5a82d15ae8ee590ec45d84b164e99

    SHA256

    e75ed775d6cd7692eca4f87d813abd090b246cdbea6f392e99c8738cd04f98d7

    SHA512

    f8a5162e570959a975525eb8ab74dae9e4e55b56c5b65dd9abe88a67c459d18b3763a17f896949fc3873badd50f255ae1dcab70b4da3c985ea77eb87f935e317

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b182752cde86aa3b790c462df708a98b

    SHA1

    fa589bb2852231e55562cfa553216a354ad7d348

    SHA256

    0b824e3667cfbcc13dae032c9fad12fc5771ff45acda0777ececcd395a72510b

    SHA512

    7ec94ad27f566a9fec026ff951c23f6daf74f91df057142ae8d16dedce9cdd6e6f75425b1a149da6c39449fbebd2d8ced37a76ab26d5572934f646e6207028db

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    40e6b7beb4e8f5584b1b27f131befa42

    SHA1

    31821dd369ece55039f0495eda32b13f14d5f427

    SHA256

    34b2860d580b5cd78d07f38cc6b55ba42bb2bd7dec1d77b60a112aa7e7376f9e

    SHA512

    75a08ca884594a1c3ef8a7b8005b65d7a0a0019f84701134ce4e6eef23868931df5ae3ec4a385c6c75d1af58c9a187a498c17e2b786a3c1f288adc006981a74b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a64dc5239b8eb6840bfc6094b1ad51d6

    SHA1

    911e543196f93b98863aaa4ddde840d748c3c173

    SHA256

    2d777a3e9e7b9ac197bf329a75488f8067c533b736d637e4d48e24b0957c5465

    SHA512

    69fa8a017380decaa39718900f22d2b7531ce557bd522dfcab7586717555a3cbd989350da0cbd1619ba78db0e801a843771cb65e1947dbb406dd2d1186bd656d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2cd476bcd78dd5d69ded74da60efa1a0

    SHA1

    c89333effe6d6e5761c59733bf4aedee4c43f346

    SHA256

    0fca00cbfa6b2d73b04655ed651082bdfe6ff69488a84a384e9abd8c3dec1b6d

    SHA512

    df0d5d63334e3c9bf3e0952384d4d949c119353d9828c349060170ac9a7c90271d98da72d96e84105e98b0390e199d899f215338b83cdebfd242710008cb0601

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JHFV4GXP\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab9742.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar9802.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\S7SJD72P.txt

    Filesize

    606B

    MD5

    e0e90e68d29d95f4ff89b338ff253544

    SHA1

    8f25e78456378d2e562fbd5fb020979e33b42b0a

    SHA256

    f94b1c7cb897b03aa1a33d98ac52251ab0a1864e4eba4c147ecfdf946d8447be

    SHA512

    e7806ce5c450b5f450925469175d0ce3a40996f77fa0d5ec357500b53d51a1b1542689b49e7beb976b4999d94c96027a14834a526592a083043031416ea722d3