Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

4

Static

static

1

URLScan

urlscan

1

https://support.maxo...

windows10-1703-x64

4

Analysis

  • max time kernel
    263s
  • max time network
    256s
  • platform
    windows10-1703_x64
  • resource
    win10-20230831-en
  • resource tags

    arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/09/2023, 16:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://support.maxon.net/attachments/token/o7sJsArAayJD2WWHW67k3YiVh/?name=Hogarth+AMER-+Temp.zip

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 5 IoCs
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 14 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\LaunchWinApp.exe
    "C:\Windows\system32\LaunchWinApp.exe" "https://support.maxon.net/attachments/token/o7sJsArAayJD2WWHW67k3YiVh/?name=Hogarth+AMER-+Temp.zip"
    1⤵
      PID:4828
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3208
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • NTFS ADS
      PID:2212
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1780
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1528
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:2800
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Drops file in Windows directory
      • Modifies registry class
      PID:3012
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4224
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2112
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4540
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208.lic
          2⤵
            PID:3184
        • C:\Windows\system32\OpenWith.exe
          C:\Windows\system32\OpenWith.exe -Embedding
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2784
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208.lic
            2⤵
            • Modifies Internet Explorer Phishing Filter
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5096
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5096 CREDAT:82945 /prefetch:2
              3⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:4816
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208.lic
              3⤵
                PID:4264
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208.lic
                3⤵
                • Modifies Internet Explorer settings
                PID:2704
              • C:\Program Files\Internet Explorer\iexplore.exe
                "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208.lic
                3⤵
                • Modifies Internet Explorer settings
                PID:1196
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208-client.lic
            1⤵
            • Modifies Internet Explorer settings
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2672
            • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:82945 /prefetch:2
              2⤵
              • Modifies Internet Explorer settings
              • Suspicious use of SetWindowsHookEx
              PID:3996
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208-client.lic
              2⤵
              • Modifies Internet Explorer settings
              PID:1236
            • C:\Program Files\Internet Explorer\iexplore.exe
              "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208-client.lic
              2⤵
              • Modifies Internet Explorer settings
              PID:1624
          • C:\Program Files\Internet Explorer\iexplore.exe
            "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Hogarth AMER- Temp.zip\461ad322-84e9-48c7-8845-4f36bf730267_0050569FE71E_1693579562208-client.lic
            1⤵
            • Modifies Internet Explorer settings
            PID:3856

          Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            Filesize

            471B

            MD5

            6c7b2a5652d9af8d682fd4fdaaf087b7

            SHA1

            339ab9d203046cbd435fd20725e6a1a74e9bcbd6

            SHA256

            8cadc8e8ad996d377ff4650eda2d01cb1299de52c5a668f996f594a769a98662

            SHA512

            6b762fb8bb68b9595bb410cd279c1358a102a2b87f58d0050b1b689a723e5ebfb764014b1b723419050ce2a4fb51072f52343068092e61e47f85526a50be6044

            Download Submit

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
            Filesize

            404B

            MD5

            973bd35ff06090289bacf1dd642a454f

            SHA1

            bb6e634a4a8cc3c230ae1a35ffce2dffbb4618b6

            SHA256

            009c0cd188123d9dd31dfe2b99df47b7655d23c1c05e6b72e4d34262de8da341

            SHA512

            886163cf76644b5cd2de3d2fa3dbf4834641abafff253fd599a7995d6f45db0a66917e7edf81c4a648af4993747144a30e2031400642316603a6b2e1299988bb

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA83C.tmp
            Filesize

            15KB

            MD5

            1a545d0052b581fbb2ab4c52133846bc

            SHA1

            62f3266a9b9925cd6d98658b92adec673cbe3dd3

            SHA256

            557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

            SHA512

            bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6IJ7L0EZ\rules[1].xml
            Filesize

            1.2MB

            MD5

            a87271512937a308ca9442032a0029e9

            SHA1

            bc5fd38d28683bfdf4556a499bd8184159d29301

            SHA256

            70e8f749d63636609f3d60d85c00e7a1230faccc59adcc9ead0bb9101e7d53a6

            SHA512

            d60944a41ff8969de33eecb68dbb02e09005922b5eae87e39e28e52669edbc65c605f181a82f4eac58b4fa9b0f64669d9dfc3a6e052a9d873c02bd52a821ec83

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\IV18IXVA\edgecompatviewlist[1].xml
            Filesize

            74KB

            MD5

            d4fc49dc14f63895d997fa4940f24378

            SHA1

            3efb1437a7c5e46034147cbbc8db017c69d02c31

            SHA256

            853d2f4eb81c9fdcea2ee079f6faf98214b111b77cdf68709b38989d123890f1

            SHA512

            cc60d79b4afe5007634ac21dc4bc92081880be4c0d798a1735b63b27e936c02f399964f744dc73711987f01e8a1064b02a4867dd6cac27538e5fbe275cc61e0a

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XCCD8EAG\instrument22[1].htm
            Filesize

            2KB

            MD5

            ec098d4e1a36718ea29833d4af0f011b

            SHA1

            938c8a202fd2710c4f1d0792375c47149aa64b98

            SHA256

            bc4163aabf74b8fd1eb2cbb57255869c815f9bf9f01ea1da5b3b66adaed34dca

            SHA512

            837bbd530eb2d1e75d6048abfc15c398016a8032331fd8740634b3d7cd67bcb7d9a11e78b6bad6496678639fc816223bf9c90695e3e81fc11683bf65f0bc07d4

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\DIJM79B6.cookie
            Filesize

            644B

            MD5

            7248ddf85c5cd21472face774fb7034c

            SHA1

            1cf9ff1c2dfb94f49138525d9f777ccc3dbc74b4

            SHA256

            e22496d834f659c412a46d1a84321ce9c65af6121a8f8d782f7f9221eacc0034

            SHA512

            bd4900c4397ea1dfe5145d3c5ee94d366ba0b40bd79330cff64eea25d816ce9b44a99bbe4d47d19ea8b8367eac3256890d2cb866bf0b721f6336bf35360f1798

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\RNXG1OXJ.cookie
            Filesize

            608B

            MD5

            90e0dc18c359f4c62a2a8a2b1af5536c

            SHA1

            759fde28ffe88adefabc593c4ccc7dbe68bc1b40

            SHA256

            2e23ef969539f2934c4284ea3ad5a0101d008ba7124c293d80c8cc5f0f4c966d

            SHA512

            4f8154a531306243ef7abd4d24a85cb96def8842754c0f9bb408f4ea85b7987c05c4132db7ac740c34abbda7861b828722c367cb71e9a26eb41775c4202a8f78

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\Q6O2ABR7\suggestions[1].en-US
            Filesize

            17KB

            MD5

            5a34cb996293fde2cb7a4ac89587393a

            SHA1

            3c96c993500690d1a77873cd62bc639b3a10653f

            SHA256

            c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

            SHA512

            e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Hogarth AMER- Temp.zip
            Filesize

            1KB

            MD5

            56e6604bce30de3230f7d0d92f1dc1c3

            SHA1

            6a4000f6d75454f3ef8701ccb66a85f34e7b658d

            SHA256

            c79a9918e946857941af69e813d407ba970eca973cdbd4d2a0f16b07614fe32e

            SHA512

            cd9bc010ab93291c6ec7955dfdd487fe44a9aa63d12da91ed29fdc637afa02225f03276b1cf759a6f392eaae91ba9ba113b76a0ecb083b07b01d1e2ca397672d

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Hogarth AMER- Temp.zip
            Filesize

            1KB

            MD5

            56e6604bce30de3230f7d0d92f1dc1c3

            SHA1

            6a4000f6d75454f3ef8701ccb66a85f34e7b658d

            SHA256

            c79a9918e946857941af69e813d407ba970eca973cdbd4d2a0f16b07614fe32e

            SHA512

            cd9bc010ab93291c6ec7955dfdd487fe44a9aa63d12da91ed29fdc637afa02225f03276b1cf759a6f392eaae91ba9ba113b76a0ecb083b07b01d1e2ca397672d

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\Hogarth AMER- Temp.zip.31ik2if.partial
            Filesize

            1KB

            MD5

            56e6604bce30de3230f7d0d92f1dc1c3

            SHA1

            6a4000f6d75454f3ef8701ccb66a85f34e7b658d

            SHA256

            c79a9918e946857941af69e813d407ba970eca973cdbd4d2a0f16b07614fe32e

            SHA512

            cd9bc010ab93291c6ec7955dfdd487fe44a9aa63d12da91ed29fdc637afa02225f03276b1cf759a6f392eaae91ba9ba113b76a0ecb083b07b01d1e2ca397672d

            Download Submit

          • C:\Users\Admin\AppData\Local\Packages\microsoft.microsoftedge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\A5EEDE9Z\Hogarth AMER- Temp[1].zip
            Filesize

            1KB

            MD5

            56e6604bce30de3230f7d0d92f1dc1c3

            SHA1

            6a4000f6d75454f3ef8701ccb66a85f34e7b658d

            SHA256

            c79a9918e946857941af69e813d407ba970eca973cdbd4d2a0f16b07614fe32e

            SHA512

            cd9bc010ab93291c6ec7955dfdd487fe44a9aa63d12da91ed29fdc637afa02225f03276b1cf759a6f392eaae91ba9ba113b76a0ecb083b07b01d1e2ca397672d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\~DF9C4B067DFA374EE5.TMP
            Filesize

            16KB

            MD5

            7c8ca3472dd0370f694654562662f684

            SHA1

            2dfaa0e5333ff102c17dea9f5f8197cf9ae2998b

            SHA256

            7111fd8177f6c1adc8df16cee651a350cf3eb02dca51b6de00cbb9dc4c6baca6

            SHA512

            91bdcedf068f2668367c0f4bd861a30464c1cfc52f0f0575030d452ea6748672c0f8198aa9ed3fa2fac474d1f196f6ea35b69fef2f10b8e64f3f7872a614bcfb

            Download Submit

          • memory/2800-62-0x00000200F90B0000-0x00000200F90B2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2800-66-0x00000200F90E0000-0x00000200F90E2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2800-68-0x00000200F92A0000-0x00000200F92A2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/3208-111-0x000001A42B6B0000-0x000001A42B6B1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3208-112-0x000001A42B6C0000-0x000001A42B6C1000-memory.dmp

            Filesize

            4KB

            Download

          • memory/3208-0-0x000001A424920000-0x000001A424930000-memory.dmp

            Filesize

            64KB

            Download

          • memory/3208-35-0x000001A425AF0000-0x000001A425AF2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/3208-16-0x000001A425200000-0x000001A425210000-memory.dmp

            Filesize

            64KB

            Download