Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/10/2023, 09:17

231012-k9jccaae7t 7

11/10/2023, 09:08

231011-k4bejsfa98 3

11/10/2023, 09:00

231011-kydbyseg56 7

11/10/2023, 08:53

231011-ktflhsee35 7

05/10/2023, 08:00

231005-jvzv4she8t 7

05/10/2023, 07:52

231005-jqs7rsbd65 3

05/10/2023, 06:28

231005-g8clmaba26 3

Analysis

  • max time kernel
    304s
  • max time network
    316s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/10/2023, 09:00

General

  • Target

    500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe

  • Size

    727KB

  • MD5

    3bd2bc1fb2ed7ce223505556ee150890

  • SHA1

    4cfd2d4f3c8c7359164eb79cf0830480d4793f1d

  • SHA256

    500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37

  • SHA512

    374eae32c1e803f468ed248d7828ea98b438d1377e21775beb5e0a477b593816ffa543d7dd3da94613d7e448a9d5557269f2c1b27d30726c85cf0a73f89883de

  • SSDEEP

    12288:TcTn6DzlAr6n1X+R1vXAMk8Bm+r7uobOJ6+ShsoaqEkgOsS5:ATn0e6gA0w+3uVzShRag2S5

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe
    "C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:4388
    • C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe
      "C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe" /retrynav 1
      2⤵
      • Checks computer location settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe
        "C:\Users\Admin\AppData\Local\Temp\500d0c1f457ab162b7ea0f1d31c32757d70421b8c9bc7b0083a5e3567441ed37.exe" /retrynav 2
        3⤵
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        PID:1076
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ReceiveUndo.xhtml
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4980 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2364
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ReceiveUndo.xhtml
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4200
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4200 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4240
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4200 CREDAT:82948 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:4708

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\WDZ4SUV0\www.msn[1].xml

    Filesize

    125B

    MD5

    c99b645b97f3709097fa2ce75a6fe969

    SHA1

    5637bab4d1a72c50e44aeb3051304966575d64dd

    SHA256

    a2db5e8afea319e49373527b25d6f0fcc2023526b955a16c7f8b7e0fabad6db2

    SHA512

    e47c427f30a2e1d56e84761b0cada92e726fe55bf8808ecc9228e1e26c0a91d158e93d5c4ded24177458cdada2f4f48118555ca4c7edb475bbacb68bfc5fd8b7

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C1FC1C8F-6814-11EE-9359-EED69A4A1DC8}.dat

    Filesize

    5KB

    MD5

    922022e16393cad1894f0c40fd1ae1b9

    SHA1

    56fa5c0352f7876296e2dc2589e278e969a557e1

    SHA256

    01b5c055f2f278d0570e138f4790fa43cb1ec5e1a28c1b8c1c1e4c49baa196ac

    SHA512

    3394240bc2acd4c8bc758002d746e1ee824a6f14cdc1da36db46f825253e02194f047d887b1b1dc63269b260e400da9fd4200605076dcbe1d2e9fbcf3ae849cf

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7A5L91DP\favicon[1].ico

    Filesize

    758B

    MD5

    84cc977d0eb148166481b01d8418e375

    SHA1

    00e2461bcd67d7ba511db230415000aefbd30d2d

    SHA256

    bbf8da37d92138cc08ffeec8e3379c334988d5ae99f4415579999bfbbb57a66c

    SHA512

    f47a507077f9173fb07ec200c2677ba5f783d645be100f12efe71f701a74272a98e853c4fab63740d685853935d545730992d0004c9d2fe8e1965445cab509c3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\YVRU9O6W\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • memory/1076-31-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/1076-28-0x00000000027D0000-0x00000000027D1000-memory.dmp

    Filesize

    4KB

  • memory/1076-27-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/1600-19-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/1600-21-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/1600-20-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

    Filesize

    4KB

  • memory/1600-17-0x0000000000720000-0x0000000000725000-memory.dmp

    Filesize

    20KB

  • memory/1600-16-0x0000000000710000-0x0000000000712000-memory.dmp

    Filesize

    8KB

  • memory/4388-5-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

    Filesize

    4KB

  • memory/4388-15-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/4388-9-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/4388-8-0x0000000002EE0000-0x0000000002EE1000-memory.dmp

    Filesize

    4KB

  • memory/4388-7-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/4388-6-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/4388-0-0x00000000001E0000-0x00000000001E2000-memory.dmp

    Filesize

    8KB

  • memory/4388-4-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/4388-3-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/4388-2-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

  • memory/4388-1-0x00000000001F0000-0x00000000001F5000-memory.dmp

    Filesize

    20KB