Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231025-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/11/2023, 22:18

General

  • Target

    print.html

  • Size

    656KB

  • MD5

    1bb62d6ab729a6efe49fdbdbd4a68a04

  • SHA1

    9397ad830dc1513732124135c10462e6828af823

  • SHA256

    192bd0a72aa1cab448d6e5906c771e019ceb44f60fe78e3164a7889b8efc0e8d

  • SHA512

    a365284077df824ab3b4108e38fb2b768223394d720a2ceaec3a497fa95b2f3e0d2e4cbdbfebeb3d58e40b6c2173a5e9993e91d62679dab2ca11427c8367cf70

  • SSDEEP

    6144:LyQS2iCbkFV+BwpTZTRUlhWWjYTBxP/PpdX/Rbb5HxwrQljV0MNE/i6Oiv7ZvDpE:q2GFV+BvWDX/JrlBREv7ZvD1qEV8RBx

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\print.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2404
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2404 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:64
      • C:\Windows\splwow64.exe
        C:\Windows\splwow64.exe 12288
        3⤵
          PID:2596
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
      1⤵
        PID:1200

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\B5FYTYSL\MathJax[1].js

        Filesize

        61KB

        MD5

        49565b9ce89c64da075a5a39969b366e

        SHA1

        30fedc6c732ef68bff3ef42016c7610d70a00289

        SHA256

        48344fd55558bbeb600062a175d052979f9ece87c7299788f8ecf16a46c87bf6

        SHA512

        b4e6afe70d4e8efb1227378f46db76b903c5c01a07b75559714abc97c9e6e76f382c4284f45489050af2ccc0731f16393f4cd174da847292c8455605360bb58f

      • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\XV93K3MB\suggestions[1].en-US

        Filesize

        17KB

        MD5

        5a34cb996293fde2cb7a4ac89587393a

        SHA1

        3c96c993500690d1a77873cd62bc639b3a10653f

        SHA256

        c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

        SHA512

        e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

      • C:\Users\Admin\AppData\Local\Temp\ML0YBZ2I.htm

        Filesize

        681KB

        MD5

        8aee5d9a65cf0afe6942afe9c0321f35

        SHA1

        fc6fd2937388190ba3df7ad479c1edc5eac21386

        SHA256

        64826ac1dde7d7be75d6401bccda01f0a7047fc3cd74f231119b059b74e6bb1a

        SHA512

        ed792d1432c162329d34c2c80d3c4f46912c2981d6605fe1983eb5d221109d82474729d0c2554df60b286e8df0eabdfd48bb324cc650b76df59c6e7f26a20a82