Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2023, 20:17

General

  • Target

    1057ef742ecade1f8cb5b743ce44b35a.exe

  • Size

    30KB

  • MD5

    1057ef742ecade1f8cb5b743ce44b35a

  • SHA1

    49dd35680bd6ba1f75863f17c0fe3e9ef57e7a32

  • SHA256

    79fc79f478c7b63f606dbfac1caec4232976170586d22faccc74263f868121c0

  • SHA512

    fcbd992726785da757c43b758e4c778aeb3db3506710e48f15ed10e936a48151639d230bf2d871bcc9ad762c7aed841286b428ce7912fa35b7e1b5a1e27d1cdc

  • SSDEEP

    768:TAwb6sRAIhqbKl4sFZxuufnMwHWedW/jJav:TAwmsKN5YnMXedKjJav

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 47 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1057ef742ecade1f8cb5b743ce44b35a.exe
    "C:\Users\Admin\AppData\Local\Temp\1057ef742ecade1f8cb5b743ce44b35a.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:284
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://lwteam.ru/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2388
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5b2fb14cfb6005a59d5060052c91c3c7

    SHA1

    f9f1f35e17606c312a9b64a235d83e7d09a3c7a4

    SHA256

    9a4cdee2bd4e5e3e0abc293f9738875fce0e9f8a691d408888c55986b3836e9d

    SHA512

    8ff66bdd597c22b05a99523ee6edfa4ac185227f0e16b3472c67e32fbbb20a47b32f331cd3747583f1ac36fb77688abae5501a34d09c85a763c72d830c60b4ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    dfb527b378815520129e805bf510f641

    SHA1

    c791781bc94d2535e34c2c04e33c9d173a63e25c

    SHA256

    2d2eaaeeb49d59854ae78d74a7926be9af16341397595a55d1e2d70768d2cc7e

    SHA512

    4b8f49c6f6eaeaa06f1b54c718799e823df3fe6692b2e9e0636cf2b5c5c2a2d519453a91daba764094d91d6308f2c3e5bd52738ea3c1d874a65b231f01bb6d0e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c3ba2e9730e317d525e0c34ca628136b

    SHA1

    7a641b95a34b6362c594209020f70752cb5fdcc8

    SHA256

    be4b84cfac2ea9e410816cece8217370172d00d89afaaa5f3f69c2e6ac3b31bb

    SHA512

    61e905753ddf0440e1eb819117c2e7c1b0c6f2487d8fadb79d6d956f7371118c80be3c3e1a2b3348cd17941180dfe6c28ea6b225aef72c64c1692abbd50b74d1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    feb1897f0319d109ebc2a1c16757812d

    SHA1

    33004e267346a8ba3ef5f7f565426d7ddac6e4f3

    SHA256

    d9ccf1357036fd6e2cb842c1c2e5f41779efba7ed792fda35ef4170e86cca394

    SHA512

    c3249b429631055729a6d6927ac3fa7545f837ae221d36ebabba9052e800bc06e232e0a55f945f3d624209439bf09afedf934e00fc726ee597b4b705aea4ebe3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    03cfc08c831d74908ca33f80fcbe8e0c

    SHA1

    0d822603902876c3e515717119c328c22ce7110e

    SHA256

    cfab22d6c5c4e92e3b137bb944d01127bd805af0727f08083a20d4f9f3e0304c

    SHA512

    005f1eb654d10a95b55ccb4cb6f0e61687d7c71bbee5a10cbffd49482972c423629c905d33b8ef19de44ddcb7761734596624d4a784b2f66af914b71adf382f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b66cf6a0a4db89f4b5d25a4fba5af02d

    SHA1

    b40c964b0402c8869540a69ac35be575204afaca

    SHA256

    bf402dc4838a4367eaab5b582337dbfb283005c0743437f18bf390bcd8f67b3c

    SHA512

    f74f05793b076631818e69482841fc0d1b52be4fe2526931db761b290e78cca7b187fb593ebc8379372b7c7a299968c1869b0c55ded468aaea41607542226466

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6175a6b26338da500f00063534d1a51a

    SHA1

    dfc2cee6c6ae4f7930ac8c711209e152dde59a5a

    SHA256

    9b40d7050fa4cb0e48e1be4f479770a7df72fc5791c9a0928541c4c589d4a8d3

    SHA512

    b2981a675f203045e24fe89bfc39cfa669aed3eb3a4adef86bf591ad8b05c2157f9405cbdc4d76b314ab544d003511ee654e470cd7f8e311a2a9bd01cd078335

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e45f6a94b85a27a3ff6e4f5003079dff

    SHA1

    9a4401d807254c398678bbc8b34aaa6de32d378c

    SHA256

    09cba2aaa83212f245095db020d55b5cc66cb7440c7f3fbbdb2a3f053e8ebab8

    SHA512

    112ff0027aa79b96c85c3b4ec53f4e90cdab6fc2232446a480b14152a72355b772edffcd78b327697286375c080a711f4dabdf124086b08c2b865bf7c7977f7c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4db4d4c22c168e796e0f7c2e48da721f

    SHA1

    9c1f5461779e72388de8eb2b22faed16b71d6c5b

    SHA256

    e6bd1a5796cb2b6a337bfa6aa0d0058b19a31fcf825dc40767f7e2b86740eeb9

    SHA512

    a3cde95c5b964f8d9060d2a30454395c6a62e319f8513d4fd2cb95d749a749ce967538053dae2d512ebb562fc787d337343acfdba267072a24cb976092590bbe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    94287203801be5e2d72c8213379d7460

    SHA1

    2f5b697acfb5de0cfcb258fe05b006d2cedd5355

    SHA256

    54803f0c0dcada56c4bebcc8c9cbe2f5375c8b9629caac8089092c17f146eb80

    SHA512

    5773a4099e1d270182b733c3b8d712dae0397e086d79791b10e6889b610f08b21125c95c6b9c6e6fae1555584302431454b890c5254aa1bacf6b8c3a9cbbbd07

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9fad8a61ad964090cfed42d2f58c3a07

    SHA1

    7da91b0aeab2271d4f55803f2ae287a6a4f9f935

    SHA256

    7c603a8c6072d72e88912305b297aef78744af21aee0cbbbb437187da1664753

    SHA512

    92236b95ab20475457e54459a50bcde2ac3ff4236bee84edb0e6e4669b0c3750436af054133905d48f573bc9376b12ad18437cec0ea59171d1aa34b80e51ad6e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1981fcc58880feab40817c3e4455b8e1

    SHA1

    2b727930ed5389fc63fabee3b0ac2aaa449df10b

    SHA256

    d52c9668b80a169f649d7b86043b730784e6ff326f846a465683f54184762e88

    SHA512

    0a4bf00aecbd66ccd63f30faa377f2010038212a6ee5927e1e26ded599e88c0f83152966035591e83cd003f13b93360fcc05b50c9e7b33aa85e5fe16789abb9d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    faaed0c400560bdab34b2a7025a08f83

    SHA1

    f8b66390e41d5bfea91350627a3f44e1d92341bb

    SHA256

    c000a07740423f64de7d24611e17a1ed815490134174ecadc7766b1d2fb2a006

    SHA512

    716a7efb8d33b9450c8eace13a36f1f7b513439ac87260499b2868baa1d32b114148eab0bb1305d3177889dfd81c4bf5d62587b9f6a22ef3e65f01153596906e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    60ef6a334c003d69a2604dfa3e585778

    SHA1

    51f342910b09d433d21f42e612151f0d8a8891e9

    SHA256

    1852e84e1caf763ec24b6f269d48028ba0781e77a8aeaf8883ffd6a0ebc92f7d

    SHA512

    164e6273c4f3c778041a5d354c40d0e4da96fbb8fb01718b2eea496aacf1d8e14d52b9b3d1f186e2cee33408c7ffe4dc3a693d49b4e7380cfe1fad4c48869adc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    06c57f054cb24e6aa7bc10563e2ef87c

    SHA1

    0c5d1866c2bc071e14bc8939c0cebe654b52b772

    SHA256

    0aaede87b71b84bed44741744860a46871cdc8cb79afad6207c69dc3357a1d81

    SHA512

    71dc299e449119a550d95acf9cd639b0840f0936c73007f25ef47934bd10bc72b3cb17ac3ae9fc15105b750cbf329b8fe7b4a2c84671dd3457b1fe9c2712287b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    dc2c58e2914f848d32febe0f6702677c

    SHA1

    108649118a21330db0f1ff8f7666e0b3fb8b9c44

    SHA256

    94a03b36455890b6bb7d70e5a51df829ab2815103444488a4e88edda286ce73f

    SHA512

    50c2bd258ef8e5a4cf0f74721054bb383a57c0be3340e91afc5b2060a2890eb551984c616e661cb4bb31068596edf02682efdd67f0235ddd98000f055963a5f9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9592673b4ebeea9281722bacc5c7da36

    SHA1

    a90a592ea263d61e3d0bb1e0cfb4ee3cb59213a9

    SHA256

    34678dbf2f409727c9290af1e8a263b00b78e5db6036b187b2f2d8a03ed5095d

    SHA512

    d6e22247b0b8288f65a52630363607c57fff1063573ab1bdf737d7913396c8633f398ad8b77849e787fcf7c5868080de47c256d68c7a238a693b832b5581c52c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    138863dab3cadb384f643eaaa84946b6

    SHA1

    8e64be9dcbc2eab8d4929b90826301181a40894e

    SHA256

    5934dec6329edcc9d3d2d7ba4b5381a3e34a50e5113030f2aee6a085f29ee64a

    SHA512

    e8c1a56ea4bb1cf8216f0ee9639d53cd41b53543846029bbea38e746c1932a9bce720784bb44b378eb6a4a5e05e6fc70ab2ddae8d09217e8659c125887bba70d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    87b2bd2020d11670aa56513e99253b62

    SHA1

    0e2125be7b5dc087246b39f9ad08dc845d89ce7a

    SHA256

    58ac1a4df83c8eed9e80e0cdb5ffbda48b2716906df3b0c17c13eafc09d40776

    SHA512

    419f317a412f3f675c2636005d510b749de6c4b0bd533388e0e5d6f5bce5cacc838686a5d386d4f29408f082227b7f971658e13fc6c48dad702e1fedb3f54f5f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9298c038e67f72accf2e7d55293b799c

    SHA1

    c12c391cd102ecc5c4afa14932ecae78632daeae

    SHA256

    44051d2ea423c2e7ae0c2d56a7aee25c7a7a14c23f3e9bd5d8372511e2211717

    SHA512

    53119087d346ea8b46b2e2c6589e4645295c3d330a686a3376cb6fdf21d97212019cd5638504c7924621a1698dc13bd8a4ec7e35ffb0ebe625a086c409c00f1d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c966bbb3094f91be1a14765a7f97b921

    SHA1

    bb26e2a89789402b455617581bec091b200216af

    SHA256

    b359bf52178f1376e88a48b09510abd3f72dd3b991754c9bae7012431a020d80

    SHA512

    4b97e67a36c78e1ff86c2b3e645adf7ae3a10beb94516b3adba5f3044d565446c461195213e6b3aa987609f35eab43f2992bc84ad14999d6179d0881944b3080

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fb614ac0b192ac8b9058421a75e44349

    SHA1

    3253c4ec6127fb76440edc1e6129a659ff3e88e9

    SHA256

    e89c70d20d120f004f8c77b639f0bc0d043b25aee80703c96be8fca0ffd4571b

    SHA512

    1a1df427cb506649aac5235c0257be0f152d913e3ebabbf99a3848cc48c5fcf3ef214e241bfe0ad8f3bed11f022ca42016ea7442a9ad9953ba78e2e190e89b8c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4d1f4fc7f241aacf259c038ab7e5791e

    SHA1

    6e95751f635731690d7007fb2db1f17c2ecc70ea

    SHA256

    46b9ea23fd5c3a5668f68130fb174faa7eb3df86820d521f1209578a67c8517c

    SHA512

    658e04fb912e78643e37b4f9252037a7a49cb83a60ea39668648ac431b0bdf53a3c88d76f075cacc45e656e2060ad538ee24fd361c016589142e9d9ddf6f31df

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\O3YELV9K\www.lwteam[1].xml

    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\t83hqs9\imagestore.dat

    Filesize

    885B

    MD5

    962de2f9860f11f0e5e57018524a6999

    SHA1

    5b4ee321dddc0d0bd10267748ffaf46b19c830af

    SHA256

    8178b3e7a972f7b7b921962f99c42ed8ba2014ab8413df207cad9e006d6ec9d1

    SHA512

    7ab2d9afad0ac624028a3abed56642f2d5873920b707cacfd5d06056c6571d2cdd35cb599df9d11732496804d9b831161f69aebc3b10facba43db146923a7ef9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4R90HQQX\favicon[1].png

    Filesize

    713B

    MD5

    b60718d11a10bdefc4e3c7d6a63cbf6a

    SHA1

    929e99488c8677395013c9eb028075bcdced94eb

    SHA256

    2b54fe4a5aa0ee56e3b1a5532c8820e3fc75272b5d8e7ca4a44c03c9f171dd87

    SHA512

    e06a0485b83d1ce11a1978aee650223573cbf9727191d713e6ad2fcf2550a409b988178c5994eba16f4863a970b1cc22d146a9c1e054c2e36ea0562c6bc2895c

  • C:\Users\Admin\AppData\Local\Temp\Cab34B9.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar34EB.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/284-149-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-285-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-172-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-158-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-0-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-145-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-53-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-3-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-2-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-1-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-1035-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-1036-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-1037-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-1038-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB

  • memory/284-1039-0x0000000000400000-0x0000000000447000-memory.dmp

    Filesize

    284KB