Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2024, 09:19

General

  • Target

    6508cce6ed083af3c34b78a42f2e331f.dll

  • Size

    132KB

  • MD5

    6508cce6ed083af3c34b78a42f2e331f

  • SHA1

    6b0aaa0e3ccab03a520302029deca35ba0523dfe

  • SHA256

    9d7e58de0ac135df79cfece1b2f457ac07640d5a842d9be4f80634294a35c492

  • SHA512

    de41a6e1a89fbf3ef6f76e70f0fbb49f3a628ad6e6da40a3502907fb3c4eeda62c50df1258189162c1d3e2bbb377694a1c5879ac65dc584bb40049ebf9fa6ea6

  • SSDEEP

    3072:dOQ/SyOcEXfRu3sMVkSx862dB5t1z7jOIXHL+lck0rlg:4MVkBDBhHHkX

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\6508cce6ed083af3c34b78a42f2e331f.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2760
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\6508cce6ed083af3c34b78a42f2e331f.dll,#1
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://gordon.d4rc.net/
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2140 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    7df9e4e8cb91834b84a47f314fe688e5

    SHA1

    6520a918fb7a5ce22047503b4a9d96ca78c3aba0

    SHA256

    a1fc31b5f58fad38710e0d0a5a221195c6bdc0ff39f698a523d484e9c56b9adb

    SHA512

    ab03817d0aa1c91707e9943d2aa02a6910b22080fa093b106a6aa43a4643c06ebfe852c8d84cc19c8f66362d3a023e30490dfd91020dba5d274333046e5084e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d881c57cea40e32e44f934795e8ee7d8

    SHA1

    a6dcca1b0508ebaa2aafde5a5ef68dbe17b5bdf0

    SHA256

    04b09be2ade0d7173055abf79c0c45a301ad702aa5d2d8eca23288d020db3752

    SHA512

    e4c37df079aef44de0cebf0d65d62670f79643bf0a474e32e9b9bfb737a7e832cd06c2e35a434dca051254c2a5d71a031bc5647c5dbc3d428f1f3b14b043ab1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0d69304e032a867a8b0bb770c332659a

    SHA1

    a3aab09b184f4f017c230e5438f59578d107358a

    SHA256

    04b76f5a51995f5d2cdc5421714b9c8cd2793689301c9786b220f479c3fe4ea5

    SHA512

    f45da62af7c23d11e24f88431ec44c3e1ced7db882eb7d2011950cafaefc2a91c2243a471000e423df32c391b3065072950bab3855ca2bf9f36d56433d898143

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    34fa491ae7f87575d78fd71201386483

    SHA1

    5c8f217f88cd3ab2d49ee3f6e721c897361f8456

    SHA256

    e93829b24bd743e79c06a3252582265ea6cb0734fa654cf99dcbac162c8fefea

    SHA512

    009a82e5e1cea9bfa87b559af2e623b47f049e46dc15439766bbe234abeed1a1500b0bdeece97fa00836628e3e0308f4092579539971b7af6226833eda033fcd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    68bb398f5450b3a39c026ff3fd6f614f

    SHA1

    32dd09f124e1ff72fb1a75ae9be5f6b157c06efd

    SHA256

    66930af706fa5665ddca295c4774c96adb2165a6b8b1770afd7121762485434c

    SHA512

    cc8a363dcc6418725054128250302e7ddc1bea655c3c289fdefe67c3c39cf177d5da5608d53433cb36ad617fcc73c7ec161ba4d92774fd75d1cb05be4ec1b6c1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ccede9fe4114882f7601f7ccb22477f8

    SHA1

    41da390e08bcaefb54cb587d8e44ef18caa8ad67

    SHA256

    7a6c7ff24969cd85fa5c4aa50b07eb8648b2a507ed7f16c2b3a415a96f060543

    SHA512

    180ec13e73c2b03eeb0d5a95900f74ac922a8b17c633790950abb147f3a95b248e769d1c614dcac39df3923804e740d784b50d0d78dbce574f465388e5d4770c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9729499fdb730463fc3772bab5ffa9a6

    SHA1

    7b6fa18752398e8c51e494271957aca7895d6844

    SHA256

    18345758f2c531177a1bf31bbc7f147420e56be195604f1df83bf292668afd87

    SHA512

    3a0b75aa5b1d70fdc1ecc7d28867384bc6dc435433dfc77b9ab10a788ad2d2297782c3334ac0e27b5d44667c6e84f65eb7b4487a0e478847e1f849abc64291e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    eb75d150d226acaf574410531ddf86a9

    SHA1

    67a0efd81de29a4d1dab11c461205c15116657b1

    SHA256

    7cd244ced47c03f71f15e8359e3e66dcebc54d90fb987007776165c241676be4

    SHA512

    b5c79c669253b24f2e93c467a377a7e807ebca312a140846bae5144f14cb8d1b53183c5701cbffdf992a5a2e7261951a282ff3b89f6b5ae71f754ee8dbe3fd60

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    599534841a9d426fc9e6112a7dc53ae9

    SHA1

    136249b55b1cfa6bd7b3e3cde0ffdb8231b1def7

    SHA256

    d07c2396f532311fab0016facfd1c2ba3bd9486b6a81a363a1be32be7ae7664f

    SHA512

    7f38066dcb3cf986375d714ebf3756f851eba0c94415b1e5f9bea6dccd1e703a5d9a7fd3dc875e20d9efa2dc996b3dc4c7436a59af4c4aa6095a5f205e58ab45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    932aed4882c46dee03e09f47e59e6225

    SHA1

    149b74c25b6154c45bf63ee38f71d8ff91c4059a

    SHA256

    0e1e426a9f331b26a78928b79f09e4c1ebbcaf23df8efc386650a9103491d266

    SHA512

    459e69ec1eee9a9c19bc0494b9bf954e86347b530b200af4c71f45210faeccce289464912969800f6f18948032e6b0d2914d281ab1316de36d0d8dff20da1a01

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6692ffbac2a90721e0f2cd29454639f1

    SHA1

    f7ed567eecc42d28c5bd03bf4c0bffdbf6c8633b

    SHA256

    fd475245658c2636eb42c9b52a3a03740251731dd93bf282097a40bbb614ecc8

    SHA512

    dda1b91a8dffb7f105c02acb55c16a227ad2a339113e0fa5c10518581b0d22280cf3bd6fd02bd64c5bc417afc29d19e6c3e23f29a8da818d28414389aeaf3f9a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f021655ba45853ed57a1a25e84add779

    SHA1

    d5cd7cc4b142cff99f1e578bc9e03faa1689685d

    SHA256

    572bf23fbf886d55163ca9fc7e0b9e37013368ffd83c473c43a05a379fc0732d

    SHA512

    7e66eb08f5bf6a42975d857e0d4dec510568c62484ebb4b29e8b4fe037a374614fcd0169103e0450ffc5f58a31244e76bb118f8d458a1b146586cba61d0b56b3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    22cd740fe668c34bacb7b311f828093a

    SHA1

    de6e973dee91485a509591a732deb50b133a2b40

    SHA256

    5931dd117af88833459d96e0b7747439a7966cc298334be76cc4f0ded6d25c42

    SHA512

    3a8c61e60181a4a44ec0dd7c0a609a0e332b22fed01e68860608c7788da9ac7798174ea3ddd26cef0d5b3b6753a3ff430efa34fc195e8a1b06528c96e94331c4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5a3fa098714dc4f5df4a4f6137ebbf64

    SHA1

    d8444b05f48992c3d0b964df390998101078df36

    SHA256

    2d987bce842476784a210d337ed8b2d1b6f403aafc0f47fcc7bf3197dea7b0b3

    SHA512

    da2327d00a69738eb7e0f59e2706062eaa7c94deaf2147a6d6630a7b8896069879f873b2e055275ae18004a7b0ff575f0355713f9b773b7272158336c475d79e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6408540229406026b4e50adfb4bbc359

    SHA1

    72ac4f4fddb5268eadee98d6fdd80a2530f02e54

    SHA256

    e0f0191efe8c940c5b47b9b1d5a99d95e6c3347f390cfbd5e5c19fdc439673e6

    SHA512

    dd351dfd04a559b0932a8e0ed28aa79c29bb6a89eedd23a60660632f5b542cca2d4a37af0c5835c0e3e5edcdc316bae00dfafc55023ebcdc8247b04b493eb025

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b116f3a24246a53dda2889607bac48f8

    SHA1

    7b5e06f2eebb41cb897ff5162846aef75602cf71

    SHA256

    0b4c94805143996883c1c83d63e7e5b2eca83c1bc41fedf088fbef0f501f3a09

    SHA512

    489ae8207165102319b4eae5a52c4cb375825c85beea9318c14bf55b111739df22b0cad4776eaff06f711591a944d8a88c65dc9cccd68fdc6c44b1848228e2bc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b24fa72da5dfcd8a6165acff989c75f5

    SHA1

    ca17ddb54fabda5f3808451a8f43e7eef8a2f6a0

    SHA256

    ad50467a6d889580abdd3564526a471e4df3b6fd992040f1e0276f04671184fe

    SHA512

    e8b69d722e1501bbb970667a028c4e51cafc43c6f46c7a282de9ddba5b62de6bb446cac36f0c98986d70e4f98ee4d4299b93aadc85cd4fd92de86c4e8975a2a8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8d989ffbd221f25f3651d2317152e56d

    SHA1

    770ae61c3b2b9d7fd4f793c311fff4987981d10f

    SHA256

    c0017eacf7617b1cacccfe3512838ac69e9d704fb000ef7c086a052ed88e9158

    SHA512

    2affd8b3ce56067bc479fb8e1fa684ce55c87f0f55a5102515db415f940f60b253d5b432e5d853ed35589d70190eb7cb962b935377bd5639117dccbf86121d3c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b6c61af4fc9ebcd31e6c9e09fb1d9956

    SHA1

    04413aa67e43c82a700b13b93f57ce14367a17ff

    SHA256

    588f36b606778e3745ea7c933a861ffd472c66d8186768d4727e81135c9e97d7

    SHA512

    d1483cc31c9ffc9818df8d9f42d8b9fc8b227d45eb7b89215b3386b001d8a3995e5f209e1ac1538a10e48676649b87c2511509e5f765a11ff30f6d0169eb498e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a1a6848cc008b3f7d1fe256f5b378a57

    SHA1

    ce5aa7274ecd40c4ffb0afe7aa115419a898a9c4

    SHA256

    de14e9f46b9f4e7bb1407698e76919bb93497c8a8dfc0b9a8d2a2ed9d6f178bf

    SHA512

    eb3eeb882f91525d7fb226670262a28d1b140388caa806f1ff70d551d1a7a36cbeffc39fcfd89aa36751ddadeae2fb97133e44b6dc7e45b55f764d44ad799fee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    725df59bc60a0debe237794f0a91082c

    SHA1

    b85742e1baf8c4228d80db9010b69fabc87f5139

    SHA256

    e909ffa4abd7bac4584cadf756ed02f047227fad36ba7c978cda84ae31dea24b

    SHA512

    45f88d6ec07ddac7a65f8d68b20e90f0530c12db8cab564c56c2037802958560780285dbe77ecf775e4cb6deaccbbe43edd2fddd410b9db1f87516eded3f0c7e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4042182e5beb097528dacf4f443cd0c9

    SHA1

    17bbb42d5fb118c1d00b3d33bc1460de68212564

    SHA256

    2b636c6cfd54a8147826146c8428f133badadbba234ce4b009f2a65db1199c03

    SHA512

    5aa92012d9b7ec183234fb9717d852c7596a322dff96ae16a7363bf9b58d0de56fb0ef1f478a7783eda59e2650a11c655f16e9fc4e0fb96c346a486a33efe69f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bd0a81591d28e964060f9a0bdf2866ff

    SHA1

    72657e7d26dc28b202040c8746d1e0f61bbc25a7

    SHA256

    09cb5872ed1b8cf50aac6b1b8022298aa7ea84d77490259b2203ecae665545dc

    SHA512

    30175f5c69292b09ab63aa463b70eecfc57b685543a8e8b7ad140faa3004548eca58d8b8e0d0fb27228fe8d5912e4ed998f29442a8ea56bbf6dc139e75cff521

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    724bf4dc6bcbe619169eb98859ec981f

    SHA1

    819f4542fd4dba69feb5c7ef8e0891f8cd31c6db

    SHA256

    e0d9e40757cb2687839de0cf3f6818fb6ada30db6bba7846989f964a1a3e3a6a

    SHA512

    5cec8544aeae1f88b76aa05106f3c274d8b64093ff6840179c2e2334424a3b151d0ee5d075377deb6e49318e8ba7d4901bbd066aafe95ced0efd5349cfdce633

  • C:\Users\Admin\AppData\Local\Temp\Cab5D00.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar5D71.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06