Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    18/01/2024, 12:34

General

  • Target

    656150f6caf01db2bce7711f9df89e8b.hta

  • Size

    11KB

  • MD5

    656150f6caf01db2bce7711f9df89e8b

  • SHA1

    c52411b43b9e8d78825b20f2e64e3acd6f7fb577

  • SHA256

    74a14d27fdab8df87868448ffbdec10a2e940972c0aa52e6db044d307f79fd01

  • SHA512

    a40850dfeb74063121c7216fc0b0252f63773ccc38c6abbd3d3210ee6b8f3e5da5760470d66ec1ff1a2e3337c583a09664f5414075eeadae61691ba4fbbadea5

  • SSDEEP

    192:Z4m404/4WR6cNgO4B4B4B4B484B4B4a4O4Ma4u14o4fj2464N4cv4K4z4h4h4h4s:Z7ZEHIIII7IIFHYx1LeqTifvbEIIILnN

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\SysWOW64\mshta.exe
    C:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\656150f6caf01db2bce7711f9df89e8b.hta"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\ProgramData\qVAlignTop.dll,D2D1CreateFactory
      2⤵
        PID:1204

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads