Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    89s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 10:29

General

  • Target

    79ff58f188f27f9bd14186457984d132.html

  • Size

    61KB

  • MD5

    79ff58f188f27f9bd14186457984d132

  • SHA1

    1eb54f0d0fe44e4e93a1a69e579873f2557c9681

  • SHA256

    3f569e52d4a05c78a47c7d98c85f0643f3fc48ce9616871b0f393595462df884

  • SHA512

    bd21f84bfd1925d2908a57a1ce9fb785369d9cf1c27dc28521075d55e23a526efd32f3e6f49ec05a6bf063709d65baaf1603819a59131a2109f6b37cfe92f3f4

  • SSDEEP

    1536:z8RgaQrjyxdQxVR+ZGpgNAHrSoXMf1jBoOKGTJ11EG:IRgHyxURxKNAHrSoXgoOKGTJ11EG

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 46 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\79ff58f188f27f9bd14186457984d132.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4960
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4960 CREDAT:17410 /prefetch:2
      2⤵
      • Enumerates connected drives
      • Modifies Internet Explorer settings
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

    Filesize

    4KB

    MD5

    1bfe591a4fe3d91b03cdf26eaacd8f89

    SHA1

    719c37c320f518ac168c86723724891950911cea

    SHA256

    9cf94355051bf0f4a45724ca20d1cc02f76371b963ab7d1e38bd8997737b13d8

    SHA512

    02f88da4b610678c31664609bcfa9d61db8d0b0617649981af948f670f41a6207b4ec19fecce7385a24e0c609cbbf3f2b79a8acaf09a03c2c432cc4dce75e9db

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    b610bd5c61e2121914699e4b6cb9f7f4

    SHA1

    514f5ad7770f18e1c5b62253d95d6aa3c63c83ee

    SHA256

    3a418958f81aae04aa13719238c42d24adc5258b95246b3df0b32a1bf7676b51

    SHA512

    9ebb50a5b4942dfbf1a037e8a1b6308502d5bd337abaf90cca0d44f3a88001b25c6f82787f13b2d5a6f2bcb81209f831c16422d4c1a6cb6e07d55e8dccd7b3b5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    3f7313b6842f1cfc98b9363dede851ee

    SHA1

    45d815e8ead49ab95a49df84b05b6a67d32bd6d7

    SHA256

    6ba8fc8f7bcba687937fb8129472c4a8fff711f4109d3ab6637389e6c4dbd9f8

    SHA512

    70929fcd45060cb14bde1f1c5752ee85e575609defdada4183ac062966c6ecb4f602d170fc9ddbdee760a01cf7df2e092ca509b3ae1920f53d212093a927e88f

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xml

    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

    Filesize

    9KB

    MD5

    7050d5ae8acfbe560fa11073fef8185d

    SHA1

    5bc38e77ff06785fe0aec5a345c4ccd15752560e

    SHA256

    cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

    SHA512

    a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\cookienotice[1].js

    Filesize

    6KB

    MD5

    a705132a2174f88e196ec3610d68faa8

    SHA1

    3bad57a48d973a678fec600d45933010f6edc659

    SHA256

    068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568

    SHA512

    e947d33e0e9c5e6516f05e0ea696406e4e09b458f85021bc3a217071ae14879b2251e65aec5d1935ca9af2433d023356298321564e1a41119d41be7c2b2d36d5

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\platform[1].js

    Filesize

    56KB

    MD5

    0d25af623d803b10050b53a7b218c652

    SHA1

    2dd71fa961b5df37134bc6eb987ee7b7e5861488

    SHA256

    0bcb6531cb0967359e17b655d4142b55d1eac2aed3fe5340f8ce930a7000e5d3

    SHA512

    919b48cabd548ae63a6b89dd3ac4df919b630b0cf75266d21b35ea3a6b54eb1ea5ed7371e80bb6611e105f2d994abf9f76f6dd8b6915dd2b8fda09edd263c139

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7C34XGPV\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ALL181V\f[1].txt

    Filesize

    36KB

    MD5

    b4717600f86903f20b391e3ac6ff92cd

    SHA1

    cfb3feb5d24964e3341dd790cebb037cded61211

    SHA256

    7593d09b1cb8653942027ebf8ead270000e3bc9113077b76bc542e86d65e49b4

    SHA512

    6d3b900de6029eaf1ab60b386b4994969eef22b597d536d5e04ec6b8695ae0c7fe124efc3342b35710b42b4016cf5e5491674a3057effcaf4132403f144f01a1

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\PZ64U2GI\55013136-widget_css_bundle[1].css

    Filesize

    29KB

    MD5

    e3f09df1bc175f411d1ec3dfb5afb17b

    SHA1

    3994ec3efe3c2447e7bbfdd97bb7e190dd1658f9

    SHA256

    1a2eca9e492e3a21e02dd77ad44d7af45c4091d35ede79e948b7a3f23e5b3617

    SHA512

    16164d66d452d7d343b1902fe5b864ffdee42811ee90952cbfe9efa9847c58c0403f944c8e29db2bc2384ccd516b629cb8765e5e51de37da6efd75962cf82530

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q15AV1NQ\cb=gapi[1].js

    Filesize

    133KB

    MD5

    288c5ba5b7001fe841c32f690f62cc93

    SHA1

    29aba9d8e4f7cbe25fa5e64b9ecbe256e51fc789

    SHA256

    c2f33dc18eae27d4e878bf837dd97f1bde5151e44b0271408535bb93265b8c52

    SHA512

    e375d41344a086d35accfb02bb1f91e2dd383db032af387fc3d6b1230057cc5e432e9b2cdd976e51425b4f587391d42f4d9d857c2e6f11e822a65edcb85f1c9f