Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 11:33

General

  • Target

    http://142.171.8.34

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://142.171.8.34
    1⤵
    • Modifies Internet Explorer Phishing Filter
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2976
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    00d19b1b237ee254b85d7d5cc7609aac

    SHA1

    0e6f26e9c1f3614401c15d831d54dcf04a804d6c

    SHA256

    52be4d4cca1139eb154b0c2fac172e385c3d976406e1baf8a583dad795ee2d16

    SHA512

    1db112a207b235c193567891d0db4e884a9f43e61f94148792d31d812a64c98ce11b3193f7185d64aecf115d5c3c7d9c42227d31d70f059c45e65c161829ac13

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a1eb5fedd84b1286b80c0bfc590ccba6

    SHA1

    8c1d8e42f71be22cafd8f59107fbb3bc1ad5cf7e

    SHA256

    7fa6579decf104fe49deb2c07aceeb472f64d695b1bc7bd222d70a666409c4ca

    SHA512

    e8ad861887eec383151d7ce42eae2ce85b2c05a47e21db468f79d62be2b8735836270234af2b7c32b640c0f57c869acff4b9d6ab7ac785d4e8c0eb9d46d08f35

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f1b69bc0ed09f8aa4403ed08797f9797

    SHA1

    b060b799c1fc8385f861b9010b383a997937aafd

    SHA256

    ec8456a3521e3e5dd0ac11cda57301993156ea924826c95368f793bca9cc810e

    SHA512

    46450e3c4cd3bb3af8f86b08af8978d929a8ce1489fa64356b4e562955d30c42c2943ee1cf654add839ce625bca39c81edfa19542ba62ac26dd8133a9ad59427

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9117470871ae138faa7c853f32b8969b

    SHA1

    97c6e7507cae7d9fc9b7f9e42ca42702d60629fb

    SHA256

    f4ff2a76563b9d418e81b18c4e0fc0e030b0ccc67b7c200bf16021bfef7ecfd1

    SHA512

    7c0b401d38de61ad21874f3176ea3e9b7db3c17e22f25116a259fb4f2c4dc54b800208b85827b549db059b5d1e687df2b8177d2f80e89fe59108449c747cd6ba

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7f235de9446d1de0c1740e00d92d75ad

    SHA1

    6c50e09bdfdc5044d5dced4b517660edc253e797

    SHA256

    7c485f90cb045ce9e56cf9a988469b2ed8a257d0f682404d967e155e19fc0db5

    SHA512

    d7cf1be9c4777ead350705fff817881eae6a93ce295d93f85e1b9f827ce9dce1f55a4bb8ec7758ef0c49c9f40d625485d6939aa23b94669dc108f39da57b03fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ebb3b9d4b9594a77eb7f81d131129707

    SHA1

    0d0bc3413b46d5f4ac2bb6f478b64dd7e8a174fb

    SHA256

    9a988692a901284aededc874272cb50d2aad2792bbd88da8c0731bcec8bbaa07

    SHA512

    a25ac2980a79dac64576861af14e7884ec1305b2ebd10e5bf91b4d09d02a18bb54a13db945e5ce57f7394140a393ea1db536eedc8860f15c1d513d6b87c080de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    dc535c8db73d6d643633c0d3e8bce58f

    SHA1

    6d2afd6c7e903fcd2c3cc91a990171bc3b10a687

    SHA256

    98bac3e562d693160be37017187c02cc2bfe780ac6f541d4a016229d1d7be5a5

    SHA512

    0003b5c187cdf1faf9057dc50110246339f10cdaaffd11c7e49f24822eea78c3bea5c27c06f5df406662a2e49c3cbbef431bcb77fe68f9861045e3a2ad31c616

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    618e021a17caf54ce076d0e1584ffb31

    SHA1

    a0891762a164585a473c9d8abd28d589145833bc

    SHA256

    4188d0e193b0361ca1dc42ad97ce7b054cd59b6dd71afc12e010993c2575739d

    SHA512

    1f273f9368decadba3a88245408fe82b23ba2542651108c55f2e14833111ad98591b2b9fda6b298142609ade8287cb2ab577f9972f44e00735836f47bc66a449

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b268a8301d78fb9dc8dff08ae1e5008d

    SHA1

    792ce0231a26d70f5c11e47cde529912f1c9613f

    SHA256

    9bf4f91bc69499afa907ac91b38cdea9c1e54d9d9dd69272be9ef2a0b52cf614

    SHA512

    ac81721bb307238783489b07257f5a2977a1eddadd76cf9f466eddc585b94c130608eb2019f20f7130ef82ae1bdf0c9f248b3dede7e2523f5be33514ac94e923

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6f648c3ddfe635876bbc6be873853d95

    SHA1

    4a11d46107bb1087aa12644f0b8d98dc9c62a1a2

    SHA256

    566929681b6854a44f9bf814593a84c38a309da19a87b08656a4ca03deaaead2

    SHA512

    8c441887a44de9da01b6d3fac0fa9f589626f7c3cb22a85db31ae55c8580bedc0bb13860da76cc4270fbca498ed3b11c711695b237ce837d464c1d0e3579ea04

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5267847648d5e606f354ff39ab6438f7

    SHA1

    4ecdc818f7a941dcc2d6fb99a735e7c6be3d56d5

    SHA256

    57931fb2f847c5eca9bdbbe179c1381591bb68363a71f44fbd815da9ad02ba5f

    SHA512

    00ed9d7ad455210c0e4aad66b08ff55a889c508726d575a2bb8ee18202dbd3dd50e686cc1b28611972110ed2a7324a1210acc7d5aa5d25b1034969926f291580

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8c4d39221ba8dd84021531d90dbe8b45

    SHA1

    38b1984882b0a1ac29c8010243c853cc04ed04f9

    SHA256

    18eff2ab898817cbfd1253da361ad76256f993d0957d0746e01a2ea495dd6f9d

    SHA512

    13df5ee565657874efe31840bbca6444d9f089cd036442ea14734d8a4268d72f7030742566e47078a194df3c95767a4ae68ff7e8fb7312fabaebc3a5d151725a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    dffc74ba3fb5bb830f8ae14a9e280c12

    SHA1

    0d2c25ac345c5d9cf0a8fcf6910f810b891c00bb

    SHA256

    398e16a2ab246f2b39e6f90e095fafe0e02e5d84bca159b1f2e328425ebdfe6a

    SHA512

    55596fa28c7e8f56f373a895853d1067fa81cd89ec774015ec2deb95137b5cf16da6164314023aa88f65acac5705c09390f4e5b0a2801e217e7f83447cb1d27e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fdd34114aed4104659ce133987330c0b

    SHA1

    05991337b7dc61015f298d56cbdeda1cf1b92bde

    SHA256

    edde7cd10672d2aa9a61d2f5318ca7543570271159e9013ad70342b801040457

    SHA512

    9945f301b4bab13a063443a902dae10ccdcaf0bb282bddf0cabbe5e5fa41b22c45ee63a0d4c71d38af8e35a77f32348c4e3d573912c7eb68fbe460f77d3ab664

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1e9356446cc8197b91a45eae789f4914

    SHA1

    fceccf00d6a1f88eb2594e2e0fb1cb1453ed8041

    SHA256

    dbb5afffb870b2722693b09e806ca174baf45411da3062b92b3f0e4294dcd148

    SHA512

    6eaffdb111abdded96440124194d95e0257f97786c3aa99422c7dc6d12f15316a4f152ec9f50acdb28b05134f2b1162a19f3fbadd353f8e77e6ca96a9a4a4456

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cb19e84c41bb8325e4dd7a55c34fbcc2

    SHA1

    ce957bfbadc3b28d0a671ea073bd5a256d5f8714

    SHA256

    ac04134e7abc4d2f89a68cba5939da54ef023af571ad8f581aaadc9289946f55

    SHA512

    f4d40870cd811bfc459a4e2b82d1ac8facf094e37808103deb17211ed3536bf513935665317659a2e9765d65706f9b17b54be8a477cb4243f8614f805bc8405a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    16f2f5d380270dc666728a70e92229a0

    SHA1

    14fbcb38e556f4bbf474c049ec16d61ea949eca3

    SHA256

    1123a0abc921eeb36733b9ce5b382fee211ca0d468b9c10cede33c337134ccd9

    SHA512

    6f7a49864cfc41b8061d8b4ea5e78bcb305840bea2e8f809141e9bae48a217591d79ee774f21e3b00d87be3d4a3f9f7f9ad4be1c32e26564304c1e83fce7511b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d51bf353efb7a67e2d19d54194de805f

    SHA1

    074f1090289f4a315f31a0303c50bd1d6ad3c9df

    SHA256

    06a42047b1bd8422201f25c88b4b307aaad8a269bd35b9bc535907d4bb7e0cb0

    SHA512

    0650ea62cefd3f6ee3c68f3679fd66dc7651543951607c2f77bf404232055c786b4732be868a5ab07cb8fcdb6d3f43c202d8cc9847886348fbb1c196da537928

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    25551e1e11cbedce65c6fc6bd26da00c

    SHA1

    a5c98baa2f1bb93b7278ecd117738cd4bfee38da

    SHA256

    922441edb7224d6ccf5c147b5daa8b0b950fa1f475bf352c299ffcf829e4f4a1

    SHA512

    e9294b9b73354d56b079cfb0004efcb1df367b3dad9719f0275b2d3c24df707747c42809b7a0cde04d7fcb8f32be023e949ab90b0dae88605c3147b68e724bf2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LAJVCBJI\LockBit3Builder[2].7z

    Filesize

    144KB

    MD5

    7db3797ee09aedc1c6ec1389ab199493

    SHA1

    42bc848028f3256cd671301991795ecc44fef4e7

    SHA256

    453eebd2dcf98e15e9ccab2c706438a9d34497631db1f64b6fe9cc3ed41696da

    SHA512

    9b42015bbb7bed0bab806c73edf43ef523e96908a501373964aebf1aa6b61952f1e4c122ca0f9b25be60fc331abc082701cf0dedeb2ee95ec8b519bef9936e7a

  • C:\Users\Admin\AppData\Local\Temp\Cab6ECD.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar6F6C.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06