Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2024, 20:19

General

  • Target

    sample.html

  • Size

    65KB

  • MD5

    3ffd461241aa29dfdcbd307e9ee9d2e5

  • SHA1

    258e23bac5ce3841d29858beb2e438dc7ed55ad0

  • SHA256

    7abe5279dc2ae49a6fadbdec4808f4e205c3b91c718d5617fa091469963ad03a

  • SHA512

    e742b5547cc1ac736e225631deb06b9a4ee9e150773cdc783b3b8f0702b0bd00ed24e5d47d32536a7a458e9307c0bbba998d68d3454d196ece84cc0c5a9707a0

  • SSDEEP

    1536:N22hwiXkjDMLwB+yCtamjHYj1fdeTjbN5NMF6HuvvfGFaE:8iXkjDMLwB+yCqIMYuvvfGn

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1368 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    471B

    MD5

    7bde92ff965b73dc76190e608c2fbb93

    SHA1

    95547789d183bbf9ea20ef6ba4c6b2f0249fb30d

    SHA256

    821420f187b512f853c8b73d9439e940e6e04c499532561343a739717a9a76ee

    SHA512

    21406b04613e8be9f2036f5057d6d3de568ec1aa4eb6471cd457e70e6ddadfc3b988d5f4c2d316e548b21b2850944a78d75a44ec3bf929e71fe61fb6b0de4ec6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

    Filesize

    404B

    MD5

    496783cb7da179a8861e3461bd23af13

    SHA1

    be4cf8a12e7adbee69e807301cae2163d1c0cf66

    SHA256

    4d80b1c47120c34aace8d5597b56e3e98ac665c1947da19483899488fb134288

    SHA512

    1ea5e3fd6ea25bbd758527feed952e8d852e0ba6d213b85e2209252204ef96b6cdb1d9101069709decd4159612b62d71b0027485a96304141fa44278440d6a3d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\L3T8W3B4\cb=gapi[3].js

    Filesize

    64KB

    MD5

    ee01651d160cfc55249d6011a3c45916

    SHA1

    79d6121df6575974ad21dafce33ec98e3f2f0a7f

    SHA256

    639d75299973c7d3794eb7eb129e3b5a6139f9f521e1f14383abd0fd501219c9

    SHA512

    8a39dfc1ff2c58ac106225976aafdaf7befc0a28903a0c65e2c272e1967c3336af2b477ec12604400bb8e16aecee6567c9cb9d157e3d54649e28b9b2f920432f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\478691279-postmessagerelay[1].js

    Filesize

    12KB

    MD5

    92169c8a0fbf6e404267d0705cdbdf42

    SHA1

    a5cd88b74ca5ced239cdbfb458fe25540d671f46

    SHA256

    dba668b49a111527aac8f616b9053ea57c944e01a84ebdcd02a13da921223384

    SHA512

    8c5d35ea512fa7be367cd9a9ded2f23822dcce730e5502a355ed0d48949ef763eab13be0d50a66de6b0f8419d6a002c12c4ddbf20d97f5393ba922e48a4f02e2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\f[1].txt

    Filesize

    36KB

    MD5

    9d85d169ac39e32e841c9f31260eec3e

    SHA1

    531a9a6aa5cfb310c66ea5382463dd0b0904a23c

    SHA256

    e05cde0f29863290015cc8f3608a874cc33ca8a44c76faf3564e02888c0cc325

    SHA512

    dabd133fd0fc982fa16d46900f16dc3aa5e42c7845ea0a9ecceb128e7773f6a6af6afd8f8546cf9e05586c36355855137352af545dd901aeaa7de91b2f8dfb53

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\WHUIQOC9\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Z0UNWU5J\rpc_shindig_random[1].js

    Filesize

    17KB

    MD5

    f019fdda31635d2a31b151ad8ad56c7a

    SHA1

    6adcbec55f66ffaef83d9a134423aa98eb2a2189

    SHA256

    c7fc0b1526533002c956ebf8e8c42c3ad3f96c41ace73fb4063cc89051944831

    SHA512

    fc278c12316e098976833882a38c788d812f9d36bd1b9b2b8c87dab4dc906af26a860df95436ea1b7d509236d44d0533d475a153437f8f5d42653fc28a77ad64