Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    283s
  • max time network
    211s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    26/03/2024, 00:03

General

  • Target

    1a91249d-7c73-b2ef-85f0-e6d843eb264f.eml

  • Size

    86KB

  • MD5

    956d30af97319e9abeaa1dd796ee8697

  • SHA1

    2da5c34ba6a03d12b44e2b63238227c78abd823e

  • SHA256

    12ab3bb3b4a831ebc3373915070648ff3b9a4e4996f076362f1c0dd7f7aa7790

  • SHA512

    fe31e622900247fabbbda116a1abc02ad67e431f2408aee9aab83cb5c9a6e133ace2520bbee6eaa66fc8b87d9864e48171dd0915e151291491e89183518d9329

  • SSDEEP

    1536:kl6hIh6zPQqcCIq8bvtobWieJ0AKigpZyzsO14MTjXG5c3DXPYu1KYG:kxh6zYNHoKdeXnkd14yjX3AQxG

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 14 IoCs
  • Drops file in Windows directory 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 26 IoCs

Processes

  • C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE
    C:\PROGRA~2\MICROS~1\Office14\OUTLOOK.EXE /eml "C:\Users\Admin\AppData\Local\Temp\1a91249d-7c73-b2ef-85f0-e6d843eb264f.eml"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • NTFS ADS
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:1656
  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_pdf09003420640262400142660000008e564.zip\pdf09003420640262400142660000008e564.pdf"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1480
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:1776

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      1b726c2486341f4a9805a7cf3d157084

      SHA1

      8ac65f241e45f245fecc148d98535d06836ceb93

      SHA256

      e1780a7444dcea1f2efcc37152e9f7f0779b5b6e91b0aa412c18fc8398afa92c

      SHA512

      6e5c402a4a2c37f7a4e1cd59f4144c3d3494221d63caaa86d42ae94df979abdc44383ffeea5501729c1774ae4ed1e45474f88422ddc593d37e396e5d73d7caa9

    • C:\Users\Admin\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

      Filesize

      240KB

      MD5

      a8d9046c22b916e2258190422e3a78b8

      SHA1

      9a3f42985ee35563ddd13d95f85bb6bc3b63bf4e

      SHA256

      23ffbbc599271af521324abb65d9329d499c53af49548022c8b1a526872b4dc7

      SHA512

      2fb938d7b8a0896800f5926d768ed7e1b80b9a2f1d801df8944400ecae1e365d31ef9f6189250a80b533e730e881f82901737e635cfc7c2f76344abc51cd3a75

    • C:\Users\Admin\AppData\Local\Microsoft\Outlook\mapisvc.inf

      Filesize

      1KB

      MD5

      48dd6cae43ce26b992c35799fcd76898

      SHA1

      8e600544df0250da7d634599ce6ee50da11c0355

      SHA256

      7bfe1f3691e2b4fb4d61fbf5e9f7782fbe49da1342dbd32201c2cc8e540dbd1a

      SHA512

      c1b9322c900f5be0ad166ddcfec9146918fb2589a17607d61490fd816602123f3af310a3e6d98a37d16000d4acbbcd599236f03c3c7f9376aeba7a489b329f31

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\S4Y6RU0I\pdf09003420640262400142660000008e564.zip

      Filesize

      57KB

      MD5

      f6c5629a8eaf5f2fc7817870421a36c1

      SHA1

      dbaf811e3aac42f135fe6b7fa23972d92ce6d2e6

      SHA256

      cf6166b83834e03596e4da05e8273246600233c287efe7d3ba3a0d8783df3de8

      SHA512

      d82005f5915e985ac947f69204b6002eb10c0affd6b93c1cca4fb80ba3c403622d0f79dab155903aee0ba8ed59e1761d8e52740de4acc1459e85a6dc890cde25

    • C:\Users\Admin\AppData\Local\Temp\Tar6EC.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • C:\Users\Admin\AppData\Local\Temp\{D20B5759-F273-4652-BCDC-623ED30FAAE9}.html

      Filesize

      6KB

      MD5

      adf3db405fe75820ba7ddc92dc3c54fb

      SHA1

      af664360e136fd5af829fd7f297eb493a2928d60

      SHA256

      4c73525d8b563d65a16dee49c4fd6af4a52852d3e8f579c0fb2f9bb1da83e476

      SHA512

      69de07622b0422d86f7960579b15b3f2e4d4b4e92c6e5fcc7e7e0b8c64075c3609aa6e5152beec13f9950ed68330939f6827df26525fc6520628226f598b7a72

    • C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

      Filesize

      3KB

      MD5

      1866d47e57dd77dc6be1c3961db89679

      SHA1

      d3b0fcbb67643abe39f8daa8e293e549d4fba830

      SHA256

      300a32d70990957f6f83c3be169086ca5746abd17c03dbc27121388e96ffcc68

      SHA512

      1501dbd39be81ef3d474f0e5ce21c735dd1c93a11b308e28713decd949e0cb1dafe99433d91731c6474a495f7f45d1ab59942415ed3dc69d9d5f23fa951299e4

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • memory/1480-208-0x00000000039E0000-0x0000000003A56000-memory.dmp

      Filesize

      472KB

    • memory/1656-195-0x0000000073A0D000-0x0000000073A18000-memory.dmp

      Filesize

      44KB

    • memory/1656-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/1656-162-0x0000000068D71000-0x0000000068D72000-memory.dmp

      Filesize

      4KB

    • memory/1656-1-0x0000000073A0D000-0x0000000073A18000-memory.dmp

      Filesize

      44KB