Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
17/05/2024, 06:41
240517-hf19ysed23 6Analysis
-
max time kernel
221s -
max time network
210s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
17/05/2024, 06:41
Static task
static1
Behavioral task
behavioral1
Sample
Juicio Martha Elene Pérez Shaar vs Sport City.eml
Resource
win7-20240221-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
Juicio Martha Elene Pérez Shaar vs Sport City.eml
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
Demanda.pdf
Resource
win7-20240419-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral4
Sample
Demanda.pdf
Resource
win10v2004-20240508-en
windows10-2004-x64
6 signatures
300 seconds
Behavioral task
behavioral5
Sample
email-html-2.html
Resource
win7-20240221-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral6
Sample
email-html-2.html
Resource
win10v2004-20240426-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral7
Sample
email-plain-1.txt
Resource
win7-20240221-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral8
Sample
email-plain-1.txt
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
300 seconds
General
-
Target
Juicio Martha Elene Pérez Shaar vs Sport City.eml
-
Size
1.0MB
-
MD5
3afae8c2a47609e10c6caf9ff7baf68f
-
SHA1
d06635e7cc2d76efe117578f622b1e824fee5861
-
SHA256
75b5a1772375ac64561c91606ee834f962f2b4754cf1d825964dbacdcc6e54eb
-
SHA512
6985d86ef5256caef7529d4ebc2ae472ca4d73593c6a114e3832f45d989d52818f5e7add146ed62ac2659f27eb955983bd122722575f49655278193452b0c6bf
-
SSDEEP
24576:C+C/Ek/6IA9luqEz3yntdeMd3wWU9EnBu20gJVzYJzd:C+fLBDtm7yBJ+d
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31107109" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{950F752D-1418-11EF-92F1-62BC6A84A035} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31107109" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31107109" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1769479670" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1771979803" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10932f6a25a8da01 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0030396a25a8da01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f000000000200000000001066000000010000200000006a3cdc79832a1419d3c41e7e030b8c595d8e25bc5d4f4f8b0b479505733e7a2e000000000e8000000002000020000000223a2dac3fe006767a1a55f505ee5a85bf639e36dac7171e5b6310fb48dc93d920000000ed58dd4c72d2e1a61041974be591eaeaa1bd8fb4e46c5d5eb341bdce8f0702334000000036757db418b88605fb239b9992b92e0f25b8c5b951c15084ca19dfd50f969b91419240d7581188baa89153e16cd1f4b32fc6f799f24b52c07717b133388b787d iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009e387b9b7780e241bd4d2d5013251a2f00000000020000000000106600000001000020000000b3ee3d21dd50bba98baf217884e6eb26ff629330886b706e605f87d7a9f936a8000000000e800000000200002000000012a8c39685a6be5848e763d565e263edcfb6c441eb3388c727e960ef35fa300020000000a668c798c3c53dcc7562cea6c876f0e41a0b471df64cc97fcb5fb9bf3f16933f40000000d2546ff0a77e35897beec8590cf4bcd9d6aa32bd82568af83f268431339478ede2ef3c22d701f1ccce554f8de7b0ad2662b63f902a20c9ec1ee0471f8366bc47 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422693103" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1769479670" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings OpenWith.exe -
NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\Juicio Martha Elene Pérez Shaar vs Sport City.eml:OECustomProperty cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1412 OpenWith.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4916 iexplore.exe -
Suspicious use of SetWindowsHookEx 61 IoCs
pid Process 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 1412 OpenWith.exe 4916 iexplore.exe 4916 iexplore.exe 3228 IEXPLORE.EXE 3228 IEXPLORE.EXE 3228 IEXPLORE.EXE 3228 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1412 wrote to memory of 4916 1412 OpenWith.exe 95 PID 1412 wrote to memory of 4916 1412 OpenWith.exe 95 PID 4916 wrote to memory of 3228 4916 iexplore.exe 97 PID 4916 wrote to memory of 3228 4916 iexplore.exe 97 PID 4916 wrote to memory of 3228 4916 iexplore.exe 97
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Juicio Martha Elene Pérez Shaar vs Sport City.eml"1⤵
- Modifies registry class
- NTFS ADS
PID:5104
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Juicio Martha Elene Pérez Shaar vs Sport City.eml2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4916 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3228
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5ce22da433e34e64a164222adedda2dde
SHA1795bb029c6f283235b514cb458e2cb2cfdf4aff5
SHA2568019321a2ebf954425959493d26ce513e591c83ac0b989305e2791a23fac60f6
SHA512fa60949fec765d3fa4e4f6498073ec53e341d8ebd4edce9fa3f4af975cac709fdf39df78007db06ff5ff5762b166f07b515d3528e217dbfd9b37b67fc34a1458
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize404B
MD5e7a6041d6b2377c635359bf00aba0ef9
SHA1a45ac08e4a8cd5385ea0d719e883d21275065b82
SHA25656752d04abe062045661b810c5e3a431022af551dea9cd95d1b2ead7ae82d459
SHA51231e08b312afa4e6e7bfc293b5ddb178c774b4ffaff52542b65181d821445742ad5ee6df3bfbbd729a685b7d0b533a7efb514bf483b046eefe01d2fac2b9e48ef
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
1.0MB
MD53afae8c2a47609e10c6caf9ff7baf68f
SHA1d06635e7cc2d76efe117578f622b1e824fee5861
SHA25675b5a1772375ac64561c91606ee834f962f2b4754cf1d825964dbacdcc6e54eb
SHA5126985d86ef5256caef7529d4ebc2ae472ca4d73593c6a114e3832f45d989d52818f5e7add146ed62ac2659f27eb955983bd122722575f49655278193452b0c6bf