Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    295s
  • max time network
    320s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    11/07/2024, 10:17

General

  • Target

    Neo/rapidgator.net.url

  • Size

    244B

  • MD5

    ebdfe7586f6934a83c1e013152afbff2

  • SHA1

    6b6e01b9ecfc72478ec8c11b54f374aefdea2e81

  • SHA256

    124a3fcc92c88f31683f8008b95eb372b9b645b1cf985785027404a2b5aeba47

  • SHA512

    67c4e85c587d20ac42364c7085d5513ecd7ff3810c082a3f3ec3da81be2c85f3f27a85c8c261853c7276848fcd046f10c0ad71ee853065e9527a6316583e2e3e

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 43 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Windows\System32\rundll32.exe
    "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Neo\rapidgator.net.url
    1⤵
    • Checks whether UAC is enabled
    PID:3020
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1268
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1268 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • NTFS ADS
      • Suspicious use of SetWindowsHookEx
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199

    Filesize

    170B

    MD5

    24981c90fd74e95c4e98030a9030bbb5

    SHA1

    b0993740e9daf00c37689e77f90e3117bac41610

    SHA256

    991d241cffd235807d1ca3989fc93fd1ea47c2d4040548d90c14f0698575a90f

    SHA512

    9a75d4cecc23157499976ed7b59ab3af4090abafee658ac9ee4e2461fe6c34a2dcd4922579c26c9b2171da8dcc40eaa9706848294ea8d0d4ba5a740b80a51f05

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e9c494d78688e713a37bb514650a3323

    SHA1

    bd1bb66c30a4f7ac3ae634d5ce4370c6fb0760a2

    SHA256

    5b382c7f41e7b0962939f92edd20ce363e92f9b5ae4e1c7306a5c4f4cf9184b3

    SHA512

    b89ab966a79a98673c2dfb6b5643f9b38150faf784c0da42df6e7f53b8d62143106cc6f12738d85ba6c7a353a3d47f793df1c374fbe899a20982cb835646c054

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    75de096f109d7bc93719ccfcec7c7b42

    SHA1

    9d46b690419cb58c345470bb128243b11211c224

    SHA256

    ddb10193b7b17974e3e3fd2abc4bc8f8b63be085d4b2dcf2f403b45892d76df9

    SHA512

    c14686988f159007a06269834abc0d7d66ab515f0433e4f5101be681d4297c5d6540b3a1215df48bb8caea328425e496e41854825e0431987b0b1729dbaa73ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d8df9bf3eacfc832197cbf0b0ecfdf04

    SHA1

    129e9d49acf56e6c9ce7bbe398712e04cd205298

    SHA256

    1bb013e0c647ee66b4c3df03a09c629aafdd36056db07bf3ded690c2f3e07afc

    SHA512

    3a3c8121c66d59e99aa2d131c23ae3831d799750ce3b4cc6e41f8351d7ceab1862db2466ce9cfe94812ff8224a35aef9a0aaad7d04290507307502a1787d82ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4ca88751f6e24fe30190c1aed981c38a

    SHA1

    23d9e70d43a426af4331631d1e6328ca82015355

    SHA256

    b85e8f1c59dfb67991eb085cf4895296ecc8f456cf4931112e01b34fdbdaa5de

    SHA512

    e704e626effbc1a45faec681ef52134230c000b3f0f594e8f79de0965ec5c507ef866707d7515f50b9d8802c37ccdab86a59e8f913433943cbaf50e0c59f41aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0116798713b49055f5cc6792d33f605b

    SHA1

    1f9c5058c8fce1747594ba7d05ed4c899f51df79

    SHA256

    fdaf33f07198737bc7fbbb56462f4f3eb59832f82318c4b8e3bc298e31c3a047

    SHA512

    a69affaadbc70c910b6632ec9fbbf36db656600cb27aa868bc119891760eb5979723e6fd2d85a022c47d895bf3bb6b64b663e4c73f2faa57fb116a9e9619a5bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    485f3e3c5f65ee6a3dd1c8c1f10bf7bf

    SHA1

    28813551eb5ef4731cd84359e9698348ab7c4579

    SHA256

    2446faab2d87a93f685897b392d6fa6789702b33e9be6bd767a1941cf65c9bdd

    SHA512

    0f905d36285b8db9bda290736b8aa883b3d787cc673b0560ba67174600da3465badd99f8cfa6d8a01bce9802ab58c4813dbc4d2046ed51ce023a9c09dda66daf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c25087ab40e98e68d310738c688ef373

    SHA1

    e6f0c0f2ee3411da4559fd37c8e46fa690c539ff

    SHA256

    23a7bebfe283d557a25c65f55696430a3181aeb203a10a87e4ad03ac2d30a96e

    SHA512

    0b1ca757e50d74f9fe31adc02adf54233a1dada7b57d86c30c0981240a9057d0d55ff47381c20147f4568d69b516473b1438201343c4b1d2c33ae2b824ebec45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d3b41b4974e7326353b4a9fc8b904a25

    SHA1

    a6709882a74976704e5eed69994d4fbb3f17d50d

    SHA256

    41ec5cbdcfd5d35ac1435d5fc34294aa6002149ef55d0640e459c95c6df5a283

    SHA512

    7b81af03d7d9115c852bea41cdc0c5d16d549bf6c4306ee32af271a87c47ff6257dee0ba265ad8d540c1bf52ed23113a70019f1d2ee0a039273108be43a343a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c50ddac540963bb11af28cf1803741e

    SHA1

    4551ff5e5184731728b63f767d66f2f57f6b4f56

    SHA256

    29ca02d8f4434474b2629d2494e6a37d58a7b1908447002a26e00f7a297c75d7

    SHA512

    bfa84c515808c33a523be01d992bcdda69e0b70c8a5c9cc7d4aa917431b290da4340b457084f540021bb224d454f99431cbc40e430a1874933812420ba1ef330

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    84eb83c8a0ae1ce7fb5c1c38ba91bd90

    SHA1

    4a66e3dd856bc1478b8b0d94b749cf8f14c05ad1

    SHA256

    7891b50f904e97dc50513ae8b07e75c067210553345dbacdf0403bcebcfcbc27

    SHA512

    55278700bbaa7820bbc6162b9ef41677aa703e99fb61c402f8ae31b8a1403360d84a4b645634c7f1cca5eca828e56a8506be3bf7bb30a470e8ad4702913ab896

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    963b28d4038a2059d3fdf67df122eff8

    SHA1

    470576c434a57f67eb508b69290aa03e4265a182

    SHA256

    4618b22be433e55fa9e3c22d74f3bcb1962c0bad69c95bec5deb7068d8546152

    SHA512

    6a7331e2fe97c5db5450454856bba148bfbde68c98f7c979f2657340bd5cf901fb69ea31efd5b1be27453f714a7939163bbe14c43cd6f3f4f6440b5d47147131

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bd990e3a2e3fe6fb91970d4b88cb75a8

    SHA1

    3d284433dc5a063a1d05affbaf3379b3f960b5ea

    SHA256

    9dcaf1cb4bacc39d415529a7aae4a174817f56a6936c5db163482dfe51a8daee

    SHA512

    162d08b387221559272e476808da33427abe695693cf6bd06912e5e7881ff843081ca64b08d09dae4af8e091adc6d0c5432f3a57d4017f57bb20656c8b0619eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    86a526ab47a956ba805141e316072e5f

    SHA1

    2eb928534967bd7281f0837a14f94d6846c15fe7

    SHA256

    74e0d2f8799e24a0cea99148c9dc4db3b37a127abe597879a28ba79f8311beca

    SHA512

    e1cbcf6e7d16b0f04bfb31dbcdd7f94cf951a61b8c59c85254dc9809ef5d1751fdc5c45a781ff3c9a90db67d28edc6f5c0b3477a7c0dc5d444c3c98e82c4ff8d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    aa6df7796b09261e3f5dcc31eda04b7c

    SHA1

    247c894b2945caa3f2638d7e5e944741189e74e5

    SHA256

    0a2bebcacaa5ae4ae9bc9c6b1bad63d66eb7b58118965def81bf3b04eee10c25

    SHA512

    d0ccd3c111b7439d36110a35203e178f4f5a8fbfa5f5512a81ecffe920f863efdb89576498b233ed4f6f5c1542509d5eb521b2af80c98f3eefb5010b93fd2890

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0d37705aedf0a630ea386292993e9aa9

    SHA1

    e6be7f04372456a0d88caf26f6fe99035bfd95cd

    SHA256

    bbd94f9b031c8105f449b9e28712d6cb6d00603531ab3d1f10453963b5b1ebf2

    SHA512

    3c36b52c20daef9841c770747e12d34f3a5945e28e42bee24ddfc6171decc3a954ffaab1b59c9da73d2a750ddc15c36b486978e368b50668daab9a1f385c5938

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9058475fe1e76c1d6cc408941e914ce4

    SHA1

    dd6b6d9b4a92b0e0633b341d9414c8b08838b166

    SHA256

    c750651800c7bd647c5c64c290f1d7a1dd63d7c30100d8cc229545f4a8797353

    SHA512

    f2ae49c1033833eda6cfccd3efa02c6a86cfdda5aade2bc7aeccf72dc71ba70ef4b9b766235badd49f647ed158f90eb463d77d8a766f58ce550ed98ae9cbe220

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d8bf9f6ef56a34b140d9b16a0890f8e5

    SHA1

    27fb982d2e70e529fb3e9141cb36206d850031a8

    SHA256

    dccdca7c6b31a5048f5755c5a14b2a63819426fa0af78bce199e52efe66b7535

    SHA512

    845ad6479aeb16de4a5bd5e106ce2563de4cfb3802ca49e258402bce389fe912bf942bb6cb437f65c2beb7d68e1d61b020d9e136ecaa3d4cd574e1caf03ecd0c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    939a48fe1b0210d57970c047fc91ef77

    SHA1

    033ef188a4d8f20e7e100832c957e925efc831a1

    SHA256

    d5f3018f3aef6348252944b905ab04adb26fe2e06099fafa7a22255d9efcdd06

    SHA512

    1e9a7c16f705fb77a14d5637f3fddafb016aacd90bc8dff0bfa215ca07218f7386b85fa96387c43820bc8efff9e4b250bc1c5ce0128c1620ee77247222013429

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4b71980976eda664829f525234db88f4

    SHA1

    dd4bb2cf133c2ff991bb2c028dfccc72cf5d1d73

    SHA256

    902372d6026b19aabefc3229d59fd6ca6517a3d5a2f938b93b42b6b42617c675

    SHA512

    f8d449698cf03d63a8b1de8b2b9fec4eeb25742b727d9211a2aacb541256dfa67f8257ff1f253c970e9399974343f711ff4c1bb09a0aba4e1076f33788d1b12b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    151b732f5323119a389c1b086c6814fa

    SHA1

    e0650325aa64b45a6702d682533e78ad0040ea74

    SHA256

    a54220602fe3cb3c4504de2bb1c56efb3266ad9f6ea52e7f51e3893a123df53b

    SHA512

    6488479b92753779d75fb3e3f76dc9bddc4d195055c3def38392ce60d8bc0f6d7a14dd96740406949eb558ef1c475a8e56e049ab91b37e5b22e48c6714c7b25f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    05c96dc68eae570ab538208b4a547aa7

    SHA1

    ce78b225cf05f795641429ad5350fe6d598f63b5

    SHA256

    1291449ecb7cc818d4b6cdf0fb4667501f52919007aeeab00a3138cbfa5e3fd1

    SHA512

    9c072e8e2bf7ba250b07db8546edc8bccef3e3b68d00b8deeb33d9083366673c8d005cb5783b8fcdc8721ffea637f116f0b28eba6c565332714910d940983395

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\K3G9BIBA\www.google[1].xml

    Filesize

    99B

    MD5

    09f5efb5e2c8c955e80885f859117f40

    SHA1

    bc7feea9bd3c86ee3b9a2ef978e375ee4e1ef3a6

    SHA256

    b1a7ab935a3612708b439a91790e54c01681dbd0e2e00e115979c45f2803eda8

    SHA512

    73badc6071fe7688192d7f6ccc3dafc386d4adfb720d736a92a2559c9c9a1bba3c30bb02e525589355f84c9c08cfdd98ed39b538d50ed59bb9e095b47ca7b0dc

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\p6d9oj1\imagestore.dat

    Filesize

    3KB

    MD5

    7262224da30c93693eca3037d69303d2

    SHA1

    02d04f28e020f4883c2bf4143496bde7a98354bb

    SHA256

    96582d5de916d35235a48bf50f14d20038f3daff5e2cdc455b0f7760014c6232

    SHA512

    4544d9ddcc34c3d14e6625720acb4d4e8b6b6515352b7e81a10edcde1b9922f9d9632d709f0993f7866e8acc1c92ed9115fbee2a55b9875ee549f5edc616dfa8

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JQ7VMQEC\recaptcha__en[1].js

    Filesize

    533KB

    MD5

    93e3f7248853ea26232278a54613f93c

    SHA1

    16100c397972a415bfcfce1a470acad68c173375

    SHA256

    0ec782544506a0aea967ea044659c633e1ee735b79e5172cb263797cc5cefe3a

    SHA512

    26aca30de753823a247916a9418aa8bce24059d80ec35af6e1a08a6e931dcf3119e326ec7239a1f8f83439979f39460b1f74c1a6d448e2f0702e91f5ad081df9

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\SPRIFH8L\favicon[2].ico

    Filesize

    3KB

    MD5

    cf1faa2e6cdf8c78f971d5927d28dd99

    SHA1

    ec9454d0ef9fa07eb9dd38d44131574fbb4f84ea

    SHA256

    9cd57803d93fbd183de40d1007606a3c30f90fc82a205c7abf4c12d322b7c144

    SHA512

    cbdab9962c62568ee07aa07a00e270c902b721fe0248b88bcc1ae8dfaa8bfe49bc77c40fe87c06ca1cf786dee786af85a45e13c88dd85a06be4a5e71d4177ff0

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WK27LCMU\styles__ltr[1].css

    Filesize

    55KB

    MD5

    4adccf70587477c74e2fcd636e4ec895

    SHA1

    af63034901c98e2d93faa7737f9c8f52e302d88b

    SHA256

    0e04cd9eec042868e190cbdabf2f8f0c7172dcc54ab87eb616eca14258307b4d

    SHA512

    d3f071c0a0aa7f2d3b8e584c67d4a1adf1a9a99595cffc204bf43b99f5b19c4b98cec8b31e65a46c01509fc7af8787bd7839299a683d028e388fdc4ded678cb3

  • C:\Users\Admin\AppData\Local\Temp\Cab23A8.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2429.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/3020-0-0x0000000000560000-0x0000000000570000-memory.dmp

    Filesize

    64KB