Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    13/07/2024, 20:01

General

  • Target

    https://photospace.life/P3Y1A5

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://photospace.life/P3Y1A5
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2280 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fe1977b592cc07bbb2a3c15cb7d15191

    SHA1

    eba56fc7ea21d55c573365c7ab9035b1f860b29b

    SHA256

    09d8f07782181f5cd9089dc47a50d990b3d610fd15ca617c3e44fee45b9290b7

    SHA512

    a9bf9ec9fa74097680fe58ab4370029cc90158c97f317ad3ca19187ba5e4860535ea09e28943902262172c56e74e37bc4c37e5b865c169709cf07197fd9c811a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8a03c09fb49cef86bca5ea446be41380

    SHA1

    fe4fd2d531cc81e15522e85d23212559dacd128e

    SHA256

    8e3bce869bc734ae74371736234ab425acd2298749562d0e2f8eb991094a9bac

    SHA512

    1093e047e20be9bc35a8dc6fe682163ea169d1b384fdf20d6fcffde492228d86edbcf4f28ff9116d7c0b40747da3e2e4e46c9ff32de8cbe675a5e6390940e117

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b13be43d42f869e097ff5c181843b5e6

    SHA1

    662dbce4ff8122f166b9b0700752de9f912665f0

    SHA256

    14cbd60e226dcc32eae2459e5689ce9a0d459103579b1f8be7591fa47afc4314

    SHA512

    a03a51325fe8ae0b63bcec90bb3da0b8038d3e792edda65bc5a99dda1fc65187b0b1d845bdaeb20b9e1fa12d3523a7b3aa7e6fd08570502b6a09b9f0d26a59f6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e4b60080f8ef565d381017accee6697c

    SHA1

    fe99e2d61966f6726b5123e3ff3eaef771f4c7cc

    SHA256

    f93dc069d5a63405c7182e8dd292ef33faea42dab69ba48ffec791943d4354c2

    SHA512

    7191f0b2767ef4a1622921af7e3d120aa69b3fc0f96f149f222b84ab1eae856df03ced8d9a07971e58078a4fb40fcbef138728b892ab7bbc97a4af5f4cbabc80

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1a19004956829c66b6940c3812bd8d64

    SHA1

    bd669476de41535ff29b9156a66d42e3c5d01e18

    SHA256

    496a20772c2c4139817b41e2b15f740bc1e61f8d4771d151252ccbcf2fea9ec1

    SHA512

    79c41eb6f4f63f78c2f8bb272e0e5ad9a54bcb5280733296e32844b7353fdeca0dfb6180fc2041c271597c901b419282e5f9df5404d933ed2a716736d6d606bd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68e52a3222d0946bd46b36a3e4a03194

    SHA1

    f15e6342cb4246cb27382f04100d114ae4d3a5cd

    SHA256

    3f40488f44e4f4c38f388aab3c8ff2ee16f6e0309468c7e28d69448aec83853a

    SHA512

    883f923ca1d20d0ea8dfeafa2a7f34fd697072e04122c36d57e13a564877c71c179857c72bc12ec35896d3dad7812e998bfeea4a4ee961aca606e0392ce9fa04

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c5ba5714bf4b53322032dd257a90943

    SHA1

    7dfb134894ddca75fab93bd68c7325e14d1cb4fc

    SHA256

    89ec3a5336a5198ae0a8638682cc5bd6218f49e984d3f3ae822187e3f0ddf0b6

    SHA512

    2599e1ecd2ba7a9bdff229bc8dcf289b9ae451e9e970ac35227eb93cc86169a94084704751b7a3e9ad74d44133b52390dc05a16cb0a316f41795133f71319ec4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    463f436e37fe3caf2b9bc8ed49328616

    SHA1

    4c2a7c255020bcadedb8f968c224e7e41adf65b2

    SHA256

    e8edd2b0514a7676fd29182e47299b32f778f14ff1777fda2421efdad4e6ba4d

    SHA512

    d46faf2bf718966b8268e38e051c208c726e6714508b9c327af9db1816c56f3f45c6a6cc897969685cb7fb6ef029dc54c18637341036c19eb56fea5242d81fc7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    876da54bee7c9be12fdd6bcc50839c2c

    SHA1

    e9826765a796c0ed48c87031a4a39eb132a632aa

    SHA256

    08ea2e4841b664f226d9762c1ba7489dd3e48b5039f33a8447fcb95861e0398b

    SHA512

    b0d29903488728f987dbe56319ace00fea2ef82f347099774ea2663b86e225597493a57ec135aa266a27f986123e3fdfa5c528fa8c54ceb4d5bac2f4b357768c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28b911f9a3afdfad7d892fe6c10ade05

    SHA1

    14bf586193d3acfcba10c8cdf5f401209b50fa42

    SHA256

    295ef355e2ba791850dbda707dd771672737dac4417c5a0229fcaf972adb3104

    SHA512

    abee027175dd475e30d5a446adbe6bca48f59bec1a4652ac950d8061e9f82d5fdacf5843700c0f1465fea15f726db80b6c6da6767b3b5bc2c9f67448cba17d30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68b0ee1a299c18c9184ec34c9880d516

    SHA1

    f7da1efcff5f5124cabe26b3907b5b0daf627ca4

    SHA256

    a8d896e812bd6d3caa1a4d6c322485687095db178fb57a5e64582354ab118032

    SHA512

    15bf38223ef210311225651e5752be724fe536da0e154dc3718f489672a40aee93e256fff4a42c6858474bb5732511106e887a098fe89ce93de828b2023a0f0e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c11d85eb929f56b0ac4cf39a39ed51e9

    SHA1

    227feedf20e3c13d4a18867f39e1c39358c5e3f5

    SHA256

    7017206d77aa981cdc02cebd88cf2a356785b45753a32b61b0c213541fc925a7

    SHA512

    0fffc31e2f0ecd99f3745f5814d1e61a9dcf328a93e005e9de9662799eb55afabd19e2d210561c36c14a7859b3d856acf3fcce5006957d7a88f8fd9a7f78721f

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2F8P2ZFP\ify[1].xml

    Filesize

    13B

    MD5

    c1ddea3ef6bbef3e7060a1a9ad89e4c5

    SHA1

    35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

    SHA256

    b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

    SHA512

    6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2F8P2ZFP\ify[1].xml

    Filesize

    176B

    MD5

    9179f0555c203fe989ce0b6a4849a42f

    SHA1

    3ad038416d5a9a035e72e52f6971bb956183afc8

    SHA256

    d6554598eb82180d2ca154c825395de9a8054834733eee0c126622deb25ca881

    SHA512

    b84677b9134e73edbc36d8ad4709b40f4bd47209ce1f16f7154b8059e66fbbd861935fe9dfc25a1a932fca37c04f45b8dd834f0860971e832ef1d0f5ac230910

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2F8P2ZFP\ify[1].xml

    Filesize

    357B

    MD5

    818b196b1b91c5fa2cdcc01353e8d9a4

    SHA1

    524969f9beb5959daa95a870e792cccc6e5fd877

    SHA256

    35bf6be27f41b2642cf2cc2456c79ef7291b7a153639467429fb4fec057cc2fc

    SHA512

    57d1712ffcb3f3fb30f428cb5c2c4869832212298b4b12be0516f124fd395a1d2f31d7c15a9e60b098ed123db6e6f429ca4ce23693286840c607b4a7f70b8f55

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2F8P2ZFP\ify[1].xml

    Filesize

    1KB

    MD5

    176bfa74c927799c1aa92660626a994e

    SHA1

    a6dd2100dd66a0dff5bb20c031608e16b6779849

    SHA256

    2123a502a1dfc6519888434427f4766d178ff9f62fbf4f9f2b7d1ab2b3076e93

    SHA512

    0eafa78494e82f847100b8bae7552a6c5a17233423c7bd9987bb4ab40ad9acf35c29369062a6c0afb09cfec911a1b729d56ddba822991ebe53d20ed1066b6737

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\2F8P2ZFP\ify[1].xml

    Filesize

    2KB

    MD5

    fcf3c8b9ff21fa68ea5c2cf760c1daa7

    SHA1

    1b8e44203e83c32a8e00a96e091fff893c983991

    SHA256

    8c7189484a311445e73d66f1baf8bad684dfe4cdeb5ed97d63dcc2147f9c6999

    SHA512

    ac8340ba815410caa01ae43e9bbbf870832f14a19ae733168bc852752d9b9185bd7c82eb450be46dd71db3787853a964da21ce65f668dded524b0190e753c6e0

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\85y7ywt\imagestore.dat

    Filesize

    15KB

    MD5

    ae7121d3f6cbf6c8a3c56d22912332ad

    SHA1

    540ad58dd87673ba2826083c3877818964149574

    SHA256

    f4c71fd9f37966db41dbcfa6afc23cefd60cfadf3b2a9f1becc09f4cb90c5bc2

    SHA512

    4b42f6279223bf8b1923c3ab65c9204b8f8a7eb1c734fd93110d2941483488013570d9ff2f6e546c327093d01d7c9abe5cea1552e838abda0b90ea0f082fd310

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\favicon[1].ico

    Filesize

    14KB

    MD5

    de5a68ecf1315791471000eea42de65d

    SHA1

    3f3e7239d7ec1702868f51e9d28e528c6c60e984

    SHA256

    fb94090003c3fd820119448548cb3f11a37304608d1f7401824111f53cfbe61f

    SHA512

    0b5b8b073714ec8e0cd1992d722c669515ce589d14f4dc224e9c1830c4aa8d3473c441758f8128f381607c85acfd015b1fa0f271c4595c33f4d162eab69f2501

  • C:\Users\Admin\AppData\Local\Temp\Cab872E.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar872D.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b