Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/07/2024, 15:26

240726-sveplszckf 10

26/07/2024, 15:22

240726-sr1snszbjd 5

Analysis

  • max time kernel
    127s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    26/07/2024, 15:22

General

  • Target

    022-CITACION DEMANDA EN SU CONTRA -JUZGADO LABORAL 04 CIRCUITO ESPECIALIZADO EXTINXION-02.svg

  • Size

    365KB

  • MD5

    80193d67d0da94a9d928fe4bc5b3a7cc

  • SHA1

    ec3b1f52e184dd87dfe9ceb2eb5cdca6f96f5dc4

  • SHA256

    6e6577761b13f6a42f212419a8fcca10f35ab9315f24e9be39c8fc5cdfcfea10

  • SHA512

    b376e9152c6ec0b45d8e9fa7d4f298a8ddf2d873c3b42b3f7d60704dbef3c7a4967a6e32fef5cd8fa0019bd6176401c2b8fcc0698437c2ae8082bfacb9088957

  • SSDEEP

    3072:RCkLBpCoMXyV1d/Cl+XlwdgrJGwS4BHKlgeJtonukwUwPsWw5wzwQw6qmPwOhuqZ:RfBpCoK21dE+XlpJGwSsKldhLsuCY

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\022-CITACION DEMANDA EN SU CONTRA -JUZGADO LABORAL 04 CIRCUITO ESPECIALIZADO EXTINXION-02.svg"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2240
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2208
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275470 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2320

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

    Filesize

    1KB

    MD5

    55540a230bdab55187a841cfe1aa1545

    SHA1

    363e4734f757bdeb89868efe94907774a327695e

    SHA256

    d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

    SHA512

    c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

    Filesize

    230B

    MD5

    9940cc0734df41063f0f02b093251c89

    SHA1

    50fd2e8f1cc9841106b34b1d0271150598e4b24e

    SHA256

    dc12c0e371c0707d08adbef8eca7063e9f377604fa31bae8f2bbc178da62d5e7

    SHA512

    e8b5ecf0d1082835cb7a5fd22c2f925caa4632e1a78ce7241284a92127aff8f8774de93c15d3669a3bfbb6b98c70e675ef791ab6dc91a52cdb9b0242baf3474d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ca20c1fba507a8043cf2417d4e6c564d

    SHA1

    f359fd983b0331b6cd370a6b96542327463a96a5

    SHA256

    fc649072c2fc1bb40e0cc676e4d342965c36111731bb4e2b6e3a309745e30f88

    SHA512

    2286b6e6d270be696d6c9164efc02b5808a4a2da441396c5c2caf2fc17121ec73367d0d127c956c1e850d143a51258e609fc06106f4cb7343dd9d48508347e4c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2bf1014d210a7f144985dc24ab396c2f

    SHA1

    3f5245a69eb200b9147d794c58805ecbf8b752fb

    SHA256

    89088a96f90eb4e230ca3f68d3130e6ea19637c0d9a28496f9cf2bb75f62fdcf

    SHA512

    85998630b5f3813c75dcd1f49df3d13da68097bba805a50b11b0cf400bf838e208e937bf5d0ae91cea0aa72c285f691bd6b54cb547c1f289139905fe544137db

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    eece3efe969ca7602b88d698cd4d3343

    SHA1

    3f3d0b5825491552c4eb52de5e39688359074072

    SHA256

    2cbd63b63b30d5e1fae8069865de98821061da30c2ef4ace968c6092c518142e

    SHA512

    c882732b65176bd7b784f08dd0dc057afa22fdec891c29d66a6b53495dea967ad1792266535aefb78e5cf5bb42a3417e4d3978ce53c7c8180795734504b31430

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1785336461c7948cba269b12317ec9f8

    SHA1

    5d09d694e7007c63000153a82a999aa4b08bd84a

    SHA256

    db3ebb91491a63702c58dca4c9a68779325f83a9347a3b4001cdb2684d27eb51

    SHA512

    89e34f77993496ee3e52d097f361d47fd0af86f6805d76fbb1280883b86f3ca930890bed162882966255098cd8b24f337f35b8255e14c45314c975d56cd10326

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bc8e783d6370db6270a5492b29489cbe

    SHA1

    5b1212c1bcb89f773860bd69913795517bdcdbab

    SHA256

    80ef8b3ffd92e36bc3fbedcf06bda68146c24410d81d7661d15dbb957aadaabc

    SHA512

    7bce5c86b3ac7a2f55ca0472d65b511906c7c1a6c851c821a3afd4c20e08a686ce9d5d8f4530891c5ae6ddf2009f22529fa49cef956e5131f1336d70c663c8aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6687297f61035407e0d1c3ba89fa4c05

    SHA1

    7a3a70581c260a2ee93fcc28ce3f788343c4dfe8

    SHA256

    aff41985e037f431a889671b77f8d8705e45d6d59cda989407df87b7c0d9cfa3

    SHA512

    4bdbd116c2edc5e95c6a669234c7605e2c02afdb032f864dcbb428c9b92fd6f6cd33e5fe360d8a85169eecc20f123130763186c230469e0a407e07f1022e66ec

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c1468c25575f0e192a6cd33c0394fdd9

    SHA1

    be52fb191536699f9e691633adb225b4a96ae533

    SHA256

    616aeeefa16fec123fc9a330f8c6de75e393985af9d37708d1d95c70d22f1e93

    SHA512

    a3d9120770927b70b8acf5753da6ed861377246e99d1ea5049bd35c046e2f5e259fba43b8ccb0ac37ce2e3858b503135c72e58b69d2ef0578ebba943c8c080ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d426d56440043b92912447d32c46edf1

    SHA1

    08360ebe3e8bbc51f378176f674dc4ca9c45b22c

    SHA256

    82cd63b5cbc83c3aaad3f54c18055a5ab422d293130b04601203240d70408a7e

    SHA512

    20592be87f56af90204461bfd2ba4888e7a8f26117f1fcbeab72c93d0f18748ff25df0f9b9d2fed0041b6ceae0966221f1613329a0a2bbcc1a657d68812f2d9d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9abe47b1b3d7a732a4770d0f514ec2dd

    SHA1

    09917d54463b26105a1e52a3e98c5f69fd7ccb87

    SHA256

    2af9a43591f421eb27c7ce6263ae446ddc8c4b36a32f1978cf48869815f80547

    SHA512

    f5b188c8915d82db55e08b4207c3062def8240e37b16cc5c887ae94fa9754393fe9a41ad500167b843b50f0c96e26b592ec9fca1e8de4ba87c4946fdb488c4ad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    551fdcd093265004b452d7998a563656

    SHA1

    fbc9e50670db1d2cc998266d7d8340a562d12df5

    SHA256

    7f1b3f1cb4b8005bae63fec5cf25a1a3c1871c6f1866cfe347dd8176b2375892

    SHA512

    892593948706c9fff298e5b43602ec688246a223c385bb7af7c8144c281a48917b8101611b4500a332e4410d81b9efff4d5c5b9a564d5f09bc7f41d9d1e3f817

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c30628ad5380f7e3d54bc699556d291

    SHA1

    6f498d2b2139e3d6aa4a0b86a7a003e68c71a4a5

    SHA256

    05aa30889a45b5ebbee4329a4a85d5eeff0bcbaf5d643a21b08fb33affdea10c

    SHA512

    c2426bb6ad00b099a405463b05c17d3fe0ab37b4fb053a38700e15027e33c1b765eff3c19eab81809ac20eb9fe855b0bb3170cc3aee8c0a512fa84cb525e6629

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6517981459fe1e35ed949c7ea7a95691

    SHA1

    6f74ad1f3a8eae9366cc36559db8f6e189302046

    SHA256

    83561a9d02772d1e7d59e0bc984a77216a3b73a3a31521847abda3c3bee25177

    SHA512

    c825fdc9474229e87f67d60f322a456d986dd4b4e8d1b7d49d4e27ca2afa1f70a342228532053a1bd40dc4e406a32709e8a793beead2dbb2fe8c35c7b3f51951

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    400f6f14c9b46d704b17fa6bab28694f

    SHA1

    acc727c21f3c3481dfc452294ae081ba399b82ba

    SHA256

    1d71b2287e0c89e34f368c88200966c0a23d108f47f519bcadaa64955ef54667

    SHA512

    f2e1a61f87bb04f99a3e5f53992c2acbb076aaaae60104e2a79f42925976b44192bc1cce717e7e9a0ea8e7b98cc74ca175fb077a49b32086e2641ebf84dfe638

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    501af795cdc751cabdc073cf25bc5614

    SHA1

    5ace794f037659dac5af59573130f9112942c52d

    SHA256

    ab1ed33aabb4f0975d480f1095de7a53e817cf1f385e31042bd39e2b6a5053e1

    SHA512

    b8adc78000e94f8070e24d34a17e9f7bb03770ba7c74d10ffcec37ab6552c396b30fb381eea4b8cedfc52cc78cdfcc3ca9c510f08b0a5d9f99ec05088fdd5e11

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a7b8c41354936a1daf7ae99dd03aab37

    SHA1

    cab89802284e16b562e547a56883db9f67614114

    SHA256

    6a2031c1984f97f740dfbe66570e5e8800bd0b88b54eda69d35a4cc9814dbfd3

    SHA512

    15049480945d56a55beaf35541e37647a6aa14a4b9ce822b112239e678aed5a2ef0e389e287571e96938a5dbbb83e5ba678064f95ce449bb030ab7bec5ebc822

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6321d82e35f77b8d91f8cb55cb6e4d5a

    SHA1

    6ec004af378264f1cd16adfde19ea09e1a85fb47

    SHA256

    606dc8fcec1b129c9f84e79a44eec8570309ebe2e66b35618e381bf6a131afd9

    SHA512

    8db7cc7c51f13bab8fec6e696614286ac067da5e9faf3f6cd6885c4881df79969b84a0939d4c1342dc8cce15bef551b8585af9ca1a77fb350b643a337f6e2904

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    47191b73873adf9bd7f3afe4a856d730

    SHA1

    2a79ccf0e35790737409bbdf6e2507ab65d716cb

    SHA256

    94124c6b45351eb50592c1ff092a6cead34e4596b8c8fd916f75a8e2086c4f59

    SHA512

    2b3e10f6e2f7a50cbb1b54083f56a04943c2f30e7a4c38927fa830d0db0630cd23bed266527e3654d448c16c78402e54153dccaf2d8b7e4fec0195b2b23dda66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a3ae32cb49a9109a922445befb9462f8

    SHA1

    44e909e335b941d7ae2f734ef1128743b53b3613

    SHA256

    bc2d045171136ef7e800faf5c05a0495b7269772c89ad78f62ddd215b1ca6b54

    SHA512

    89f00aaf10dae021a287d6969971e81cdda38ec733b26692836bd815b65e8093b2f00a00c82d143ed67b281b6c97effecaa6c5f37898543643429441cde139de

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7c770b6b1dbbeec27a129066cadd4feb

    SHA1

    363501d7b20f5b5cd492555f9866a8444882b2ba

    SHA256

    0bf8eb47725ce128d7ed1b57e8200466598e4eb3f6d1a5362d1bc6de6e3317aa

    SHA512

    a03d9746a24c23f0677a359ab9147f1b0f02557e273d4399978044956d069e03b0a686c8abb9c39b7da803460078711b1df3be1ec4221c4805e540541e81293a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    430ddb4c7cb7f23fe4be34a3cb817748

    SHA1

    1a9001d95a450a9b26cbe61c42709785f8410106

    SHA256

    d8fd29f4c21e2f3c4fd3f7a8aa59cd18dbf45a7bf73b5f04beb410845e9a9e00

    SHA512

    d6f855acf2c17d954169638566f0e8364dbf1c09d8daa70b1e0a433c6896ac5d0d15b6266f1139f14da08ec1280a6ddbe33c3cb69921925188089eb483b1975c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    715416c24c8d162b997e622cb5e0f834

    SHA1

    2b1dfa98be09ad6da581bc8e374dc4776b797bdd

    SHA256

    85b3f5a917bf0b1938fa2d6d327242bda7e25082226b4af4dc2fadf12391fc0f

    SHA512

    fd296996688dd9aa1e3f982df842de724ef915225dba9a5b301f04734f01f1760aaac7012d66b66a9f10c04c8cfe6e67045260218032fd1290fc4e125940c032

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28b016e293dd46e482e2713b366b6755

    SHA1

    3ea1a1f1e8983cd949270075eb053ac2c30b8e22

    SHA256

    9e9dde0e685f8e127b501864f58cabbdca82cfae2bcff369aab9ffea9aeb5522

    SHA512

    7671d5a4607a1c077f038a70a4930d81ac1a19d874618a3182c890889b8df8a97256e473c745020227225011f5063fc45aecefd2cb5c0c06c3bfa1660123ca5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    276a0219bdb941fb0ea4dd2ff13b2ee7

    SHA1

    b7e9821acdc835c054d45caebf654c320277fda3

    SHA256

    28d3c7ca95459fa88b5835bbe68e5fe25f4e0f720e9f4758464a99d6f1e0f96b

    SHA512

    a7fe4be1e061612da00df4c7d56427e5c0fc6492d5360f962b55f7158f9d1741db7d4e76a2e39479b8918cfdb7e407f960655d7f4f0e158dbe9563260853009f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5c5449eac6f9879042745e2a68ee808f

    SHA1

    36f6451f075f4a1fb0614f928d460faff9aa066d

    SHA256

    fc18095de9d13962f70afb2fcd25c5747721eb2ebddc0a39835e1828d5253e90

    SHA512

    a1372780f4e09e562dabda1ccdcfa89edadce11c44428b728df2f6affa9dab824d021a13e80a15156a1e9de25a7885faf6d5544d70747c3fed2bb1ffc72fbccf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a9947b1716a8793a7e927c0281f3b21f

    SHA1

    b38c0001940c9ed9211499484ed7d5f746d4f6fb

    SHA256

    e195228fad4404568a3e51afc244bac02b4903db84979c2ad6a449f11d21dcb1

    SHA512

    71388676c7b4941256af15380a24c8c8e523404196176bf624c161bd4fc533937f0b85c5cba7f14eff82c746a57914693aa2c5d35651d70243bf283f73c30c51

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ljg9kkp\imagestore.dat

    Filesize

    5KB

    MD5

    ec6e79f4c93748cf3d5c926fe6d45ba8

    SHA1

    3f4f0e29904b6d6a76d5c0a6eae9ae7d967e4a2e

    SHA256

    bd97d27bb507cdebf17b9d69456b7782a013dad31d228c14f0336e5ad58cbefb

    SHA512

    003bf6b0505be2797a926c186bc6489d943723c5b0f875e92c946ee9162b11b0ded9c513d4aaaf9dfaa1a2a372b94be9ac2fbc563628ca801ade5959c5a850be

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\favicon[1].ico

    Filesize

    5KB

    MD5

    f3418a443e7d841097c714d69ec4bcb8

    SHA1

    49263695f6b0cdd72f45cf1b775e660fdc36c606

    SHA256

    6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770

    SHA512

    82d017c4b7ec8e0c46e8b75da0ca6a52fd8bce7fcf4e556cbdf16b49fc81be9953fe7e25a05f63ecd41c7272e8bb0a9fd9aedf0ac06cb6032330b096b3702563

  • C:\Users\Admin\AppData\Local\Temp\Cab2EA2.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2F31.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b