Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    28/07/2024, 23:26

General

  • Target

    server[php]/theme/small.html

  • Size

    529B

  • MD5

    4a37792461cfe27187b5d9f9a29ae43c

  • SHA1

    97c04b747c2e11e24c7fee0f93cb0c98e7803325

  • SHA256

    ad945266a275784cc8c711ff9fe2650da6587d851245e04a45db8af46b34db58

  • SHA512

    10ebf4a1935f076ae9faba0434eb6dc9253bc3b96ad3ec8e0dda8d3de30bc20d674a10d0f4feefed1c6924145834349ae33efd33f0e9853d1721b864083b698f

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\server[php]\theme\small.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2252
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7fb93a88f1b61b2f1cb3b827c5aeabcf

    SHA1

    88d5c2c7ad30161ba01216fde0491a0bf18b7c0f

    SHA256

    a432dfa60aef71bb9c7ca9afbf8d1e225bcc08d070670d93087328626562e091

    SHA512

    a048c9ea7dbcbe1bc9d278bc3bbbf56b26f09f491b3204e28827f899acf3ef26b17335735be61bfa4d2e7c322d1bba963b13b073b35db0537c8ca52aebd5d001

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    01e15d7b34b7e66f4da9eefeb21b2022

    SHA1

    c78dece13e69625dde5c71237d8c66bdd77eae27

    SHA256

    9373168fc76e35551dfcc076eff81634947e1ed4ba904c258236f7b7b292b9a1

    SHA512

    7b5d579f8bcd43888a223e5b8984c5300601e871b9d73f59ca5c92afd47eecdaae42319d2825117244c55859c5b6f4c31368b3288bbc888142087923396e9d2f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd5796ac4b61c66b6d32156d4ab6b310

    SHA1

    50ebb07c8c3117f82cb8d7040ab3fb46d1cc9687

    SHA256

    aafa546b6410c714ff04f49f9bc4ed907ddb38a77f5685c09ca32d19b573300f

    SHA512

    ad4778fcb7f27f5d8a97897277a0ee4315ef0392abdd4ac944d49c454ba568dcbfb1068e3411ec30c13b053292d7d1e0bcd0a0b56a39b1eb1b4df3c6bc300e12

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    084cc24afb73679163d79667d3707aa2

    SHA1

    48147032eb538fc910a8b97c71b210ab4bcbac76

    SHA256

    540515185e374cc375139f0e6f5fbb68e743c323186f3a5ecb6e7ca07d9e6d20

    SHA512

    284036948ce897578d4a31b438f96030ecb641fa3260c0cd9d2a0bcdf28e98455c825b7c701362f51c91b3e8525c4c6768b893fd4fd4cca15fa210aeb47ee98a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2aab67c46cda22ecf7dfbd169a89b9d1

    SHA1

    a8e66a4987f6f75dae971f196f387b8362fadbbc

    SHA256

    1770826b71c464ff916fcaf6d03da0895e43e0de94f01961b10c2db15456e5cb

    SHA512

    3a1cd38b96b950c27b7b65445614df3710d3b4cdca9fb49c53d4e60ca048085ec547afeadce12d1979859367e41fcb7b6bcf3e3c46cbe11cc2e2c481bf74a1cd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    db14806c98e4aff7b13b784cffadd0d7

    SHA1

    9f6f34e4d587b089d7e33f7b48146005daeb7c60

    SHA256

    89d45454ec03e00a528bba6f3aff3c216bf13a2898beb427739f2b906bd5d693

    SHA512

    b5a2eaed59d91fadc27c9ea10827e1eddd2b09dabbc0a5cc2669627077c5fb1139d7a73e2ebe8af70416097ab193a364c1abd5dc68889e4724664e8918e2b036

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c6d338c7cc2f2791f940924f4ddcec99

    SHA1

    fc74b42ac70eaa7cd125cedc5e52d66944b89daa

    SHA256

    3b31edc5a0706a57db963fd954f90ef9cec88e121dcd670ac24ca4dd003dc6ba

    SHA512

    70617e6452c1baa925404ad06a465274da5f32ae424cc35ed55af7265d120308a7468921ef58206430e858165f9ecdacd57b1c78435c69e01a1b25be299bb64d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8856880c2005ba202ad6ad0e0f0ffaaf

    SHA1

    79d733407306741e79055a92c237e95642c46683

    SHA256

    22caa135ab453d3e1d1879c00b2208e49b78ca8a6e623bd847a79b016e23a30d

    SHA512

    46696c1db38718415b5bb1f5c2181030547f61a6b53976718868e2c9a346aea0346771aaa390d99530588ee51e18c64c184999e85b12240f13c7ea14ac728f52

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    259c33e587e5c3d2df0e4eaa83ec0f88

    SHA1

    80b5bbc1625d5f1dfb5948fd486079fbb65c9530

    SHA256

    bbc93d55ed528516fe8ad122d3b0962f468a554f8d32c08b6cdc231fa905e325

    SHA512

    258aec13db642b3ede392720e81be1cff35a3de19e2d5cdf6000442ed67f9e9dd03715a219d36b9852edcbd2b0dbbbe240dd2297846aa54c6ece69a3529d3dea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ee740cfa1c6377543758d7135f11c50

    SHA1

    f0b177c29ff4e33a36443972eba399463adee470

    SHA256

    8f7e1380844f209409c1140b76bc18f6c4a909e0ef14f2da8e28c61f3f4095cb

    SHA512

    a3e78e527f45ef6399cee6f23d4f0bd93b8284f92b4fd99bef58d06d53593a48b844b770d86313cfcd70de5d15416f4cb6884ff74f071006309f267835f296d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    74604e3ac29245fdec9eee830d59084f

    SHA1

    205d52d242e24b6d4b44fd13f91ddc36f2bd92ee

    SHA256

    050b7d58993d975f356e2eb521c46d592b325b7cf22e2430d29ea67c778e0716

    SHA512

    092bb3a26f816ddacf6680cfe201e3d3893e2c6d58f56ac4ab10cab629a7b5a1b5d8a08a88781c5c08b6b2ab1a32e0d25ffc81e33a9b7c803545f9b2f9751849

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    247260707e820f965334ca434a69c798

    SHA1

    122fa147cb413877ae32dd70c7322fb5204427a5

    SHA256

    7947fc932315bd8c0307874e448b4a1fde3f73d0fd4bc3bf0246b7b57f15a0fc

    SHA512

    404c57ffb9210a59e33e8750c4554b1ec6ae6ea4f892002876ee92b86d82bd17e512d329afa2375d2f8005836a7f324b2432c1fb93d48bb1f5313592afd1094b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6d9ea6f0453fed7ea3288ebb49a202a4

    SHA1

    fd5a470fad54204c6108d1ab6b13b30d56cc7f1e

    SHA256

    17cfb3d8ce7d55d4aa77cd39f1a6323e7567b03114b4a0a252437b2d6411a43c

    SHA512

    ccf254fb2af51e30ecdd7f3b2c8dcdc22fd738aa7d9f589a4b18bd9aa9ea55cc1cf9d2d9385e0541490fcc3c49334a0b96651daf6c0ae7e26601102660f54a13

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    340e43fb0996a60a8c4dd0f45a7cdf1e

    SHA1

    0e2330a3a3eb8d240426d1392d04abc3be201663

    SHA256

    a7bd54e5c75a5c6b5f43dc3e723a057af174f692783297712e0085580925203e

    SHA512

    537c22fed374c43e8e83b0298fe55bcf5f75e48d86d2e7c49fa0fdcaf964891ca0de5100b105fa56c81d2b03a94ce3124bef33d01136feeb26d5021d7cdb6b34

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5df1f084c0eb3638837b58a75c5d8821

    SHA1

    50316826bc9808c103db3412441a484129f07ae2

    SHA256

    e3709e5574b75f298a4c2cb1d748c26325b8d90cf49f8461664c93e166cb9928

    SHA512

    e6891c570ce656fa7fe088c2610950b31d672737b910463fd990ce68a60f9116ddbd691747dd2df624d57ea3a6a987e4423437dccab75f9223bfefb8ed4e5885

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9063c4f28b3dc1fc99f74486f508c037

    SHA1

    c52688d1e014aed20da9d2b65854248720213e3d

    SHA256

    033be5aec60e09147ffefc240bf632568872f14da83fec632b09504ec813af4c

    SHA512

    d6ca64328a016e53b29c686c46f57623d455062106e94f80040d763a81682ec70c3a01af8ed233e93457990f11e7281fcc9791b03e4f3e17dc27985187beee50

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ef0f8269421576e9416184c964ef9cc8

    SHA1

    72f30b21b9dc0eb0d0cd6f4121359b9f0e45f570

    SHA256

    dad6d1adfea59c505b1b0c0e6e47b6f7efe27eda92bcc50f3efcb353404609cd

    SHA512

    1e382735b38fa884c1294226cfd74f31832162f7a15e03222fef220fde85558c9a576e7d732645779bdf03e40858630ecd05f967ca33b985d36dc00db4ea2b04

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e7c6521be54c3202784457c41045caaa

    SHA1

    482faae0e9637e0058fd16cfabb27e3a2f5c6309

    SHA256

    e52d60b9ab75ad25f52a3d341d78751f2bd9ede167147f27dce3bfe956a38a96

    SHA512

    99ac392f9ca1986882d9659644940097c9c84b013bb0a5d3f2ba0e56aa0e7e5dcf9cb8d5d924eab0839d510b85a35c2dcc40327dc03a7deccb700b4d1b0c5e0b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ee586bf3ea5dd483fb66a4419dd18dc6

    SHA1

    cf213d4df375decbb41c8323a7d855c1d963c430

    SHA256

    afb363c490ae17fcd9acb0d917dca429e80a2ee2b7963eabb5883c069eb0f86e

    SHA512

    5ecafbad456ed55668de467d91bd2e2001fe05185fb2024d24d714fb2180e2df23a9fa69955c1d576fec03aac30cc6febfe4147592febffbad145fb8b928051c

  • C:\Users\Admin\AppData\Local\Temp\Cab9770.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar9832.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b