Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    03/09/2024, 18:56

General

  • Target

    elk_cloner.a02.htm

  • Size

    5KB

  • MD5

    4ce6c94b7e6ecd91d8ee9b12e39962aa

  • SHA1

    ced9b8adcfaed9d9634b7762e78099f8fd842c6e

  • SHA256

    99f144b6525ec8efb1913389db9f71217bc0e937a80d060ad5ed187de030b5f1

  • SHA512

    03bd622d4ab2277b2a226c30c42a62692f9e217971f57db834accc493d8969b97d26ce96a96ff324ade224d1426107db6418c28ef195b34d39bd6632495bfca8

  • SSDEEP

    96:Ge5py7SNjUJ3au65dYkpdVcVjdXfMC5uqN0jMQFcREYdGkgEHvlpPaLy6Df:GIyJ3qdYkq12QApf

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\elk_cloner.a02.htm
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2684 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f91bcc13ea379b736b6e010f8ffedfc6

    SHA1

    f77e815c05a23056640a9a373081504f4deac392

    SHA256

    dea7b9f81fcaea999ee31a0bc8e15b9cbefda284265fbd4640ff36046d36ff91

    SHA512

    2decd37b60c38de20a77b1051de81e6f2cb8a7ab9659f3accfad85ba6865566ed6bc2e86eb29ca98ba7947fec7fb6ae11f8876d66dcc5b1efdd84623a7d13615

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    faf366e5047497152d00249ac68b971a

    SHA1

    6b8f9c3525747905dc5f48bc0c86c5fec6ba36c8

    SHA256

    396f2a1ca2c0d8c3de6656d0ad6acc8012e371d21c8f6a3ec450d0ba59d28a7d

    SHA512

    4178c2648aeec6bf2a017eddf036869de753b07b7c3dc9ab9c7a273512d3288bd36155782e8d111f385a9e57b875ef906ceda6a3bdec6fc57f74b20ada568ec2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a9c2144f7949eaab55a1263b6aa36fc3

    SHA1

    67e6e9538af932e6fa92bb88cd8e10a6c6f15300

    SHA256

    c3d9129281479572c7e5189b0810989454accbc951b3b570f082584db7fc88ec

    SHA512

    59fedb3aed62c84cdca52aae8ca77b860c8962d65a1bd0c39db173cdb73ff312d59e9e23dffca0c1ce46927b2f44462e5c45c2ff08b070dfc771d9b7fd5adda5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e6abdd1869cdaa7954976dc876c0148f

    SHA1

    da2458e356e425cd0953b4d7bdf2df2d4b51e3e7

    SHA256

    19b632a800a0a7edada069c3226315a16db083a243e178cd91e33929f4893ad3

    SHA512

    6d64944682f0db63724515051b48e1c78fc05c739aeeba0d34fbac961976abdde15a328f92e3dc9afd71f505e2e822d17b11a246bc28b5c7915244b897b7cf68

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    429324b5a5720d810ec90d7a589c6787

    SHA1

    9eddb13c63b6a6f1d2366422ddfa56ea51723e1e

    SHA256

    750b19adc3daadd80b6b75fd61e6d2a12c3c3b00c91d94a805c151d9b7256a24

    SHA512

    09b7ceac9b1a27ddf370161ffbca77b183062b87c5b27757afb30ceda1a8a57d352aeb8cfb033f54e75c71ed5770daa3e65ae48e82017e4cd098386f568daacd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    57bcae72bf1f25681e5483f02b063bcd

    SHA1

    1ddfbf2659e9e493cc70a955bfcaa75926efa98c

    SHA256

    8f72ffdcaa792151da7b13085b4c30de94699b6eeb0fff1f4b14d5f2efbf6a1b

    SHA512

    54291dbaffba3c130f51e07dc935c14fe0b914affe15e23a942fc4823b6e262fcef0bb0839094a6cc0ba68309f88c32de54f3d69838782880dab5f0bf2c71349

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7d30f2416027664517c15b19c035051c

    SHA1

    c2949e11ed749698a17827c6efd73c65204d4b1b

    SHA256

    1b1f76fad7062528fa9e480e6dc92a45e93aaefb5f96a0e7de9793643ee12e43

    SHA512

    7edead2ec95fa1bb4faae68f5d128a7e809b8b01b282a2791498cfd79f8a27f5fedaf5ef462f1b3eabe9f70be8a3b571573d13ee8944b3e965952ae29dba3443

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    71dcab43fcc20aef846bc60f2dbfef0e

    SHA1

    de5f18861aa79bfc2b44fff8c3c79283bca4d443

    SHA256

    1c1f2978d254c1cec3efab64bb5e37862648982952806c4bb9592cd49e594544

    SHA512

    5e646191bddb173b5631c559596bd9c2fdc07608fe03f28d26d8369f66adda1cfb05d8dfda3802b931a8cb4c6d5d483fe5c699d742fe86a144fe4f67a3d0c67a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3942006f716abb56a1b5ea42e47ce236

    SHA1

    8fa7d1615f1b26994179dcde73a5908dcc6eeaf7

    SHA256

    ff863c505b4eba7d12a2d9e7ddd91a24fc24b4efd886eaa677ed7c06a7367b63

    SHA512

    acbcedf395a428b160b0681a172a9a3f914c53cd10d58e51a92cb1fe7fd67ab6b60f046ff73ed152cd5e942346d0796e392caf030d0942e58c6da76e2c1bd657

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cf38a5bb59ee65bf476b793a2b6f46b2

    SHA1

    c6c09299b58e847703842f634cde30fdda666dc0

    SHA256

    85cb2cb58aa1a3cd00bd579922818ad20bb5333b6c37147984b255edf8c594c5

    SHA512

    7f4b0fc4d9d28a94e9121b523c28f62c4a2025fec5b3ab4bbdd011a9fa9b12185a6271f8893a84e69f5f31de82afe3cab865932823d6e0da6a11a061e6d1aa3d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    08d53458e3a4299f9dc8079c20070fda

    SHA1

    9d708db4cce2b10956865fb67bd6d82671702976

    SHA256

    5b8c09d85a177e0b18e63831a683ec1c48e688c38bdb9fd5a65db4a7f84cd732

    SHA512

    b93ac16c54af3e0d98c68773f78e1756f8a649c4396cf8405c157a501060db61210dab3432dcc6ce5c08a47856763a285a807738b2fd093f3a278a397ccc3416

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b625a306a0d6417cc879d5d1cc474fce

    SHA1

    b2b1bc3182d30152d884319c5143d8cfcc5c8cf8

    SHA256

    af910348def1df8e4cab2672cf9f55ccbc3e7c8d88e08580096f80d42a88e911

    SHA512

    ea530a1027e6e29493160c744bd403f6e73f693d7e52b87bf16a0cb64ac5ce20bcbcaa8eb5ff5dd5952237264f76b67813db14889a2b9547f2496ab59c15b196

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    bbeba562977096b75cd3ca207b1976ee

    SHA1

    9a0c8722c3ddc80d55a33254ffc42aad620ea5fc

    SHA256

    b3e63547850258e92e3a05d578625d5bf55661029cfb47ed9e3f123ee07c650a

    SHA512

    2ec16677be8b03dff43e855314b909d90ee51cc4f7b0deb87ee8c34bda121cff910c48ac41becaee8040418010d87e1fdbfeb19ca720af0fef3c04258f19ea42

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    428b49571310979a44a2ae5f7d2ea7d5

    SHA1

    58f9b76bd826fee8c1a7fa98cac99bdbca7a4ac0

    SHA256

    9e08dd2803cb3bd15305a39a0379be20a6bf3d987cf2d34f99fe4f7644f01b2c

    SHA512

    38b12c54171fdac2d15bb67c46ab44c7a3eabcec2c49d817d677a6dd2479cc98e3e9a2bfe70fdc8e20ac372b9f3fd59e142897291699b885e1a5596cfe1e72fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    41e974792be66e92414f7acad7520c0b

    SHA1

    c2052dc42af863e7955e94dabcec0e13f9cb20f7

    SHA256

    ff7760a67caf411992593bee43bce98a1cfa99edf9d40aae073190ba2d56bfda

    SHA512

    a98e7a94a9217a6fab1566208705f38bf1a16079c161bb69ff5cbb7a07349a1ac3f18ea3e3881b90769f2b535107e1993f5fa5046904d67dc92c723f0eb67033

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f4664cd983becced15ae3e4a94d64d11

    SHA1

    7643b57e5fb9db88799ed7f247628decca3d4b0a

    SHA256

    6c190973312c821ce3aea29901b7dce2a37c6bbe1aab522e4f323aaf0ee29c11

    SHA512

    8eeae7057233d50ddf0828bc71960dd41891b2a758ad570d34b68ad9d1901070910b7d3cfdf3e97409b91ce04d9737f6cf9205b4919a8f84124a337709d10bcd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d8eb7941d584d4d5475a03f94f5527eb

    SHA1

    6beb1eeed23c8122cf9a3b37b2dbc3f4d683d257

    SHA256

    5352ad6d54036c5982f4c98dcad82685510bef9fb5795958c7a62d3416fa02fe

    SHA512

    b6190eeac5da755a1b8c52ba73b562c8a2c5afebcb10677e4aed2c7339be6022caa641034da9991f25a34df07e124a3ab1a15facbad9573b0584af47cee48feb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d4801970df24e86e8b37b97bcd75c1bb

    SHA1

    efc0655fd0f7e5f311a9a64c326f89e2434f2cb9

    SHA256

    49f3b5b221f06fb84c49cce0c7e58fd6dec70f5f12314b3692886adaa4380189

    SHA512

    99417f93b9e383fb4f43b2f1e016df0335240e1b2f45b9528985f5da6e0a745061d806974552569dc52ccaf3893b20fe93c188e0543cec26c43949318bb1dd1d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fdc587141d6b9b3798118cd4fc37d256

    SHA1

    e6e92f8584700cb82c5f699f86d91301a1c4f2e9

    SHA256

    76c05ee4f854c7b53071fca44152c1810ad28d7b48ad006eb92e4fcca70ff392

    SHA512

    7f89b4b755221721d467b9f6ca45421a1556f33df6647e996dd680435d872a0c215c889b2d7655c29a9c01a20955299d6e7a7e499a597dfa8123b2b432759e33

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f2840c8bb8fcd1f453dd06b1e378d774

    SHA1

    d1bf60f5b12779926f262c723c0b29f2faa4c8f1

    SHA256

    ae964756eae8b7d5594d4194afdea57eb3bf5fae049ef6647ef425932ebabb31

    SHA512

    39d77a7d33ae06b803e877778fa0b120c2d5a634252d9c310385e4dfd8e0e1492d5b81048b02f41d771ed60914cf977074009ed878a3f00c07c46aa225ad2028

  • C:\Users\Admin\AppData\Local\Temp\Cab6210.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar6271.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b