Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/09/2024, 13:30

General

  • Target

    efd2d4715c956707155e2e86be3512f4d7ef4513432e1e3b2e2b6f990f5b1f6d.exe

  • Size

    7.7MB

  • MD5

    85f964c804292f4e27d626775c81026a

  • SHA1

    b75203888f898154f86135c4951ea3ff5c6630ae

  • SHA256

    efd2d4715c956707155e2e86be3512f4d7ef4513432e1e3b2e2b6f990f5b1f6d

  • SHA512

    5761e9cfac03068f3060a0bc6de79984dfcc6816889b56b48364bc061ec94208515ff8592aaa27f4ed41f779d64c4079c98e2bec74c1185d5977e17324a80ff5

  • SSDEEP

    196608:e9KkarRADq+S0KW1zJ/of7Bae2fY6tRa7Vd/m/:EzY+S0KW1zJ/ofEVAVO

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\efd2d4715c956707155e2e86be3512f4d7ef4513432e1e3b2e2b6f990f5b1f6d.exe
    "C:\Users\Admin\AppData\Local\Temp\efd2d4715c956707155e2e86be3512f4d7ef4513432e1e3b2e2b6f990f5b1f6d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=6.0.33&gui=true
      2⤵
      • System Time Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2804
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2804 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2540

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e45c3da6a6f68f9ed29b82ac8fb07e01

    SHA1

    b62094011470635128f0759f6909caa8856d183c

    SHA256

    88ab8b49395643579046fd17dff8b4bb35c419bfd140c91ccba72b9992b3cebc

    SHA512

    090eec1b1f7e1cc8560da82126332a76d62772c4578eae25628522d81e21e251a085ac12299fdcf02d2928f143e0387e96c9758220d07841adeed1e2124e76d7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    34cebbfa867bf9ebf33d4c199a64f92f

    SHA1

    87bee551cda0609f5babccbfc055b86b2c0ad904

    SHA256

    dc21696fac55dffd7bb42b88d9d12625c3007287bcbf7f7f703c838a53536f03

    SHA512

    51a4156a3d9d7e30538766b27a97351113b19cefe4098cca640b475ff3a7dc82d612074309733092654fca1b81549c054304e1ccf29ca51ff9eb77b74fda0c59

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c9addeec3b3b529d419515144350695

    SHA1

    9afd1fb1429d246c8e1203c6b0f565e3fe91a232

    SHA256

    822f3edb3400b36f43ffe6919d71c7a22ea6c5111f14eb433186f90cec8c3466

    SHA512

    12fa185a3fa4c2692f9c338494039d78bfbfb8201502b820efacc94b6fe095c8e2a1f6cca82ba152ff88a05fb97fa2483b1658c83d6d65be228f8d45e6d07142

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9ab2d87cb3682a479fc49543ee4d3029

    SHA1

    9f430e7a6c78962071b66ef41f52b320619839f4

    SHA256

    c7367ec4069a3b887510a0b133d5e0f16c42fe18aaccd36400a7f298c15a44ab

    SHA512

    1748a0cd99b373998bc236c8729642803e0bbdd3f64eaf67ad0dd0bc67bd39337e4397c92eb29d32a2c429a91b7870656172532c4f7b75c5b7b44fabeceb06fa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c3e402db5938223d13de9d6fbdedaac

    SHA1

    c2bddd55749c8e1b85319bd3471fb50e2e46e635

    SHA256

    24521d7ca606e59a1b94d1a2a88ea8795430a40c44d79e3742af13d055cde106

    SHA512

    7c838a5bd9ab5119d0b4478419650e0f940d0f07af3ca84c4bb6149aac66fa1abaf60332aa0489dd496cce704331c5278d9892c127e24ff454081c4ef3efadd1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3a4c859bdebb8f9ce954394f8050178d

    SHA1

    96dd9c659a809e5e4a406db1acc962b3566d1a96

    SHA256

    47dccf1397f815169f99e85c14fb6d86401697aa3cbae684a462c64b3e950f08

    SHA512

    e67f9bdfb8b09c622e5f50b853a9bcad22900f35092dedbabaf8e5782ab71ca1f56348a7f3cf522c47894c1ec652fc176aa8bd007c77c0310512105b0f2b23fd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    16a7b2da83b4fa14e7bfe95dbeb7ad14

    SHA1

    918c643dc068ac26fef0687615fab8d5ab55658c

    SHA256

    f4e01550680c9de22e015eca53a1cfe7f48892d70bab8dca01d6e8a69999ede4

    SHA512

    96d6012fc7128bb51acb6dc8d1bcf05d4f6860df099f04351c678ff903ec43a71aa638441857ac7367304260a0b48817f65e5d510bd876198caec5e74bb8610c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    42ea2c9b2b7e40ad84984723d3f7b185

    SHA1

    c987f505900c2a196a525384e896c1b5c86cd45a

    SHA256

    fcc4813eb99bab90f0646e7c7bd0c1b8c3e36fc088de4b4cb51252ab430dab61

    SHA512

    ade3e6f5c3ca9a1537a8ca27e7d1b97c461e5a9f950c5fabaa5d2f4a54b16a2324261cb40ef6a538a13574dacf7551b415cc22164143fdd4e5698c50aa646ec4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    417b0f0190bee1979ce82d2c6a9e2a05

    SHA1

    6ac83ffa77b79566e32416f33e23321b29944a92

    SHA256

    719de71f7ce6be996cdf96332280f06c7d6589974e295b3514da82e36cfd876f

    SHA512

    d8f8c4509806fec915b1d437bc82365ecaaedf1187c9cdb6b4025978bf9f185063cbf15b9d69aed7f188237fd4766be1b1445818a51929d4eae33cb1910ca757

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    08c1e8c859d2456bac21001f143f95cf

    SHA1

    8098b4240adf3f4669945e1fc6c9a69d310b1a2e

    SHA256

    3d60a015801deb21c7906c28f4e4feb23d04b5b55aeebfede5f3e29af66d5c0a

    SHA512

    7bdf4cb5897981fc21cc148d1909ba100b0965951c38dbeb899f5e0f0426814661162f83612029cee7eb2e48a309e90660bd560f20c9c6829b8d162b45cccc67

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1a69ac7d20687763d60b502bf832dd8c

    SHA1

    53574c4623f5b2a730426cc7b668ef996969e5d0

    SHA256

    02e43612a1b63165c86f044c070ca028b54ff6745657c1a91c8dce915faa62cc

    SHA512

    c6964c9c261d51e95e38cca81ae5f5345e3d75191f2b4e30ea1d7065d7ed66bb10754907ac6f67f87a7f59c841af7818fa722233ef6f87479ce0d38edf8fd8bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0b4e76641c260b68fdc659cf732e0d23

    SHA1

    74a6695b49f994c652c12e1396808e94da72cc1e

    SHA256

    7f809d58b51f5245ca75f464f273362b9ffed4375f24662555818259d2c83624

    SHA512

    fa87ec5be0a21d2554e423ed7f3e0f62599e18dbb6c9e9a17016f2c331953ae2b3e3ced18a1a8bbaaf2828c84235b71d5ca9fb5233cd0439c5dbf971fc7d5af1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    afb8172ceb56f71e60e2156bd1163e04

    SHA1

    22a3fd5139ff7a0637e625c29f6472b29ae302d3

    SHA256

    7986e32c30a9a905b4e870f6a2350dd55547c749375075a1cbbc2710a0e0f006

    SHA512

    7014a7884fb29b4140d0a019eecbe74e139a9a9ab3344bf299a0c3433ab142eff857baf8f3ea957cddd3734db03b39eab33c0fdd26ebf6e1ecf91007df5f3679

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7cd8df70719b4d8cf094a854b1564fdb

    SHA1

    d66c2da7bfc3a10b50b56355dd09cad2f7a36200

    SHA256

    bf879a893beb8a1ccd53e4e398ee93dabfbf9ce41d87ec8c63c9ba72717546a9

    SHA512

    04b8545e9cadc15163a606b7138e830c948bab5916362b7d91cef48505a7cb16d3982c4435554664b8d153fd20c46cb5a476f07d1471a6ab26893ac9dbf9fc20

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    28e6d107c6845a71488714fb0bdc051e

    SHA1

    5e9effc496966cf7a55c75d6f86720c862d177e4

    SHA256

    549e8e84e606965b480521c3b7386812379485b46c619a6dd5adda9a0c151196

    SHA512

    9dcfd5802cb12a7f2247fe886a5e89ead32e0fa358d4a9492857196fea7d849d7c61e83602505bd8fc212086034d5fc506385dd76b3648c9e16f381f5a561607

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9dd4651564cea5b194e12accc0b7fe7f

    SHA1

    11acb42a46f022449f46b9ee6bddf4c7cf7971ef

    SHA256

    36fb6bf16d79819ec0a89f62c52733e8f39a16c47a1ca8b05da100682b15c11a

    SHA512

    ff55507d9beb3563fdd1acbbf7c75b5d265e6c10881152a8c195d118ada8aba86a2d79a6db1dda8418dd9ca8b31d43af594a6a8dbd0f975e946fcb559011f578

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    edf99d6f1350b828abaceb45e28e63b3

    SHA1

    9b04857de93b7206a3098a67915d716c089c7f06

    SHA256

    05944ad6d61ebd3e70d672d952adde2ea077cba5d2c786cdf6254228438b4b37

    SHA512

    f263dccfce66a0a5f3454c540341893d42eb22fb597f70fda839cb2218f323a7de07e6298533586f86482b56c41abe2b06cc36e3b9fc41b691be68358752523f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4707a0ba28846233acf52baffc9d31fe

    SHA1

    51bd87892c9799d6caf9b71120735e3535931923

    SHA256

    d0277d61ec561ce4a5690be2712322d821d718ee4aba63127c8ef642de584348

    SHA512

    8c17fc24a433adcec8279e7d1d3e80b97a54bdc1a60cd17c2b12d23016eb07dbab9ba5d6b71c17f1b027ebb111713c9f19d1adbd409e5263d511677a5ec9f1e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8496ddf4627ecebed82a31b8ed5beb22

    SHA1

    36e18819845ee464cfe43e2901021289a1616ce8

    SHA256

    ab02ef6fc090c59c2dd24ef6d5520ff53b75e4ff6d14562ef0f02b2f6806d8f9

    SHA512

    e465a2623bbafaef5c2706e5336859399107f007faef39a75d72f776f18275088e4c238ed35b374806a7a8385e38299f232c53c491d7fcbaf1dbfc37c47a6339

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    66dbb474d595a84043f32015eb899fbe

    SHA1

    a8129edf7438b93fed3b91ffea7cd2077480e4dc

    SHA256

    ebd7133cf78f9b06415597c6f80b2cf79f52c550bd1e8ef00e71edf47e3c36c1

    SHA512

    6ef79248c9dcfa4c261e3290428d3973b994546ec96538b4a957640e8c2cdbb102a97284ea618e7b756501f6b5a683605b29eb564d82a4db7bfd6e1a9876245d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b7c569d7d41b96aacb86be44ec87f140

    SHA1

    0e4f0964b1c3f869cdd5703a7d5c0410feeb5c66

    SHA256

    935517ab237cfb7289e809d4b216c0aedc09d5931b1c08e437a81b01123bcf22

    SHA512

    3b086adfc8360da7ecbe7e1e0a1f8cdbaf0056848679569f40168043b4e4a611335311a774d9afbdf29c8eb30eaf1d6534e6fec0269698338acf77514f5ceb67

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a2a277c368dcaa880b06269407751859

    SHA1

    c8620c814ac493e261cc8e5da5acd422251cd583

    SHA256

    49d0fca8062f49fccfdacf96c4e2a66cffd5627932746a4084f7b5057870fe40

    SHA512

    a4c3bb67470ea7182523c9a6fe257c0d8db6d548db40b861c303f8562da74f78838977d82e29832237b8b45accff8db67adee6af07028cf41123e9cc8cd96961

  • C:\Users\Admin\AppData\Local\Temp\CabB57.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarBF7.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b