Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/10/2024, 03:19

General

  • Target

    rBot.html

  • Size

    5KB

  • MD5

    4ab1163fd4f833a48dc2f35af08307dd

  • SHA1

    1fd7769a896cf66a94f8bc46d99f9478932f1e30

  • SHA256

    844378f6b5b73c700683bf5bc03320731ba2b6977ec33a91b2da3a0abec577c0

  • SHA512

    b09ecf342be2941fca578fd177902f1925beff26dbba79ae6f8b36352633769213c5e24e0e17184db234764b137d5cab69a510ec95c039bc282d3e8795ee3730

  • SSDEEP

    96:vOdMb3eZpHDFNW1VvHCgYb9DW+gQmOITbp5Wg0:vz+53AvCX1kO+zWn

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\rBot.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2948
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    addc5a49c01f4594f2f1e402a5acfc0a

    SHA1

    3d725bfbf8f3d463cd1d447937a51b9b89fc28b1

    SHA256

    29103b81d8e31b87634fbd5d478f276302d0d883f96bd78b83438d2090173e2c

    SHA512

    3752961120d70d472e56e3cc8855f5f7831883510dc92e97ac03fae9b25354b0b63b9a4a0743dd631af944680908f949e9a2c5fe60f450dcc9eb123d13cf0c34

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68d2f207f6090f3feb4b50421ca4251f

    SHA1

    e1da2346049664e0353196cd0d206647ae13f2b4

    SHA256

    1dfa5d2cde995505ce4aec2b95d3a075516991436737792d88acfe807cf1330c

    SHA512

    636c017dfb6e3fe9db35188ed86d49882e8f11501f4b7f495710be9ac1bbb28b06ecafca2d34a32dde205dedb4e3f2bf15a1b2052c4a285bfa69af64797e7163

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    efd3a0677a6503df5e416e896092278b

    SHA1

    28475ab617bbb7777018d7009b48cbda3526b75b

    SHA256

    3d281cd413d69a7c236b8ee85a47ae10131edaa4f12722c8317dc0e850500eb1

    SHA512

    dd922e6b282663caa518e0173550bd5bae5d6532c91c41adb8fcd28b90f5000d336367d3a0a1b9941455afba3d394928fa4312cdf754408f1328bab3fb211a9e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c465bd3720571a9ec65896b01c02e363

    SHA1

    2bfd65f47f036ca0611221ce0c72799b964e2680

    SHA256

    fdb187f7dcbf5248eadf7876d48e9f13fffa6d5709d973392f47e6d95a7ce6b2

    SHA512

    e370e7de3f0e6be58717fd285d7a122f792b2e1db887e9bf9497b7d03689c8bf074bd6c23265faccffbb4887d733ecd3f73596575d3e1bbf5a25c5f9b1770e70

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0e1bcde6a487b1edcbfc4f0f31c3e63a

    SHA1

    c2acd335804e8fbe5728172a1833029faddfcb87

    SHA256

    6833edb99eebd4d312183c8454c989df77a3ba33693359f78575effc98fd5c68

    SHA512

    ff74d3ce3f01b5a39e90521e04fdf6e30b8a1a43dc7dea9d11d91d28aa8e4f60ff91d05dbd3e37af06f9df47a17ce0d2b889d7a858a231e73e9a65989f06003a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fbe22682a29026afcd75a507cb74e928

    SHA1

    ca7cda44bafe77dbb66c0dac0964ec44a873ad56

    SHA256

    bb747a3bc247a7f5f13b24b61931a891b35903afe8a24aa166201cb81f5def2e

    SHA512

    16a7b739e81ccddcd1082673c00b60558a0bec1187a87b4edd27f546aefbf94b6244183a6f43a04886aa46d6c272895c5f8414cb45aa3e044beb05b2414ca1bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a57745d666e43edaecbe66042f4e70c5

    SHA1

    bff785c000376862fcac63dad1da5ecc2218b121

    SHA256

    3357edbd7f2cbb42c433aeb716fbdd7ebdf9900294994b23bea692fbc8cc91c6

    SHA512

    606e98e630a5718ac8e409a0a39e37a81e70e2a5d15fcbe662f19ec139a09d8727a228337e89cdc53985af00d7ff7b0578d3cdbb8a9bcbe50556c73f799f6cf4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cef0be3aeac925c877c8f6f87fe40f59

    SHA1

    4922b6e4e5792eec68cb88ecb1c8473270acff8b

    SHA256

    2982a13b22872e4fcfb56d271f031f13b788f2e3750838b012b6c1536a89a39d

    SHA512

    0bce0a2103c728be00ecb59047e6b93723ab21352a51faa9806596fe7d88d8f0158b46e08cc24fd853069996a28d1a7264214a6dd769c7fb601c84d68b7a2583

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a060014f53af65248159d73c5cf7dd4a

    SHA1

    24885138d3f537150a095bad5bd84fe313b48390

    SHA256

    af731712d8843ed7061c05229a322b20d3a0a72affd60228b344576905c00f3b

    SHA512

    ac49b05f5baf066b4a6aab04d9331b52dbaeec6babee210f50516a433327af218f39911b1f1450a4a68fe55af36c86dccd7eefb95afcf5516451d73dd0eb4ece

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    33e6c6ebc28b47bef67c2789f4d821e3

    SHA1

    061eda0c913811d76318b4308eab5df6f99fc3bf

    SHA256

    1caf85dd2c6f7e5df11b4c90545cac40a57f1dc6682c12a6595d004b94911683

    SHA512

    4bc28c125254432602edf484626f28ad35bf558a9b65db22954417d80359a96c1d47a69bc125c0583b04b3bcfb48af56f2989d4511671c3ad539048c383ade3e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6cff378bbf7e4814e661fceb2c30d72a

    SHA1

    31310929f6363bc3f6dfd91feb0e76c96b905169

    SHA256

    d27b4f4bfd6f403084cceb12aa430fb856ffb9267235a49aecdf1de28e2b9453

    SHA512

    ef452bfc2f1cdb2701eae3a6bf9958bb9f55e0fbb5ea8c3caa0435fffc42a6c7364427595ee97b31dd604196c5946f8c043529757e4b09d4552bdaddb74bde3f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    606c6ace9cab1f0db12931c195613a3d

    SHA1

    4809ec24f4806faa1ac45e2ab74c1e2e5a362a5d

    SHA256

    832e9caf86b7316475d0af19db4015c7dc2b8db94d21cb66f253e8b056e56276

    SHA512

    217adccc58d4ed701097fab3fde7d72d6ad790d7eb8916833f0770cec2f1bd5b9e77ba07b33d6156ee194f6d4de9974f1d581342d78ad675075e1609c5de72a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9eab56968d2a6b5801dce685d2dc0829

    SHA1

    4c60562784d482560f6cc61e5d3078f297c147b5

    SHA256

    ae4efa1006efbe5846d819580bd0b86228aae6e8a83b6fcc6f44507dee5ce922

    SHA512

    9951292ad3c781cfec7a8023dcbac85a65bf89b3c1c9d2817dafa02d50fb3e5f65c627395553b4746cc63b5ac2c02cf137487a21f02596964c07d181dad26b43

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a7bec6a14a4ec81a56c77512caa4b0a

    SHA1

    0371a848ca25835940ec3686151d952d0c2f7a18

    SHA256

    94dd1322bdf8405b6eb0afed8f8a4e6bc840f691d2cc3eed758a791e070bf29d

    SHA512

    275d3da42ae50b493e6f5880cd8ad8043570f07745fba5dd164d15dce69935571215204ce3e0e28f1df8d7f21f22ce3c2aeddfb9e2db3d57a09bd97a91e40ac7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3d6181927c7fdef8aa65b22fc0d57ddd

    SHA1

    bdded50df8a09a84e5a1c095631e9413a93e3806

    SHA256

    9ef2273aae6fd6f9bf9e67c0c4fe6a2b6a913fa9df4830b70026edd2fb77644f

    SHA512

    691790bbb177cee37ff51b34c71acc052375cb4e313d6366afb2b64c1f1fbb02c52fd95f78f2f98f48535200edcf071ce2d0ca05e82331f1af248187fbe62860

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4ff29eb19efe0d75622e13a2a3700519

    SHA1

    9be4864736b04100906f75f16bf2c9b20f668a9b

    SHA256

    0742f03dc4e2fc1b11616c5d54c5e26591533d783148c42876443f1324a9cf53

    SHA512

    bd2905e4c78191cafb4950270648d168ebc7b3810f1f6b326d0c898ae89371510c5cdd94ff1d489a8bf82c2dce8e1600e3dbe1542baa9112f21f4245328acb18

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    46773db986b97b82a930514d52462fc2

    SHA1

    89ad3e75f06a2540410b4451fd644ae794737abf

    SHA256

    661e6ee2344746d47c36b442f475a287c6a7e0236aedd6eeb2fdea9fd652be8e

    SHA512

    f6df865f6df0b44b25db3fa9dac459b02eff78401f8a1c2349ee7bfad451055f38086168400ad80be009a9be443ceb0647e2c50565b1267728c50e4e3a3c6031

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    17ddcc7c9b73e14f5a1b716920d9069e

    SHA1

    99423ce2f9dd1dea5d81c4e1484a3c319c29d466

    SHA256

    fe492b2fa7c46f40b78d81d3158f43e410606d25466b4afd409bcf930294bbea

    SHA512

    da7dfef013158b5b09d2859a31c6b780aa295c729e6793129b5b0b332cc765371df6e7b9c1c30048a3b4a7b9aa9aabbfe6a6295d9324ba07c880add9a42ac537

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d98cedeef9f2a4a3a8e4efdf27740aeb

    SHA1

    7cf12e5ee83e9a3bc82715b0ddb15a51348965f5

    SHA256

    97e55d1d7c9682e396e4385da27b8e0df8d805f404977fe25bfcabd017f8316c

    SHA512

    653278e40a035b69e33b3bea62180a94b1460543778c68b59b069c65ec8688ab67691de99d1eb4fb07b7bb151021816ed7a6fded91c025e5f7ec1d0fd4b9da22

  • C:\Users\Admin\AppData\Local\Temp\Cab42.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarA3.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b