Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/12/2024, 21:06

General

  • Target

    Sheaveman/Preinquisition/english37.html

  • Size

    1KB

  • MD5

    5343c1a8b203c162a3bf3870d9f50fd4

  • SHA1

    04b5b886c20d88b57eea6d8ff882624a4ac1e51d

  • SHA256

    dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

  • SHA512

    e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Sheaveman\Preinquisition\english37.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2380
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2380 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3032

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b5f3421c76aaaa79099e9e67b6a33fc9

    SHA1

    80390add6f90012fa4f3bc667f64c9b90620382e

    SHA256

    4a6e98b783732a91175fa36710d6ce92dfbfb7b249cadb6c36dba42c004c7786

    SHA512

    a4672b116ea722b13609efea7a2a39433c0972074132918ce1837ba0f057f62a55376e7c5e2d4900a4fabb345409350af966de8ce1ecee4759df482db092e296

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    604f41e1a85e7aaef9326a469b5a7a5d

    SHA1

    7cea5992ca0b3885cb4281550810ad0586b84e95

    SHA256

    de2db9434bf6c294784ef4822a77efb2a324fd1c464320ac9e0c582c1ea7f6e1

    SHA512

    3275cbd7ffe1b719bd9c6e1d58c21efb1cd7989a202ae6a714de7a916d4d1cdf5db7427546250bce9ae9c6f3aa1b4b302b912f64a3f61aa4117abfe56325270c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1496d2bc9cb255f5f0b82e3796dd0513

    SHA1

    e7e2c2f55569c1e4905a2498e6cb3b001ae6fc0d

    SHA256

    0bb6c468999be94f7603afde38a8ab3c30ffa1ba0db1949c1e0221d13429a5b8

    SHA512

    6cecb14cd64c37dc07f87a8426bcb7586f3204923432da07fbcb145bbfa6720642f14840d1c8783ae386c6b5be336cfaa94ac4bdcfd66ca658927a76f0537393

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd23491a09d1d2bbfad697ad5da24fab

    SHA1

    a7dbd87ba9c06e4e65aa3be250a32e2e02c453c4

    SHA256

    092a749a5864e0f652337d5d3999c4aba13fc616bdc9734c496d6dd9c300def2

    SHA512

    3515dea8ead9dd982f8a4b8d89cb225e57ca66dcfe2c56bebfdb68dc8a99826bf271a47275fd53d08218b18b8fb6b1717712c4d338343eba26edc9a2d322234f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3db65aecc1e2699bb06ea091f48511d3

    SHA1

    00442283baf0bba61787b1c25bae968b10257dd3

    SHA256

    b7960f26d17a3259ec38f3ba217c08c3f7267446b845ef9493151e15842c8a51

    SHA512

    7f82769fc849be5cbeeba5bb9ba7297f8c71d418702529c8a245b5dc592ec13898d0723c552d994e51a3b672dc64400eb5d29acc152eebd6028f6675658f188b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    583d6c1b9cba79b641b7b64ae8747057

    SHA1

    467bb3d122d1c8c84f19d264332a1d094e617fca

    SHA256

    91db152b5cb2e812d3bc6a064b303880817838ec1d0135ba7bc666b7d07c264c

    SHA512

    c571f0e7638f359f77f804fcd8893d8980727d074bf33c2613635b92b2568118900832dfa8b45853e60655e6bc4a5188f72c059cd0dc3b5c7d95ad351ae5498d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0226c2aabaf79ce7e57e90505995f54b

    SHA1

    78ca961da223ffff9ccd6c628cfa701255feb3db

    SHA256

    998fd2cd2c5a4861e6b2f1756b8698684515d5069bcc66063dfe827fe36de2f1

    SHA512

    76b35c1ff65b7a65038d28f6f441360649336ab532e8ae97dfe90350085fde928f6badcb6b84009ad745d7a76ff4eb0bac567fab1cf4402d9ce721c20f9f30e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3b23573340941f7e03dba7eba3edb0ad

    SHA1

    20605e4055f2ac1cfd632b84c32f33f8f1b20705

    SHA256

    66dc5d4d5ac0e38d2b5c8accc101072f610a537fdfbd163552578eb32595d801

    SHA512

    5a5382a0f90ed5d19841e4414dc2b87f4f1405fb8385c8303c201c4c7951795ff75623f97b12b596ed9b45fdb3185e02973fda215523eb164148701073d89385

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    54d625804efa86ba6f66fc6ebdb86e08

    SHA1

    1b8c04dfe3ee62fea640007ea24b8291914abed1

    SHA256

    4cfc30af64b02cf14057f14c60a6b171d92a083310c9761ea339dfea384b3240

    SHA512

    f930eb7f42931d3120cde9e7481ee28ad8565c4f68a3b8bc876bf9bcce7116c4e94592b20079a11617b92f3958b32eb40ecd035a63b836ca0a0ed65c930743cf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    52b167a7b28d08ed37fe0505c4b81a0e

    SHA1

    809d81f8ab591ca4cbf11975d5114c1f6b2a7750

    SHA256

    9cc41a8d15cdf20008f98b2aa9b85f5a965ba2bdaa0ce9d4743f7c5406bb8a43

    SHA512

    d39321150c393196d2d1b25fc61b94c6f17f697c5dbbf11f79fdcb5f8df4d63fd3b5c1bab534207c57eedbcf7ba7f0b82083414c088a2e389e5b332c72e808cc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f1e3286376e2adc9f49d73348701f2e2

    SHA1

    2e16e4ce788cc176a0c8210aea05d6ae3f2d2177

    SHA256

    1a22e078e49a1bbe2d5dbad8f2d1d355a7a8fe0ac70f784a1669393693270408

    SHA512

    bd5600a9855b3ae448054b48f3e94bfab1dbb04b349c348d4de1d3cab623dc26dec2b930bebb0ec28693fdf9ad0f872f4c2862f6e9a5c5d2e6cd085ce2308167

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6744d54a0b47f26cbf69e31847d88786

    SHA1

    753d204e89594d133e7a3aeb594928d7baba69f4

    SHA256

    052571cdb54e311082e54fef3d2b1f8c006f05f5210d320f9761a3126ae1a2ad

    SHA512

    3aef9a93bb9c5d9c5e5e510fcb39bfa6585b0ad369c3c43fbd3095b17f68fe45548a0902d3a5e2b2b75f949e365a6e394747389182de9d2d6eaba2637a990fb0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ce5e1a4bc584efcd3965ee5263cd19ac

    SHA1

    28aefe84c115634acffb0d9aad8bec781e62820c

    SHA256

    4ab50581aa3425ee84d848f7db4f9a3b83c3b8f21ea61796f927b512f53db710

    SHA512

    8b3399e21a67131001d98f7d21fdce8def3c5dac05886ccbfda42831007b73845d0312175e2b87772c900bc287f9164a4f72d6fd7adf40685ab6403cbe7b496a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    108fb243c9d7ef3c33a48e9f0ebe5ee3

    SHA1

    9d7501c5a8110e011bccca2694507c0e4728ff51

    SHA256

    bce21814ca95b2b14d9b5d2a01975f964bfa3d77a9352610ecd25245f0f3fc70

    SHA512

    8df20ecd7e9ad1ee4024205d816ff4c2f043976c26583050200f81db99b345e6d159187333a26a9ff83b494de8bea846cb3c4c85ff26cd6921bf65e410077a15

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fcc59240be13b71d36867873996efea7

    SHA1

    1f5de55d5f17536ec5ef0f878df108b306048f76

    SHA256

    38cec8416041e8e5fbe86a3de05641e6e231e44694fda94400181275fdd1d8df

    SHA512

    2fc5a62a118de878db42f6f57b549e0fba332d3eaba7fadb9343ff7ac1a09ef006de78a055232605269fb8463487086ccad98c2a1d300128a1b9c5e4336e9217

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5f7b803daf581d1f08590dacf085490c

    SHA1

    5d9b092e6fbc3db77e1e7443ec09a38950bc869c

    SHA256

    651563b7033f1938e8aee2f759e47e66604b48febba17634c5cea4e01cc28533

    SHA512

    3ed3f9111c77608cf61b8860fc5d5d5101d57b0ecb30ef43f6df509997b6b2b0c82779c7a15cd9690a384c1cb9d877f9e3495a3f052e9ca585399594fe5bad7b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5dff4f77386744d1b0b4c58bfc0a7be4

    SHA1

    6c52a156f0d08ff0d0ae1b6ce7798bce31c0d556

    SHA256

    6bd55e34905e785f6b58b5f68491dc320b944a72b1ee599a41661978ed6712d5

    SHA512

    3133b24939e1cabcebad57791864433da7a2e6ec4d77b5e1aaa1edeeb5cf722b2daaecd22da9ac83193260ebe3c93b1c9ee1d00ae732a5853bc9522f8b731f99

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    85cbd0f4c832e88346e8337e2abb2e05

    SHA1

    df8a0311630a5172afad54ec5f7b4f8544a8f934

    SHA256

    1dd333a772145f160efbf6f20e621d6570ab61e92e5516bf3fe11ca48215309a

    SHA512

    6389a95eb34a514245907fa6c26c5e221edaf20ba17ff219d8580600d89a3cfec5812de2cf2f6df941457a71ca0e2fe49a7484916d889f7d6e0e7f3c87dd91bc

  • C:\Users\Admin\AppData\Local\Temp\CabEF11.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarEFA2.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b