Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    26/06/2023, 22:01

General

  • Target

    00004109.xml

  • Size

    243B

  • MD5

    0f5bae2c6d9c260cd28712b6fe1eae34

  • SHA1

    88b2a4734f0de5e6a1e7fc689afcd1b2107bcac6

  • SHA256

    7525e8eaa9a91e25789edf092122709422f2716ccbfe7ef62d3634d230b945e6

  • SHA512

    b6160218da8f6aab621e8e4b6368a2aae6cfbc62422ddfffce4b927701f5d0f7411ebb51cfcdaaaf187ce13a2da2a01e06b7d5a96fcd2f79a120293741718c0f

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\00004109.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:676
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:464
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:464 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:624

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8a863db6fa35c8c7cb385a21b1c375e1

    SHA1

    ddab4accbbad838c736ca29dedc70add40a1935d

    SHA256

    aefc9cc1fe550479d838d39795be1708bb25b0396069fbd3d32d8aa31acd5c00

    SHA512

    5eb27b8182e4446d709cd6081786baf59dd8b7c6f0dbd79cd153a9f54a1a20d01eb9f9dc6cf27989779a280bb3d33e48611f2d2bec8dbfacc2c89695851bb4fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2be7f9fa1cbbbe72bc049ede7771d45e

    SHA1

    6c0974ec80d218210dae163af639ed20ebcb59df

    SHA256

    6093b67b82ba905a1c4c027277633e3295af12bfd8157d7b417f72a56c0eeb5f

    SHA512

    2d02f0d3ebc99db1202bd51ffee39d45691210e4317b6a3f0dcfcc7d82b34c774fb48254028a5f17af8ef5e17d2a0d71ab722750ed878ef4cfed2b4d5f4dcee6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d3d52c4ba51e21e8302cf75de89b883e

    SHA1

    81df34bf48ff73f16bc69a673b312165b128a136

    SHA256

    a88b003be62d1656d606eccee0993dde34de94e1ee55cff999dfc6779f958529

    SHA512

    56211c906bc6c25bee0f23e02c022f817c3d5da0916840bb9d4e18617e90428851da6083157e9ba181d6a4752b33feef65374a66488ed3dcc6c329d016771649

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0abdf094dfc015e3d887bb9f583dcf17

    SHA1

    2495f76a2486e0a005a0e9b2171053f9b02ab319

    SHA256

    c77f8404039d2553dd1923f13091ef3952c642362c50a599bcc58f99e58dbcc7

    SHA512

    7118c867b523d2eaeaf17e1f71390ff356488b3eba003d9cfbd64a1d25908cc2d80eaaa6cbacd7bf68f43c427d315389722b6055abf42132c3a03b3242031518

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7ec09dc5fcdb16e9b211fc0b17e6fd17

    SHA1

    2b48c4713c05b2abb91157d97c779a950660f483

    SHA256

    8f491c43eaf1c29fb54f9e8e7094a8a65a30e5840ddd33290ae526bc954cfb36

    SHA512

    4157d54fff844425cf5885277666709823eecaf902052a34e1b0c739e10b46eee87c3cdada87cad36b2b83e6f653d9ff57adc285190500709232b3c71334bc0d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fc800efeca4500bc9dfeae788f46b55e

    SHA1

    857111d55107a51a35a0cf298ab63db1e995b187

    SHA256

    10d1354810c3e82673b56e82115bcd52c8549b31d86e1e2c9fb52bad3e4cf920

    SHA512

    ae98d48dc85e7b4956ad942221773161cdcd9bba7a32c740c636307d4140f2826d0c346b7243c71b87bde959793c40b67c99cd6fac61ca907089d0d7a566e930

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f73a779bdaecbc469f2b3348155806d7

    SHA1

    f1f5a6090f06133be77af083cbd78307bb4c44d2

    SHA256

    f2f6a481fd3ba2e8890389755f74d7367f1672c8d7a4370386a513105c008ed1

    SHA512

    48580b935c4671046f8c0c25c670febbcf769ebfe95f508fcd1721d0063e44ddd48a7afb90d4c80c4a8d1e88b97fefdb6796437e663425e5b340b56980110796

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c95e4dfb0ebfc769283d93d2573e7f00

    SHA1

    f8cd196e984b3d566ecb2c3aaee90ebb23a210bc

    SHA256

    2dc6d460ec1cd1770965002e0783c7e5f88f423d0527c3e84248bf258f455873

    SHA512

    ee0e07934fa6d881feb966177a5b04bce62e7a511b72b46f9743894ea2bae515d3e8933bbca2f7321dbe8d54633a1c8b1069c4fb541ebd36dbd46db6cf5e4ac6

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q0ZGWADP\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab3F54.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar3FF4.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AIBK3ZSJ.txt

    Filesize

    606B

    MD5

    dc44a51691846169934fbf953369e8e6

    SHA1

    daea2e57b4b452b7c14e4616772f34d2dcaee899

    SHA256

    96bc45e622f32106ad911d5b9605f95349dc7a8cb6685fed6d8c21a25ddb6848

    SHA512

    9663ea7c7a772354e534c43a574b5f57683f1ae944a54855136679a5686d907f807aacf4d46f99c22d6d6c12cf9d05a7cceec305f94bce9e4b31c2d2ca7f8f51