Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/07/2023, 18:35

230706-w8fqlsdg43 7

06/07/2023, 18:32

230706-w6mfdadg35 7

06/07/2023, 18:27

230706-w34kgsdg32 7

05/07/2023, 09:21

230705-lbqjfabd66 7

05/07/2023, 08:59

230705-kxxdfach7v 7

05/07/2023, 08:41

230705-klwmrscg9y 7

05/07/2023, 07:15

230705-h3aqhscf6z 7

05/07/2023, 07:13

230705-h2e9lsba95 7

05/07/2023, 06:50

230705-hl6fvscf2t 7

Analysis

  • max time kernel
    102s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20230705-en
  • resource tags

    arch:x64arch:x86image:win7-20230705-enlocale:en-usos:windows7-x64system
  • submitted
    06/07/2023, 18:27

General

  • Target

    ic_content_sticker_location_emerald.xml

  • Size

    1KB

  • MD5

    aadfe32db3ccc31c96197f0591e0fa18

  • SHA1

    59ce2e9a22fff2e9a1b68578c429f5d710463d0e

  • SHA256

    71d43fecf9f2ef6e37022c8446194d74f11b7c05816ce321f6a84279c870b4fc

  • SHA512

    914f19b03527d440752bc284fa46af19ae7cf9f4d2c11cb7bb2753fd50526181e6ca5abed68c695236227b5d8e39db1b5f9359c2d0470a4eaa147c244cc91ddd

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\ic_content_sticker_location_emerald.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2980
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2980 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:1404

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0722117572073433af37a70cfd6bf0f8

    SHA1

    c8812e5c97e42125cbfc30fa132a8881ea8c9c8b

    SHA256

    f8ce81ef8d9eb2cc5ebb6725e4e39d5dca085ed4ea31c1eab1c499c051239c11

    SHA512

    cbf2682fa3a1329f25de07230c62fa97e11e5f4deff12b5245eb5fb95a81ba326b9a247d1117c4b73c2105cc6953546aee6ddff7f9f716831491cc52bb707f2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    802ce2dfc87e1ae0a3689557c82d026f

    SHA1

    83a6cc86eb502dbfe5fee233aa99b298aa70e522

    SHA256

    ffecb814bd9672e739e8e8c5ff05656408dfaa3cddd171c35291dea28fb43ab0

    SHA512

    fd515f32861e6ce1182f1c3133d1f80ff2d96ba10db41392f0f37c8ecbc9406f5e39f7f5798e227b2e7e21798a0d4618b2a92a7f0a7a40381942c112833015f9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4d4b6fa1ab8412c55dbf1d497e3a87ce

    SHA1

    856930e52542b637898f537b744dddf704aedaf4

    SHA256

    e4ec287ed1c0b8bb32e9034a3075e10587a44621973a79d87c5fed8dc29e02d5

    SHA512

    264a9d49dc34ea7e7f05a9cd9915e9a405e0279dfd2f2aa568f11e9f05e1f3aeec8221080ffc29aff622a68dc0d31dc2de4e429b4d43536501e94deb24f2c4f4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8f582710830238cb995996517b09e5f1

    SHA1

    9623c19a0f6113b294d7f16d73ea035584659a41

    SHA256

    6c2fd01ee7d9c4b9a0571c2ef2833a474cf6eb0e058598ec9156fedf83875467

    SHA512

    ac305d093126db8457a2b93eb2c032be4ab437e0905fc574262eafdbb1ea2aac0e8935097aa3a5f5f565909809fcba7dfd555368fde936c9ef25c522112290ae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    91e9dac92d59f4099298754407e0be42

    SHA1

    c9b5c6aa6aeb264092d1bc5dcc063b18c6d84525

    SHA256

    fd0a07596d2a8475ac13f00af588e1593424ead607f5c1cb56e66da3e4e85d45

    SHA512

    0868d76b1a981d0fcf6a1951db93309e4eb166b3e035fb116cae6b7258bfa1abd468a96f11314ca5f88ce0934b39a6d8263b08f316a59aa6a997c41b170e4c1d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    eec9b9487489f566c2309cb23395ab55

    SHA1

    ae7127a85bb723befba0b3317e1abe500bf751b3

    SHA256

    ffecb01a0b05b7d095add64f82f14269f0a0759b3149e225d69542d5819c606c

    SHA512

    d89a015377c7a89023aa940555c83ad1bd914060c74caee80054f1ca42891807b8dcfdcc3b9a8c89cf636f1c1062d65da2d74204fb3448acd2c55f3f049e1fc9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ffa2e03ee790e9f5f7f205dad8c4eeea

    SHA1

    ee9f1d61c73c60447d788d582af26592fe8e96f4

    SHA256

    ff2794831d486b8a25e9dbf9457cfa165f2a09546b4a7c90dc20552edbc433ae

    SHA512

    2dd7712c54dfd7d7ae8eeb0201bbf2f3947391882b655f103d5ae78a822299e4e4a0852c70ee779227f4655e3e6dbd26705acc8e4e2846a3ec225a1d38cd1d79

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ed3069c825809ba045f73ac98f0efdee

    SHA1

    77b57e68c12d40d62e56d6dbd2546d5edbe80287

    SHA256

    19c407ddebcda0d14a1320d9e1747b8ea18d2128d5ce89b61148e55ee7eecc68

    SHA512

    ce5917608afcea031f0c0b486d8209d7d6a4c5cb6b731d003a021a8f190e23143c8c3ecfcd4df9906680c75ac0d4545be3ac8fb2f996ee48ac10b8ceafac5fb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ea3abc711e4bd86bf719a088163be84f

    SHA1

    90b208c32b0356d496e28a5394206a860277cf59

    SHA256

    23f3a26d6e76350e9d7952a40d86a1b4de4eb855efd53e4d7f537bd5c6952acb

    SHA512

    7e787732cd1d966b8f77d0b74e16d72156a0abcd69ac0b97b6df121f15e03b9578e5132f29eda241262ac9fa10abf04b6cd1bf7260ec55e611486e4edf2bbb8c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ANFZKI5S\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab1C5B.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar1C9C.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\UG0PNXE4.txt

    Filesize

    606B

    MD5

    fadce134c3246b08c98249e5635fbc43

    SHA1

    9c7c8bd967ad54a690d5e8adbfd42f0a2b3cb0bb

    SHA256

    8aa85c70c83ec0904e5272044f96fdb6044946ca2548f241ccaa79ff1ac33660

    SHA512

    f2eccedce0be6c8bf17386c52a768c364398c2dd35de7ca9540a61e7965619a2c992d98cae98e81a42c4b3f3746c85818270423e449f42b2f94b98f8ed8ac955