Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
1GRID-Autos...t).apk
android-10-x64
help_scree...en.xml
windows7-x64
1help_scree...en.xml
windows10-2004-x64
1help_scree...en.xml
windows7-x64
1help_scree...en.xml
windows10-2004-x64
1help_scree...ja.xml
windows7-x64
1help_scree...ja.xml
windows10-2004-x64
1help_scree...zh.xml
windows7-x64
1help_scree...zh.xml
windows10-2004-x64
1help_scree...ja.xml
windows7-x64
1help_scree...ja.xml
windows10-2004-x64
1help_scree...ls.xml
windows7-x64
1help_scree...ls.xml
windows10-2004-x64
1help_scree...zh.xml
windows7-x64
1help_scree...zh.xml
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08/07/2023, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
GRID-Autosport-v1-9-1RC3_(AndroidApkData.net).apk
Resource
android-x64-20230621-en
Behavioral task
behavioral2
Sample
help_screen_font_en.xml
Resource
win7-20230703-en
Behavioral task
behavioral3
Sample
help_screen_font_en.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
help_screen_font_italic_en.xml
Resource
win7-20230703-en
Behavioral task
behavioral5
Sample
help_screen_font_italic_en.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
help_screen_font_italic_ja.xml
Resource
win7-20230705-en
Behavioral task
behavioral7
Sample
help_screen_font_italic_ja.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
help_screen_font_italic_zh.xml
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
help_screen_font_italic_zh.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
help_screen_font_ja.xml
Resource
win7-20230703-en
Behavioral task
behavioral11
Sample
help_screen_font_ja.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
help_screen_font_specials.xml
Resource
win7-20230703-en
Behavioral task
behavioral13
Sample
help_screen_font_specials.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
help_screen_font_zh.xml
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
help_screen_font_zh.xml
Resource
win10v2004-20230703-en
General
-
Target
help_screen_font_en.xml
-
Size
41KB
-
MD5
80f59143821bca3f06547ef6efd731d9
-
SHA1
6e7388d118015eba95df1156d26f691f8d07ec13
-
SHA256
5ceee88ffd82f33e68625b5bd2e48e40cabf388edb491b577b2eaa12863f1c81
-
SHA512
c207bca0db586050eb2736c39798d0cc27a8e39518599554da387c364ecb6565630b3d13c4f54ab18e21e897386fe8684db1eaf002479c2618698441e9d2d8fa
-
SSDEEP
768:8suq0qaPIrTcspPeDhcE4eIq+IcMxI7QwbIDIt99LIxTUVt9UcJkUd/7RkesiIXI:8sDdEcE4ep3cMm7QwcEt99MxTUVt9Ucz
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0f93541dfb1d901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b560baeb882dc64aae4acff703adb14e000000000200000000001066000000010000200000007b86f706499486b00e359cba8ce87b1c650f3c8be769bd8e975fd3d8e46151c1000000000e8000000002000020000000383e3324db1318cd0f8e703033ff974e82f14404ff0485dc7835534adbb7d1b92000000054b2f154464fd24ee62c422fb2354cd045980635d84844ed729ea0f65a353170400000000e89784787c3c3b12c2be690a0d93a8e245d58d9b38b8d17833bfcff2ce6e86cbf811ea5e7f1cbc28ef4d87bc75409679182481be5bcf33f2a9b80d41e32eb1f IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6B0148C1-1DD2-11EE-9A14-7EF4D2542886} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b560baeb882dc64aae4acff703adb14e000000000200000000001066000000010000200000000913c16afea1a23322c928a33f7b2cd97e5f9f98acd7e5afcaaf376c9d64838f000000000e80000000020000200000002b209c7406d6cf3b6d27e3f30d30bbc89a139595a05e3e8d34c346b37a781ba090000000f6465e9da84bc7e0a6a61f113dd7f907a2640930910513f5004541c05bf39be54e25b25268d486baffe7e447118ac683fb29b6f2794ebf344999d2f0068552953cb8b93467fa00efe3ece8a513b5cb299a44c3ee8ec020d88dffc48d7d12ca85dfd8a606d60b2463fb0e99e4f75106294dba71315bd9dbb20ebe2ba6d2169f40b163126dd5b51a694c52d81292868e0140000000a0cfff46b5a606b4e0e48b048f4f32a24a5594d75714eeb91f1f3ee7fab55fdf9ae5abe24e5bba059b98425f00a290d653e5d47a6d68294a871b51322f608d76 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395614982" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1305762978-1813183296-1799492538-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2240 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2240 IEXPLORE.EXE 2240 IEXPLORE.EXE 904 IEXPLORE.EXE 904 IEXPLORE.EXE 904 IEXPLORE.EXE 904 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3008 wrote to memory of 1728 3008 MSOXMLED.EXE 28 PID 3008 wrote to memory of 1728 3008 MSOXMLED.EXE 28 PID 3008 wrote to memory of 1728 3008 MSOXMLED.EXE 28 PID 3008 wrote to memory of 1728 3008 MSOXMLED.EXE 28 PID 1728 wrote to memory of 2240 1728 iexplore.exe 29 PID 1728 wrote to memory of 2240 1728 iexplore.exe 29 PID 1728 wrote to memory of 2240 1728 iexplore.exe 29 PID 1728 wrote to memory of 2240 1728 iexplore.exe 29 PID 2240 wrote to memory of 904 2240 IEXPLORE.EXE 30 PID 2240 wrote to memory of 904 2240 IEXPLORE.EXE 30 PID 2240 wrote to memory of 904 2240 IEXPLORE.EXE 30 PID 2240 wrote to memory of 904 2240 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\help_screen_font_en.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:904
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e6dad3fc3a3d1a015b953f42c11e5bc
SHA1f2cfcc1ac71a2abdf7b0d4cc89e855167bb81a7c
SHA2563c5bcf5ef5c2c2be9815e546f4ac0a61e8c76a1326945e44abb5b5f587dcc4eb
SHA51287f6a8af4c9b4339ab173692ebeed2250f1464437e69a19fe186353cff5693bd602ea6f7300cecf41170dade8789e47bb51a7383ee75c33cc1e11d815bd5e6b5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD599effad6551da4e99aa09654ef1e51c3
SHA148a8595bfb516339471e5325d4a4dd32a250312c
SHA256796de2e3daa8b61ca5b93f8d470450b6ede6b544f442391ea5e4f54eb0569dbe
SHA5122fe9dcb81ab923d3d63928ae054f251edd04a5d400d1fd78f336ffad35d16da9222776cc634d2163f45beffb053e446bedae62d60e776538568dba38ba365143
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d7fa086c0b0acea9054a4fe95a278e2d
SHA10c709061333474ca578e1fccdead064135edddb8
SHA2565eb974a238618f999c10a3c310416d6e4c4fcfbb2754de0a711bf0bf5894ecbb
SHA512db6cacfdebc7dccdc8c1fe419f29c5bcc9f60d267fbd27be45a4dac83402d122f9af032888205bad977216e27322b1d1564a7a4d1a55033404fe97bd6cdf611f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56169c7cc3347a7b862d6ef9eb97c1d19
SHA1e289e6ec4c2c6e823fae044d6833b1a505eb078e
SHA2569f49f38e0b17b98613dfa1de189e86f56e7bfda6e064dd87123b3d317b3a4fd0
SHA512edffd58dcd4906c4fa8a70865c4f3530c9540b493cf6f3b9eb7959e8d0bf2deb19b5aff1509742800e03819935b21d6303f00271225562fe0a3ca219fcfac670
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a3e05ca2203abc4063eb988d63fd81a8
SHA1a3de95bdc4418f4e27d2af4f73dd0a2b787c2bcc
SHA2563350f3d4344311febd96948e2e5a439209ee03ae17ce8ff761d04d36ee80d25e
SHA5121cf67d2096debb74e8c842517cd6efe85fc4fd54774f13956e8712fc99ed19da7349ed29e25531af8b7d954349196f5b7259eb920ec0b70e8f665f1d7cf10123
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b305434509050687102337ea2c5f0fa5
SHA179b5295ad81d728203b9105f2df19442a3ba2866
SHA256f7c00582d7cf68ccaa504899556af86e6d1e310b4ffbd45029896da910d0af54
SHA51274aa7aca792d5be40531d0f18960f67a52ae01a1008c2a01807cf2ed2310c1094a9c57beb3743fdf481eb89986610f3aad5e657dc3726ea19dc4a85c982aa692
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5db1912b15bdd4583d6e6a2a186dd639f
SHA112982b5c9b1ca579f679767872a74b8b14da70c7
SHA25638081e2cdcdb62a227e5bb88677d184bdebb21ecc3118ed6aa406374a85c4e3f
SHA512f786d6aad1b848f8487afd50e158ee75d5a20e0432b7a715a752b69975346caeadf55d790bbbf92f03b425b28f2b200da5dbb0a5004ecd6220fd33f0443a11c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD55b0a3dfc37ac626eee89ab068b27c60b
SHA1c5b0ecb7295062a3e831089d7fc895334cdc5ce1
SHA256f646629f294ed0c7224450b8c67bc16d6ac4f89846abf1dc0578bb87d6120b14
SHA512306d89a6a253967b7dd4d2fdab666a34cf2f3e2a92be3f501fd024dfccfcd5263fa2709bb4e783e1f6a2b730baadde336750b58773b1bdfbdcb8145a40dc8617
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5eaed13fc31c181e61394a99e00d29516
SHA1cb2c9a3195ff0574d686ccde6612100c942a53b8
SHA256f21a3bc341a54dbc9bb333ef9a22e727b2aca632ce15c46c44ad08b4a07ae9e5
SHA512bcbdcaa7bcafa5084360a150b1758a325117b6db5cc3c52792d79bdd8a648e52960e84f88887a73320730c8849c0625769763ac3f805550fa38d44a3ccaf4fe4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V2025E2R\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
606B
MD5d00a15aec3ad6dbfc3cdfc551d4a2f85
SHA112b3ca3bc5cd39b2455be0667c8c39b0cc141932
SHA256cca5469ed79bd6078e4bf1cd0e87c655f0e82a92384a7cb7015f1fc847c844b5
SHA512131a9d2e0e23f128a77f54b74149bcced50c5663c314f42960d811b205e69308add2814e1bd846fa1643c0aff49fe31521407fa0e3faa3327a832b6b919fe75c