Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    160s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2023, 20:59

General

  • Target

    help_screen_font_en.xml

  • Size

    41KB

  • MD5

    80f59143821bca3f06547ef6efd731d9

  • SHA1

    6e7388d118015eba95df1156d26f691f8d07ec13

  • SHA256

    5ceee88ffd82f33e68625b5bd2e48e40cabf388edb491b577b2eaa12863f1c81

  • SHA512

    c207bca0db586050eb2736c39798d0cc27a8e39518599554da387c364ecb6565630b3d13c4f54ab18e21e897386fe8684db1eaf002479c2618698441e9d2d8fa

  • SSDEEP

    768:8suq0qaPIrTcspPeDhcE4eIq+IcMxI7QwbIDIt99LIxTUVt9UcJkUd/7RkesiIXI:8sDdEcE4ep3cMm7QwcEt99MxTUVt9Ucz

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\help_screen_font_en.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1728
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2240
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6e6dad3fc3a3d1a015b953f42c11e5bc

    SHA1

    f2cfcc1ac71a2abdf7b0d4cc89e855167bb81a7c

    SHA256

    3c5bcf5ef5c2c2be9815e546f4ac0a61e8c76a1326945e44abb5b5f587dcc4eb

    SHA512

    87f6a8af4c9b4339ab173692ebeed2250f1464437e69a19fe186353cff5693bd602ea6f7300cecf41170dade8789e47bb51a7383ee75c33cc1e11d815bd5e6b5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    99effad6551da4e99aa09654ef1e51c3

    SHA1

    48a8595bfb516339471e5325d4a4dd32a250312c

    SHA256

    796de2e3daa8b61ca5b93f8d470450b6ede6b544f442391ea5e4f54eb0569dbe

    SHA512

    2fe9dcb81ab923d3d63928ae054f251edd04a5d400d1fd78f336ffad35d16da9222776cc634d2163f45beffb053e446bedae62d60e776538568dba38ba365143

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d7fa086c0b0acea9054a4fe95a278e2d

    SHA1

    0c709061333474ca578e1fccdead064135edddb8

    SHA256

    5eb974a238618f999c10a3c310416d6e4c4fcfbb2754de0a711bf0bf5894ecbb

    SHA512

    db6cacfdebc7dccdc8c1fe419f29c5bcc9f60d267fbd27be45a4dac83402d122f9af032888205bad977216e27322b1d1564a7a4d1a55033404fe97bd6cdf611f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6169c7cc3347a7b862d6ef9eb97c1d19

    SHA1

    e289e6ec4c2c6e823fae044d6833b1a505eb078e

    SHA256

    9f49f38e0b17b98613dfa1de189e86f56e7bfda6e064dd87123b3d317b3a4fd0

    SHA512

    edffd58dcd4906c4fa8a70865c4f3530c9540b493cf6f3b9eb7959e8d0bf2deb19b5aff1509742800e03819935b21d6303f00271225562fe0a3ca219fcfac670

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a3e05ca2203abc4063eb988d63fd81a8

    SHA1

    a3de95bdc4418f4e27d2af4f73dd0a2b787c2bcc

    SHA256

    3350f3d4344311febd96948e2e5a439209ee03ae17ce8ff761d04d36ee80d25e

    SHA512

    1cf67d2096debb74e8c842517cd6efe85fc4fd54774f13956e8712fc99ed19da7349ed29e25531af8b7d954349196f5b7259eb920ec0b70e8f665f1d7cf10123

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b305434509050687102337ea2c5f0fa5

    SHA1

    79b5295ad81d728203b9105f2df19442a3ba2866

    SHA256

    f7c00582d7cf68ccaa504899556af86e6d1e310b4ffbd45029896da910d0af54

    SHA512

    74aa7aca792d5be40531d0f18960f67a52ae01a1008c2a01807cf2ed2310c1094a9c57beb3743fdf481eb89986610f3aad5e657dc3726ea19dc4a85c982aa692

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    db1912b15bdd4583d6e6a2a186dd639f

    SHA1

    12982b5c9b1ca579f679767872a74b8b14da70c7

    SHA256

    38081e2cdcdb62a227e5bb88677d184bdebb21ecc3118ed6aa406374a85c4e3f

    SHA512

    f786d6aad1b848f8487afd50e158ee75d5a20e0432b7a715a752b69975346caeadf55d790bbbf92f03b425b28f2b200da5dbb0a5004ecd6220fd33f0443a11c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5b0a3dfc37ac626eee89ab068b27c60b

    SHA1

    c5b0ecb7295062a3e831089d7fc895334cdc5ce1

    SHA256

    f646629f294ed0c7224450b8c67bc16d6ac4f89846abf1dc0578bb87d6120b14

    SHA512

    306d89a6a253967b7dd4d2fdab666a34cf2f3e2a92be3f501fd024dfccfcd5263fa2709bb4e783e1f6a2b730baadde336750b58773b1bdfbdcb8145a40dc8617

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    eaed13fc31c181e61394a99e00d29516

    SHA1

    cb2c9a3195ff0574d686ccde6612100c942a53b8

    SHA256

    f21a3bc341a54dbc9bb333ef9a22e727b2aca632ce15c46c44ad08b4a07ae9e5

    SHA512

    bcbdcaa7bcafa5084360a150b1758a325117b6db5cc3c52792d79bdd8a648e52960e84f88887a73320730c8849c0625769763ac3f805550fa38d44a3ccaf4fe4

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V2025E2R\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab8C4B.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar8D39.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\3UZYXJ52.txt

    Filesize

    606B

    MD5

    d00a15aec3ad6dbfc3cdfc551d4a2f85

    SHA1

    12b3ca3bc5cd39b2455be0667c8c39b0cc141932

    SHA256

    cca5469ed79bd6078e4bf1cd0e87c655f0e82a92384a7cb7015f1fc847c844b5

    SHA512

    131a9d2e0e23f128a77f54b74149bcced50c5663c314f42960d811b205e69308add2814e1bd846fa1643c0aff49fe31521407fa0e3faa3327a832b6b919fe75c