Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
1GRID-Autos...t).apk
android-10-x64
help_scree...en.xml
windows7-x64
1help_scree...en.xml
windows10-2004-x64
1help_scree...en.xml
windows7-x64
1help_scree...en.xml
windows10-2004-x64
1help_scree...ja.xml
windows7-x64
1help_scree...ja.xml
windows10-2004-x64
1help_scree...zh.xml
windows7-x64
1help_scree...zh.xml
windows10-2004-x64
1help_scree...ja.xml
windows7-x64
1help_scree...ja.xml
windows10-2004-x64
1help_scree...ls.xml
windows7-x64
1help_scree...ls.xml
windows10-2004-x64
1help_scree...zh.xml
windows7-x64
1help_scree...zh.xml
windows10-2004-x64
1Analysis
-
max time kernel
141s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
08/07/2023, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
GRID-Autosport-v1-9-1RC3_(AndroidApkData.net).apk
Resource
android-x64-20230621-en
Behavioral task
behavioral2
Sample
help_screen_font_en.xml
Resource
win7-20230703-en
Behavioral task
behavioral3
Sample
help_screen_font_en.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
help_screen_font_italic_en.xml
Resource
win7-20230703-en
Behavioral task
behavioral5
Sample
help_screen_font_italic_en.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
help_screen_font_italic_ja.xml
Resource
win7-20230705-en
Behavioral task
behavioral7
Sample
help_screen_font_italic_ja.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
help_screen_font_italic_zh.xml
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
help_screen_font_italic_zh.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
help_screen_font_ja.xml
Resource
win7-20230703-en
Behavioral task
behavioral11
Sample
help_screen_font_ja.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
help_screen_font_specials.xml
Resource
win7-20230703-en
Behavioral task
behavioral13
Sample
help_screen_font_specials.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
help_screen_font_zh.xml
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
help_screen_font_zh.xml
Resource
win10v2004-20230703-en
General
-
Target
help_screen_font_en.xml
-
Size
41KB
-
MD5
80f59143821bca3f06547ef6efd731d9
-
SHA1
6e7388d118015eba95df1156d26f691f8d07ec13
-
SHA256
5ceee88ffd82f33e68625b5bd2e48e40cabf388edb491b577b2eaa12863f1c81
-
SHA512
c207bca0db586050eb2736c39798d0cc27a8e39518599554da387c364ecb6565630b3d13c4f54ab18e21e897386fe8684db1eaf002479c2618698441e9d2d8fa
-
SSDEEP
768:8suq0qaPIrTcspPeDhcE4eIq+IcMxI7QwbIDIt99LIxTUVt9UcJkUd/7RkesiIXI:8sDdEcE4ep3cMm7QwcEt99MxTUVt9Ucz
Malware Config
Signatures
-
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0487d3bdfb1d901 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{65728146-1DD2-11EE-AF72-E2F5CE34D8FF} = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044063" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "971816245" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31044063" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395614972" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "971816245" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000929439ee50e204ba4f4b605da59efba0000000002000000000010660000000100002000000049cc8e5cdf49b01136ca52c484dc7ce4beacfa0bd6c06b0ac252d146bb457ee0000000000e80000000020000200000000295f2270df12dd754b7a31cd3f9c0fdf9cb0741f17a7c215878e00a3c7e5e99200000000d1770596e2e543276d00e663f86636339ab34f6a18950a18072c534d7d12cd3400000007181aa346e85c5a5b2285b515591d275d117f0e2b57aa4d70102efd682547788764018940217855c5d6d8b1be8dc6d4c83e3e94fcb8662c9464b95899ffb54fa iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31044063" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d07f6c3bdfb1d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "981818204" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000929439ee50e204ba4f4b605da59efba00000000020000000000106600000001000020000000172d10d390e48bd5e494b6283791844e8d4546d9d6f3ec15bcf97945350628f2000000000e8000000002000020000000777cfc9f4ea651d22fd5ea4daad1f81f642c42803a2136d070a1cb2fbc34f79020000000bbfd31b2efaf51d2739dd215ceea1226fefda30dd688f70261c00fc1ea9acf6840000000e0dcb1239b237440a1963dab991c5f9c0390c940fc38e3c695e9927724996c255986c0ea6c6196b1d0032bcaf6b5897d42013fd5ad188dec1a3becc9c9b1d1f1 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3372 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3372 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3372 iexplore.exe 3372 iexplore.exe 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE 1048 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2940 wrote to memory of 3372 2940 MSOXMLED.EXE 84 PID 2940 wrote to memory of 3372 2940 MSOXMLED.EXE 84 PID 3372 wrote to memory of 1048 3372 iexplore.exe 86 PID 3372 wrote to memory of 1048 3372 iexplore.exe 86 PID 3372 wrote to memory of 1048 3372 iexplore.exe 86
Processes
-
C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\help_screen_font_en.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\help_screen_font_en.xml2⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3372 CREDAT:17410 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1048
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee