Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
1Static
static
1GRID-Autos...t).apk
android-10-x64
help_scree...en.xml
windows7-x64
1help_scree...en.xml
windows10-2004-x64
1help_scree...en.xml
windows7-x64
1help_scree...en.xml
windows10-2004-x64
1help_scree...ja.xml
windows7-x64
1help_scree...ja.xml
windows10-2004-x64
1help_scree...zh.xml
windows7-x64
1help_scree...zh.xml
windows10-2004-x64
1help_scree...ja.xml
windows7-x64
1help_scree...ja.xml
windows10-2004-x64
1help_scree...ls.xml
windows7-x64
1help_scree...ls.xml
windows10-2004-x64
1help_scree...zh.xml
windows7-x64
1help_scree...zh.xml
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
08/07/2023, 20:59
Static task
static1
Behavioral task
behavioral1
Sample
GRID-Autosport-v1-9-1RC3_(AndroidApkData.net).apk
Resource
android-x64-20230621-en
Behavioral task
behavioral2
Sample
help_screen_font_en.xml
Resource
win7-20230703-en
Behavioral task
behavioral3
Sample
help_screen_font_en.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral4
Sample
help_screen_font_italic_en.xml
Resource
win7-20230703-en
Behavioral task
behavioral5
Sample
help_screen_font_italic_en.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral6
Sample
help_screen_font_italic_ja.xml
Resource
win7-20230705-en
Behavioral task
behavioral7
Sample
help_screen_font_italic_ja.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral8
Sample
help_screen_font_italic_zh.xml
Resource
win7-20230703-en
Behavioral task
behavioral9
Sample
help_screen_font_italic_zh.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral10
Sample
help_screen_font_ja.xml
Resource
win7-20230703-en
Behavioral task
behavioral11
Sample
help_screen_font_ja.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral12
Sample
help_screen_font_specials.xml
Resource
win7-20230703-en
Behavioral task
behavioral13
Sample
help_screen_font_specials.xml
Resource
win10v2004-20230703-en
Behavioral task
behavioral14
Sample
help_screen_font_zh.xml
Resource
win7-20230703-en
Behavioral task
behavioral15
Sample
help_screen_font_zh.xml
Resource
win10v2004-20230703-en
General
-
Target
help_screen_font_italic_en.xml
-
Size
41KB
-
MD5
e7a0636d36cc9187d882513ddc489581
-
SHA1
a2e6c1151624569f8c50d2d219f9f26e10aa3158
-
SHA256
f7bf04817f4dfea021da03e7ac8782917fd9e4890c104b376d1f447515b32874
-
SHA512
9043b86fab567b9e37a1b60faa9bf079996923237f0401fcd7071a85c3195302651bd39526fe096f1393da11ebf9824cf9e016bf6528a2b30c4dabf45883a6f0
-
SSDEEP
768:N5iXxqZY7OI8DhIfJKIhTjaSEs8gI12G1CIhwoptkI9lsIhDILvXWnzxlFRhvQFQ:N5iXEo11ZaSEs8512G1fhwoptt9lsIKe
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9b4fd3e4f8f414fae099af533ea5f4000000000020000000000106600000001000020000000d9d93d405f186a43329cf54db78af63df26c469318ceca6725bd71dcc450d4e3000000000e8000000002000020000000a1c283cf35158ba2b656c207943743392f867a0c7248ed33dbfe88e5852701be200000007edfa84c5f8d14f16af590f3719ba9760d64d997c14bb5f9d556a40d307073224000000062bee3631fe46b22ce1c9304a5d8f88ceef0e0ed90600c96b0678f58491138721e1a2026729b5f3bf63a4a6c1f36f094403b36fc01c11b682a40a7cb399996f1 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "395614995" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e9b4fd3e4f8f414fae099af533ea5f4000000000020000000000106600000001000020000000c8c0122b1a026cfb0e516307febf26a667cec965fc78116d3a7e270de92114f2000000000e8000000002000020000000e1cf8561c8406b9a2b168865b150b9ee51eed0985bd7d1be0773dd9f22a4784f9000000045c5cba288bdbdf31ffac886ddf84eb31d36dc5bf4b7ea29f2b21b239fc16876f4150befc22e26ff5fb2a3f18297484f5042f194f0cfe2e6845aa4f7baf09d78cfb8c1e8268d4ffb8b45294395c25811b647feaf3f4ede5f965e72306c194ab7a14581bab24b742d3589e1a5c6a514d7ec86ab172cef1b7384f142c178690a3788a6a4748fc44fb2dbed38bca73cb58940000000320dccc3a2a9f544520c9151081ece902524ab7a356c49f1cdac17321eea19e96eb40c59eb507d44dd65d882d8a0f3058cbaaeb3540b2c631bba9b8fc47677b7 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6590CC31-1DD2-11EE-96F4-66DBF85D7F8A} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b097de3adfb1d901 IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-719110999-4061093145-1944564496-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2288 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2288 IEXPLORE.EXE 2288 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE 2264 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1620 wrote to memory of 2332 1620 MSOXMLED.EXE 29 PID 1620 wrote to memory of 2332 1620 MSOXMLED.EXE 29 PID 1620 wrote to memory of 2332 1620 MSOXMLED.EXE 29 PID 1620 wrote to memory of 2332 1620 MSOXMLED.EXE 29 PID 2332 wrote to memory of 2288 2332 iexplore.exe 30 PID 2332 wrote to memory of 2288 2332 iexplore.exe 30 PID 2332 wrote to memory of 2288 2332 iexplore.exe 30 PID 2332 wrote to memory of 2288 2332 iexplore.exe 30 PID 2288 wrote to memory of 2264 2288 IEXPLORE.EXE 31 PID 2288 wrote to memory of 2264 2288 IEXPLORE.EXE 31 PID 2288 wrote to memory of 2264 2288 IEXPLORE.EXE 31 PID 2288 wrote to memory of 2264 2288 IEXPLORE.EXE 31
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\help_screen_font_italic_en.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2288 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2264
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD509224f878557e73a49c1c2b37a6406bd
SHA18fa1aee785ded38b87ab986f3702f5b56e66db90
SHA256a51793f719dd09c9faca9b71736a3e22f1c8c9199184caea5d982eeedc107682
SHA512871be6dc022b08a5f03271eae120c183cd78f438402aa204bbb12ea139b5eb2c4d85c4f5851eb38f48a5ce1e83459e894b4f4efb3954dbdf669617c17fabee4f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50b9aafe29c6767a8190f4ec8cdbe41c7
SHA1c782a133a645e111a54a6bae9c71f8ab9db9a8f2
SHA256c809f15c072181de3c883efb786d8bb10adc203df4b7a60b74ef2bc8269499c8
SHA5125ad070effd2228121d1bcdfbf1806c4a1fbc495c37d18df51f2ad588156d07506deeddcd52f89747c25d82cd52247c1957d02c6ddeb41e63669760e9cc1b4ea0
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD59f0490de21f0c57e4128b320ced1c4b7
SHA1ffb55a8c429a3a0212c82fac1be59d8f8817f77f
SHA2567980e4c1166a75b8433cd3684c2e5334c1514da367220806acc687e73b2e08b0
SHA51207ccfe1b8515052643dede765b0b58028eaa993e28fa7d3f9d6c55b1a13d4220f140c3a1ef82808c62a8f81fc324015c374888809f81cbebfdd1043126aa2ab4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD54346ecba995538a7af57af5411202ba8
SHA1656c8b75795587df8498c6f0d2afe8cf1e174582
SHA256a0d9ebc965dce6e624f9b7f6f3acc992795fb78ce4d0927967278882e09b9e0e
SHA512109ad3114dde33025ad0fdb921465bceddedb1ff9c61474a34c632777d73a93fe946b42878fc3c243162e7452adcf997cfbc719e9693b8d5115920c663f198d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD537005fd87178dad38a7f92cfa7387d42
SHA1095c59ba7f0b45fffcc8a1fb45385a7eaca8bcec
SHA2565158715141339f1141c7c14f4e1be57ae2ce2a6636d2232214c2997a6b47bc72
SHA5129bc1bef65f45ed45faf43e74ff3ae32afe602f3ea2a628c5fab56b5611eec895614ea32bfc3b21a583fd16c0f11dcc25b97fa1c11d1ba86283e4ec1bd03978eb
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5815b24a152172a1a2f52ca2c4bbee854
SHA17884f5ed0aba969923cd189cc7452272fe7369fd
SHA25654506ea24237d2811f7387c60413b3bdacb97f806fd1e5c1642c66a3cd79c3f6
SHA512b94a25056f37f9c85755c9f3693e51fbd313354a5367ccb84b15aebd269f6a5d2d71bbf5570588f0adca752e9d6abb7255624fc29b04bdf4b78e743d2256625a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD542775059b37b9768837596d9e13118c2
SHA1681706e294565d0f5dc6dc94e98603001f9dbe15
SHA256ad29d269fac5735274b0fc37ad9d81028ec213b668ec951ec681b0351eaa8687
SHA512beffb19c45122b480e5f0a98f1c915840781eb950db207d89e594714aaac51e0e21fe0f5319d409006b4217002fcbfd7d9e9f56f795877073d153f8a6b0ab264
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51bd00426f709d2f348d55ff17f81157f
SHA1b416b5ab7f461d3faa33fc2193117560fec275aa
SHA256b4ed196f163d336587c38f48002dfee2f9b45bc234bdcd000483fefa57bcbfcf
SHA5122a481c7433f4311b8f41965c5d998398980d33d4d382f7d11ea195e97cee1bb957f736ce6f8a4d954e3eef2f8a49423499c272e7fae3dbc6c5a21df34f3c080a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ba73351c3033661579d5561651747e2d
SHA1b8342405c7ee8e54dd8ce79eb18e5074db3b7eb3
SHA2568fb439b88a19af40309540c9aa52db147f68abc64030fa225255f304f1a0b442
SHA512db6da75c22283a9fa9ac0445405e454746b9d38c46d961e3af082d05eefb638f26c2ae3de62cd12b72c0e643ebc965e5e52b8ea3422e641849e84d8da95abd71
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\GHQOZ3XD\suggestions[1].en-US
Filesize17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
62KB
MD53ac860860707baaf32469fa7cc7c0192
SHA1c33c2acdaba0e6fa41fd2f00f186804722477639
SHA256d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904
SHA512d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c
-
Filesize
164KB
MD54ff65ad929cd9a367680e0e5b1c08166
SHA1c0af0d4396bd1f15c45f39d3b849ba444233b3a2
SHA256c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6
SHA512f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27
-
Filesize
608B
MD58c3bbeddb4dcbc5203aea7a2e44969d3
SHA1ce26cdd3fefdd54af0cd04409c046f2e2d7b3248
SHA2568f2a34a2c6f6e1897970fd5625606801f5b29123e5d1347b98862ff2cd15a79f
SHA512b594cfdeee0a033138c0ffc42867c979c1e91aa73c90dc05c96c025ca656866d64670d14ddafd86e4d1256866dad1065cbaf75d99c0b88421fc0a0a277d624de