Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    136s
  • platform
    windows7_x64
  • resource
    win7-20230703-en
  • resource tags

    arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system
  • submitted
    08/07/2023, 20:59

General

  • Target

    help_screen_font_italic_zh.xml

  • Size

    2.5MB

  • MD5

    cba2fc78e2dd9d64852e9e2f03a0fd65

  • SHA1

    e553bcd06c608f79ecc90b0f781949065a24db8c

  • SHA256

    60b59396ddff5ffd85bcd9ccb21ef1966c684df2a974f7181d74246581b90438

  • SHA512

    cffefe5bc1f923b0c5681c65110d9af46dd663146fedba041b6d91000775e94c7f6d0b94ed98a69c544d0b38bc8ecc2b9cc9aa62bc18edbf1572de0ba2c5c507

  • SSDEEP

    1536:I2y/+ABSZrxyHIddokLJVSQ4EYF/AICrEcdKSATtjB19PhkBeCQFdw4G593gBIfX:/y/2

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\help_screen_font_italic_zh.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3008
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2116
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2244
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2124

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6b156683416c8bf7130f0c4ca80c1957

    SHA1

    5496bf9c0a228ceb64b6b432bfbc141c86ffafdf

    SHA256

    008727970f4b45113ac5bf134cd2c44ca41df0229360fe6f01715169cc564566

    SHA512

    129ce968b4b90d1703057dfdf67d21688882dd145fdab323dd79e1bfaaeb4dcde08ea715d4b534610e98cf66d77985e0ff3ef28237254becdfc3a1bc66b98135

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e9d8be2418bcb16ca20df734a0322d56

    SHA1

    691c0157f0698a34f92913094fdf38b0ae72aa43

    SHA256

    300c8cc57cb7d9f4666cc26fdf8104284d57fb917ef8a611c82dac092caae553

    SHA512

    b132241d3907a3370c3eb157aa4c31f1b5308c371b743cc716461a181d742c2cd75cdea341319ff496f37bce6cc057f69722deacf6d6654c0abd0ea5ae7ca911

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2874b53c5f55514c8ee63e457ed32079

    SHA1

    4ccaf2213828ec62d02fc46c25adc3773e6d1c97

    SHA256

    6bcdde6086e2df6d34db1d14040f5f8c36b365cc0468dd3afd1f35fc7003d7a8

    SHA512

    a8e6ff02765eb74826cc0757269feb25f6931fa929fef25ba88de6df280c97123b434e54873b315d7c4b83a8a3113850dd55f26ab958afc85ac3dc2a70fa57bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4b11e81d31a96108471c7cd59ce5e521

    SHA1

    3587cf5dc22abba0c420fa7745800563eec4077c

    SHA256

    3496a8df0d2066d21bbe2ef2c3d315fd012a89012d7428710c17856575d9981e

    SHA512

    81af06f07a5b639de0d7f7bdeef3d4ab533960a31e26f776733191f974ea55fe12f7d22831a3cb3cc65e1dcbb3d83b048c2a2fb8ae0eda42d3549f4eda40b270

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    02d606f3e5aa4e5891d046948b59c127

    SHA1

    4f0e48cf5f6831eba238ddac03ea19c473654fd2

    SHA256

    fc4f38c9939dbf1b5fcee26194bcc03f8b572ae9279540861850864f6694e08a

    SHA512

    bcf33c97861c9f9700e69abb221bae55e782e69ea847103adc08e600b485f4570d9796eb05a352bf52b0498b0b44b03e0849299aad5ef618da459a28f1129074

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4e6d89c793b675b75c5d0e5347998a28

    SHA1

    fda95d203c4c60fcf8e859216d165cee4771752e

    SHA256

    6117842b8aea66d867aaeb1b8af5e0790f0a4edee92a2538e790d56fe763ef48

    SHA512

    177f6352e9dab33ce26a6700d61ca331f40e0137a5c209bc9b99246a290cec4662337ed3272b4a26e250ea8c5027cf507d2baa7d8dd674beeab380db0cb2bb8b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8DEHEN72\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab64FE.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar66D5.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\U68MMIE2.txt

    Filesize

    606B

    MD5

    9f4c6df7644a94fdf76db088974403b1

    SHA1

    c994811cdfc7dafddd7506e6c090872a2c2eb494

    SHA256

    5d0bab712ce6173b17a2a0ecf8c8c221bc3beed91130e021ce8981f2c6ff9e0f

    SHA512

    acb1bb09263d1e9ca9cc81395844d026670732d0c80860856aa6f98e3828475861762218b3698956f9576ed1f2ed4e03e876be909201b83251f746982ccf2ca1