Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2023, 17:24

General

  • Target

    inteldrv.xml

  • Size

    234B

  • MD5

    e9fdd6064fa88464ed0e2af07a17e5ee

  • SHA1

    1dcee5db10d1f158a10058f0c2c5c1160695c206

  • SHA256

    e0322f9e6818b6d3dd6e7b868caeb9032ffd8386ab639de4c17a1822d180b2b6

  • SHA512

    37387070d9271b6395462a752ae8259dff37199663bced59571f174cd1817575443a664ba54b29865386f7e56780fb1020293ee93e168d2444a992d048754ede

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\inteldrv.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2564
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2420
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2424
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2424 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ec7cee90e1f9db8051080ce8d21a9e63

    SHA1

    d60c6f7d9b5fef05d1e3f645f2336453a18d7e14

    SHA256

    f05a579fbd10c145187c6cca6ccf60fb8ae190969bd225648a9ce6771eeb4dca

    SHA512

    35ce2be8a10f1b54c8b5d276a090a7479d9b349b82195838c55a6270ac8e66c793395bf3f05a244bc8bf71c96f35310e2e0f067475595671abf994d98733e8e4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4588d1443bc6a59abf2c6996b6754dcf

    SHA1

    49d2fb587874415264aa7775e889a2c588988d1d

    SHA256

    38d25e4a7928a548e885dc5a279e15704460c54b1e62d3d6377392acd6e1ee56

    SHA512

    329f8544ee8d280aafffdc7ab972ae547caa09ff4a241b6f5108e5c6150adf4abc8e4f3d3186b3715565005eb7952b8273f367dee4fd758f8a891be4452fbc10

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    011ac06c7cb123cfcf030eaca3ad688a

    SHA1

    734ddf9105151cd0464028ef43e6b15a05bef712

    SHA256

    cd919f91cdfcb71059707baf68eec2392e108caaabad63617e8dc9f140d40219

    SHA512

    fc7d859c0163e6b7c27cc3bd2b474d4c41c486c302e87c23723e140d8c0c1f2e397befa3bab572f710c65c506eb0faebb1ac339a67bc21244f1c30868a050cfd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    493b7aa712d1b1ff662eea1677a07d20

    SHA1

    bf1329873111bb05fc67860cbf2038e628762f60

    SHA256

    d14eca3576c2a842aa274e36d1995e6a86de64ee1c050870c975cc515edfa76c

    SHA512

    ad1326f4ad91603512c5944d7bbf7d00bf59b0082a56cca71f1a80031e47c5fd5b388ff54571ccf7f25489fa1fdd183bb8d345924f15e0d6ebef632b506ce49b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    71e6bc20a057137182b96a3c09a36d93

    SHA1

    b86faa7884c7eec833d75882c7e4eb7c1c0ce249

    SHA256

    5a34bc5842b910f57ce605c4b100595af0b7707a0e5f9a3b82642f06d0172a53

    SHA512

    dfe4ea9c40b48159127d4dff282254e43081d2116e06727b1ff6f7b58fce1dfb1397bfb909387320bb663e41c8cb857201d1d2fb7c687161c4bbb52746d9664c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    21242fe64201aa07f03b15175db25784

    SHA1

    bc90abc659b4f66a15059bfab343bb53ed84725c

    SHA256

    cebbe3fdab7cbb9a631f22d2740ef443097ebdf0ed4a0956b70969015ba6d1dd

    SHA512

    b5b8b66b8b6e913839d0b2969fa92e7f53519a56966b6925759e03710f8d271d3ae6f4583e7de0433117c88cb3a33ba961745deab1ae933fb147268101d6d66a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b6a4ff9c93af081a5edc0fd32c57df7f

    SHA1

    742049f3b55f49c48d320237f7493fafa10f3438

    SHA256

    d6a88eb1bb9d9d40d299d732ae4b50fad1a8b3ac20b7625380f65f57f1651971

    SHA512

    c7c524cb150e8020c154d98cb48b5694d4d3e5a47687dbf5a9ca15dc9b06fccdaf9c3d6f3652a3d9c376d56e5d80dcd8c96abd01f77656ec5dcc4df19aaae08a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    af0f549faa0975110ca610bf42d8bb13

    SHA1

    6d548660825def8de5bb28a4306b55437281fed0

    SHA256

    9610ccfc2ac974f1c7615579649a21a38ade917a71518164d14e7d4abfba6bb2

    SHA512

    d9e62c28916159dd333a014087dfae5f4c6a463f8a30a0246cd095459e113cd0fd3457095782f60236e813b5dc92568ec03b0e4614fc1ecd5f69406aa4463d5b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0de02d7f1cc58918268dcbb86804bda5

    SHA1

    90e0e5b48ee0bc9d297c06db1a56ca8840fe3a3a

    SHA256

    9356be8d95ccec2ea74ddfa7a9ec3ac95e3ea12e951ea5eb4814da9075f1e6c9

    SHA512

    88e7ee460905dba9f4e7f9e6b72982ae023e530711fd61e73417d5daee79a1dbf4670864e1169f98c704927ca7097f84a31cd519550f82b1bf9a2ba6dd562d58

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c527398a524d90beec64532ad6e2607b

    SHA1

    a82e3b23d0ff578e6baf51cf4cc69fcb1dc8f780

    SHA256

    24ee7754532c9466d56ee4da94f9bd1a476d48fd00205a6f7620b19ee3c669e8

    SHA512

    0aefcca5de9a0315c362bdf02530bcb20889d16ad682ad19356b99f46d502671e90e73b78cedaa1c1151a9a2aef3c24e2ba999710c29a5ec67f18bd7bc4a32ae

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\12APMO2Y\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\CabB607.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\TarB699.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GWPYHX6E.txt

    Filesize

    606B

    MD5

    9eec9164ce47626ef474774b88624513

    SHA1

    cd83a06e976c19e34ca1b4d75a9fa6b23438860f

    SHA256

    fee89d1330eb234cfb96b650dbe48f5d94e0828d617e36e04537322e0073d7c2

    SHA512

    aaea37445754ba78bf283cbd172688df90755f759c61f77e2ba1981a6a0282719257a5ce82b843e3b8786090dd07bdce935e81451c46829a00b2fb487bea5d94