Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    158s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2023, 14:21

General

  • Target

    rev_3286/syscond-en-US/ActiveXInstallService.xml

  • Size

    5KB

  • MD5

    46876b1e6c8ba1fbf3abc838ccf809b0

  • SHA1

    45ce70edd0ca87a5920d43385066087df134e30f

  • SHA256

    f49428cabb6f6671d95ef214133100c268d2ab04dbf0f095dd08b0105ed9d8a7

  • SHA512

    702c319b2d181753be99d99c3dff9f6c578934067c89a614e9e4b0a5da6a0fb3545a3ba4986e12e9da5de8c6af56780982d181a8d949a6e573af725e2505deca

  • SSDEEP

    48:cgeD5x8gm0fUsPXKn5o3OqALPLFS31U87GUkNAsGNuiYzXmoOX1mTXoWlIGe0FsC:LeD5pmKeC3G8SsuiYR1Pl7e0V4zZpBsV

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\rev_3286\syscond-en-US\ActiveXInstallService.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2844

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f1175ea4eb2b92546641a6a1efb88c02

    SHA1

    24b483c9852b55744d6325d1dc05f5b98313bfb5

    SHA256

    5d706496dd3055cff9fe62913a8a7571ea3b42fa20a87b82a2abbf5e3bf1ae5a

    SHA512

    5372a9477a77c232ec3dd1738f341b18856e897ad1c5becc858fcca82b3cb2d85b87913a97499d2a6155c664f4f0f8b9fc79cfee05b4b771dac52c6ed85cc4c4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9ada0928a43e390b7ef9554a738d7029

    SHA1

    ff53db1357d4464c75e7ae981cea9f16a4701d6a

    SHA256

    29660667314f23680883a3edf983abf50ead63f787166a98de06ef8bd978a51e

    SHA512

    70992626084a0159cf873a53f40473959b6d2e617202a547822c0bd9b475c84003548adc40ca331cfee59639876816eb239b6bc139b982ea4dafbf6784ceae42

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c4d09e7bc90cad4e8d8f84ce299c05aa

    SHA1

    bf05b04a360fa50c7d535b15d9162994c6af9480

    SHA256

    f3ca1b138af3602141b021efb65659796b1350222b5e9d01d72465b3e2c74ae7

    SHA512

    72118cc8269a46f47e81f730876bbbcc4befaf9adf71850357d00892ace24c1304950abcac70d12ba890d01cc1f0d95085c99e4537b8c92a8d18c91a08f696e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0bd4fd9517cc1477144664dcdfc5b505

    SHA1

    b4c3af7a049398b17fd8e0eba0168a6a5aa43039

    SHA256

    29cca02b55c6aa24719e68380d1fe19464aab82798c1b96e817489997b14f098

    SHA512

    8fbb4eb1d08b3fe9cfd12bf8c168355cb8a2dda0f34c6de62cdf7b8c5a871763745585db42ee76918efa5dcf85578346909739b67829cca7c00080392c9b532b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b9b0081f70d8d948efe12959944b3c80

    SHA1

    6cb7bbb84aeb0ba1c5e92d889096bb18a430bea7

    SHA256

    3f85743fc5a1aac1f7d89e6345cad4f174a11cf77f1ad096998f43f7b8c27004

    SHA512

    ce4693dbb4ef6d410e17071a7485dcbfc4c3aa62bc4489b8c6bfd861ade214167568b9b84b90e91bdf1a91d1a68ac0c8edebf979d572d9ede3473a133de581bf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6867742ff75d144a7739b296b9cf0a4e

    SHA1

    ab4dee11089c6dd0f00793b886f2b9aad759b5c3

    SHA256

    85c051f22bcefc8923b2f9ddd54d5047269ec924de7f084d1b7c5e99239f8999

    SHA512

    c1a6be1aba574ad57a8fdac691cb1f1a74d9dd4002024ab6cfd4aa32664daae724c4b82862a796311891ebe22bb804f94de7d16a63fa333a670601eb90bd65c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c61421cecda126b060989e0c4be0b0f8

    SHA1

    9dabc312cbba15eda4253aeb7ab500ed183bbdb1

    SHA256

    574906d70a7b4eb0127659095c9e0678ae4e5e74ffdc56c00088fec6f134230a

    SHA512

    c3bb2526a0345310f25ef1a0536bdb13ffe84492ad8635e7a527bc7d5785a90cc93292de94a8e7592e74120335f7a473bd882cf9a0f55a951bccb1188ffc8e76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d89b69dc70c81b6bddfaabc890fdfb22

    SHA1

    3f496154e7d306369fbb0740a974929d6ab0e427

    SHA256

    ade1b1f3dd17b2c72321b49876bed6bb27d31c745740d3fea045b32a26707181

    SHA512

    70417084d7a95992eec17dde70471600cb1d9aa79f1539723bafbe1e44f8f21f0eeb061b5e4143fca0a7d74f725031405549a5f45f1be61037b6bac60f9c87d2

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E2UNMO2B\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\CabE4C6.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\TarE546.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\J7W8SH6L.txt

    Filesize

    598B

    MD5

    0be7d387e9abf5389d7dce0a4f791bb6

    SHA1

    0932293022c0144955799859f96029cb99eda37e

    SHA256

    0e0796c11280be309840a6b1c09e69aef76e11d4747f5bbcf95ab984145d10a7

    SHA512

    e6063af96e5e05987521bfa9a0d4da6d07fe15f5fa5559a9c388eff53252083da4731a6f1fa86edd788a73022025b6d8f14352dccf12b6c558ce1bcf0ebeaac7