Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    21/07/2023, 14:21

General

  • Target

    rev_3286/AppXRuntime.xml

  • Size

    3KB

  • MD5

    88d794ea092ef395433cfa321d06e5e4

  • SHA1

    f1f7c7dfbd04ac5a92cbde88bd4f087781d63c40

  • SHA256

    5afc969e4212a6511f307385c99b8868e8c873183dc271bbb95ba571b24eb53e

  • SHA512

    ebb770102b8202de4bb7319cbc2cda860e4de5d1e95f0fbef4d4890aa2b22cd48cf73909d028a37b507926b4fad573716fba16e50b8f9eca8d5feab00ac17cca

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\rev_3286\AppXRuntime.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2096
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2900
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2832

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    111c7cac12af509c3b5c3071a7c86cc1

    SHA1

    d903c572f66c379b48d9d32cd41ab879d9aac62b

    SHA256

    a21f837cad5a1b403ab23f03e9b0184b0bd2da5bc012c73cc0721936a28e16eb

    SHA512

    2cd14e3de8ed53465fede0334a03b256b0a04498b15b9b94d2fdf86471342f392981f713d8886ed55cbfd627de1a149d45fe21c96987f50e225846b114cb6a5a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d7ce2d8983313240a80371948205fca9

    SHA1

    eba46aac91ff0040af46b9700308b45203ff8fa4

    SHA256

    a4a7c2de03a60b055d6d0ffe53df85cec82a3224978affc7931df851a751f505

    SHA512

    dd9da1c02884014b52c6a4bdcffc04f4308e20c509c5bf2acfaa5649a39346245cf2521a69d1792086de841ab70f33a1cf7242bf48c9a186a30fbf194549153f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1c2692b6b4b4db73e5492fb97af8268b

    SHA1

    31122b411dfd18df3b8a8cd04e297b4c01bf74f2

    SHA256

    29b34725ef819df16ea7964bff60b63d39bc064ee18044e83550b7572f421787

    SHA512

    ca9ab9b76b97c58fd95936f222abda83238c4b00636fa3fea3faca2e2cf94de15d84d065ab0e2b16bfbc33fef596ae214f49e70d3e7b865e341af86d172d9acf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f45800940c43d383c1b53abe5bdb6a95

    SHA1

    b7a22ff4f00e9871fca048ba18d3bcc3488788ed

    SHA256

    9b1b90a7f5257d743f3918df3a6363a800500e17feaf1e0192a9372c985d53d5

    SHA512

    725641f70f316c2fef5419c782ea24636b1b5968a0aba34c17de0e22cef1a4d33399c1e7b11e58265502025bfa5ff88abeece7ef4cd42817a9456c27364b0ef7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4785911440560deede0cfc4b81563eb3

    SHA1

    724e93e4d8b9bc800fa52181983553f430234f3a

    SHA256

    3f389f38c6c3fde3797741c1152eb397f35ff6269b4185b302ce18c7c147e38f

    SHA512

    75bd974c81858addf083a42764ac129b75a7a9e7881161b1a9fb56afdfbf418fbfe231c8f11610757875408f2fc9673992234cd4a14dd7852c7144b0981b105d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e5d2eafb9978004607d1723398596673

    SHA1

    7d1c83992aaa85169499d3289bf511e480962f3d

    SHA256

    3b6b732dcff702a0c6f4cde2edf121e4441e6a747b230baff9078b0752965900

    SHA512

    2c443d4919512fb1cec4793b1a1af25861d085a28f97df25ebcc66bc11ed6200426fdf3a8f656f22f24f21ad7b0e6a10d292a941c310026779ba1cc69853ce46

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8629c6950d0f1d09db27d22136c6b244

    SHA1

    e13806160e733ffb8427f502a345ba68cc45578e

    SHA256

    04b43388118026fb0882a934bf8ec9374bc6dde647a1997b316b3adb70b2d41f

    SHA512

    197ed22c2186775adb616766fade42197345745f60d480a8fa5c4a7617b877d9227f7d048bd5dd8b62e2a25c3e207fea0230a7fbf060f71e17f1de269867a1b1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    aed7e2ac7d9212f0fed03ca20b300dee

    SHA1

    781759ed44230c7e17ba8d0ee8f24512270ff58e

    SHA256

    40509080c880b2129d4a5b0c22298c2d6217b63c32df75f083b76b9b719a3b36

    SHA512

    5daaed596cbc9332addd9437ecd9de09e953be65ff32dfe5f2ae388977555013b0dbdf9e9f0216fb91e67e72542fb9e0be5d9d87463d67f1c1eda9b4283f3b1e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    051554da3d29cb73c7c294ca2c5ad547

    SHA1

    177234709e64877b3e80ef055f5aa58ed0bd38a8

    SHA256

    d451d1f8882226aef0774930e90bf7baa2a08e1f24d2f86a294fdbec34938e72

    SHA512

    c470698662a0ff2b1ad03f6d5a7e484008376a4d7b178e475c05f8d84de9dc8d651809c3ffc37f415dbe73fa1e4df4edaf28f3051f5ec7f9fea813720f841600

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bfdb11abf0ef9834fc821bda8c3c9ba4

    SHA1

    2ad0e2a28e1d08a98d5fe1e560e0dcca75c8d3fc

    SHA256

    9cb86b4c817290f3ca8683a2ffca66b8b27df21d30f25d25e78e6aae6ca76d44

    SHA512

    d724180ee3e7581a459253a3b8785cc3169a40b726549a05ed7c8cffbd1f58782410a8097e3a01d4b04cddbb21616880b2ba10b3e54076a9bccb49890ca8f29c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d64c0ae38ded17eea18abff4b0f3ab9d

    SHA1

    488c086194839162e3aa064c2ff3528a5722e917

    SHA256

    16de82b767d45d49e5e59d63a148d9f9ac1759392761f037640c6bc06f07e3e0

    SHA512

    0275680a860ac158cc1ad6a87284f043e6a524674f4034c11e074c7b75c7feb6ef2274fac93dce3eff2ac79ce2e44578ded7d5ba6f72705bf34ee0a850d0866d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c1d64d67a2bb1a27a174cb7fce339195

    SHA1

    3eb714e5f1af5eb6d54e39acb1051c062f4d3e01

    SHA256

    1c11d20715f63409cf25cd69f2aef01249a45e6f6f92426bc63728d0f7fe67e4

    SHA512

    cca4e906efbb868c4b7f3b8ceb9fd0f15c68eb6103492ec6ad3f61d8e3ffb6e80a2e92ec4dd8ae9888c5d2f5ed7097f792e7bffc8962308897135162bf1ba35d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9fb0d1c2a949a81db6fe803a4b9ab903

    SHA1

    4ca5ba48ee06da684e2b1b03ccef41112033c048

    SHA256

    acc6e8becb4c7b0a20556805f5204cf2d70d06695b91ed42a9de7d31f869373e

    SHA512

    610e1300c1b2d6dca0adc447f8df5cbf23de816e898284cee0194a272cb89dc8449a0043cde665b7cf656bf7ce1675139e2dc7d78181d4db743ef2edfea55a62

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UORESFNG\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\Cab2629.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar26C8.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NX50H9YC.txt

    Filesize

    598B

    MD5

    7d73d51e9c7f2c4b28fbdc11f5b9ac52

    SHA1

    5e5ad537544de465c1b42a148e814550242caaa1

    SHA256

    764a66a5e6202f78eb629fcd74494b1a99dcf239b975a5b91eb31cb1e918c9ce

    SHA512

    2fcbc633b04736528619b2132d81a51eda07cbe46650bec56fb0802a0437702a51b13097b2817a3fd5bb28177cf6546bd5bf8c492d362796e3c6655eab422f45