Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    168s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    22/07/2023, 20:51

General

  • Target

    GD/Resources/CCControlColourPickerSpriteSheet-hd.xml

  • Size

    5KB

  • MD5

    77ce7c2080d0f2ac65c42cfa4ef631c6

  • SHA1

    9a6fb0127fb661d519cba5868b60835617859180

  • SHA256

    980f92d2867c93f2b6f43bcb6aa05647e7545562055b51edd7eda38a3f6e5dc0

  • SHA512

    255abd0ba5c467ecf79a2dd90fe6768ac0b32a7896ded83f6d79ccea46e20b1ce32224d977ac333df6f96df2fadd711374bc8d6307983a90550855422cb83f12

  • SSDEEP

    96:/y+VHP5/QO5nNHQWI/QOj9kuH7I/QOj9ksHMCmI/QOj9kvHE/QOOiHc5/QORnHz1:aYb06E06D06d902VD

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 39 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\GD\Resources\CCControlColourPickerSpriteSheet-hd.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1916
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2812
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2468
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2968

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fc4168e7777e6f9475d0185b35f9a761

    SHA1

    e7478fccd9d611504927661b93bdcca6e3c9baef

    SHA256

    351f5ef68f61b75cd04710a790751cc442302577dc27e0549ac028f06bca19ea

    SHA512

    18c804a0bece8ac76aec9493d64ada3b30134a100b627fde96412d16ff21b34a02799b23f91f4c2b81e99d4751f7887445455084c95449f5a165fd5292c41624

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1c8279fa55e30bd305b486dc841ece9d

    SHA1

    dd6bb3a470ad51ec65d89ad9b3e9999ff7671c29

    SHA256

    f8417aee1f885dcc46fe343ee7a70f4cec0af4e25e6e202afcfb4a80a6db6bb7

    SHA512

    1d823b8deccdd005443c4dd24a8a9c778b5237abd77253346f029e0640bc78be2dde1c7c20d09ee58de9ea689cef55fb4a60eaf750ec1eb3308c723881b68bae

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cdc00b812806d5a04443697d6650583a

    SHA1

    0e0e5b8ea9d1e303364ea81f8974f30efcd5ee81

    SHA256

    a58977be986d4e06e1d3ff794f61edf02df6ef3cb4a4cd37978911dc011b7905

    SHA512

    7c99ad872d77feb869c5ac2d95413ae830c41481e19e22254214b37a51f8eaa25db58de18ca2485e1b87be25df28363287753a52a3ea3e9527862c3555fe2de8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b9e24ba2878bb5c98bdc1b0a419fdcc7

    SHA1

    8b0ce31b51c16fb42619d3d6a771393be7c2a62b

    SHA256

    6990b343978d2216b68a368f97622cdce92aea9e78b59072b8e1ebfa1fe81735

    SHA512

    dd768b0fa7a61e852b8d0d4ab091089f3338665b699112d3c58c4b09ecc4ccc27f046067486cc998e03cbd89174801c5a313a897860917223665997010987821

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8be167647c9499ceb5415152897058a8

    SHA1

    5014439632f19c3e4d5afd1b097d8b553a7d163b

    SHA256

    3481b10cb4dc6f4992976e3ce69a4786bef3e61470fc21f3c9be51e3b4e02c6a

    SHA512

    a6fd962c329eeda6a72ac91b9254112b7b015ce52d24b12a4d0f31835a12408f0f6aeb047070e7db4203994f0c653b6c03b4e4aa3c318ca953493dcf44c63d52

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bb080a85361b05db35060fedcdee6bc5

    SHA1

    8fb525a00ffa33c956854b496376a0998b0ea357

    SHA256

    5a5b834811638bc3000e14ea20315bcabdc0f23508241ef92bbbd9269b16d4f9

    SHA512

    834c2e8a51711a5082cfeff544b34ae9e156554950478a7eaa3720e38cf8dc2ef1697639f0a4d9f03bb4e97705f48ae96ffc834c10a2b64b584395d4aef58eb1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9e203b773266948d4669b12fd0d61d58

    SHA1

    b943d8a293e7cd163f3a3b8a93cff2bd73650628

    SHA256

    277ea7abbf67c21b69d2d0b1c21b005c92cf349609b9dc29b26faf8abb6a4439

    SHA512

    2d60615a076fdd0042f38f2c31f331790c316a536c2a2cab1c5244804d0c2093e411d81f33294a66a70ab221e0ac7dbaef981004dd93d300e04d16668321227d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    38d867d99d870c281bf037452307d052

    SHA1

    ec946b77b07bdc9aebb45d14e1f1f91a27a7a6ea

    SHA256

    8fe80496f211d3e8419bcf78b77e9479e9d3a0300c02997a8465fc37a3badb36

    SHA512

    56a4f55259eb170cebfee3f2376302103db3577e8adbe050b874e872237f35722af96307ae532e830334f80d8706ee6f387624b2a421585dbd6b0f5537d765bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    36b78ee5bddc9092e0aeb3c15253fe51

    SHA1

    a77647e9e6345690a5d1cbd33af5f245842e06b3

    SHA256

    d03e9cde8ec0155f8c09ac084e9dfefe27e363c8f23c26f146321e985c981d49

    SHA512

    2b28d0e7e26ccadedf079adf4f96d470e821bdffbd168f2cb21d7f47762fe9f7568ee0942896f10af737bd9749ec87984c5378ba26c776ef344ba70a30def553

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5879920445d331e997beda82e9dfae6d

    SHA1

    1d66950311e27909cde5a9cdb5209094a879f2e9

    SHA256

    548be33036a33c7ea53e2b36d71486616539bb31ed574e4636b94c00624f7826

    SHA512

    0ea485f38ec7eefcf90d8a2c896b30ee6acf1bf54c04522319e22eea92d9e112a144e6d7229c40f4b15362597581b9db1cc044ba176ed0012951bca5c13bf59a

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UORESFNG\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\CabD1E.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\TarDAD.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ET2OO8PP.txt

    Filesize

    603B

    MD5

    924b480b33cc33dc34183d191eb2ba19

    SHA1

    e26b505f5d1dad30a3e8bb6dc4619ae4a15840de

    SHA256

    25f16d05f1bacfb6bb817c51ccc80f6e2645903e8753ab87893dcac9fef0367e

    SHA512

    9dddc0f3f2816c8f116fdd7719a740e079303d9957e8c849af851ba5121521e7d1cbb273ecc99a4ca212be123fe95e428d8a9d25a8852d9a446c8bf25b0969bc