Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
8tragedy_redux.zip
windows7-x64
1_rels/.xml
windows7-x64
1docProps/app.xml
windows7-x64
1docProps/core.xml
windows7-x64
1word/_rels...nt.xml
windows7-x64
1word/_rels...in.xml
windows7-x64
1word/document.xml
windows7-x64
1word/fontTable.xml
windows7-x64
1word/settings.xml
windows7-x64
1word/styles.xml
windows7-x64
1word/theme/theme1.xml
windows7-x64
1word/vbaData.xml
windows7-x64
1word/vbaProject.doc
windows7-x64
1word/webSettings.xml
windows7-x64
1Analysis
-
max time kernel
134s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
15/10/2023, 16:54
Behavioral task
behavioral1
Sample
tragedy_redux.zip
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
_rels/.xml
Resource
win7-20230831-en
Behavioral task
behavioral3
Sample
docProps/app.xml
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
docProps/core.xml
Resource
win7-20230831-en
Behavioral task
behavioral5
Sample
word/_rels/document.xml
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
word/_rels/vbaProject.bin.xml
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
word/document.xml
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
word/fontTable.xml
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
word/settings.xml
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
word/styles.xml
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
word/theme/theme1.xml
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
word/vbaData.xml
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
word/vbaProject.doc
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
word/webSettings.xml
Resource
win7-20230831-en
General
-
Target
word/settings.xml
-
Size
3KB
-
MD5
94fcc0477c2d0b80fbfd3c1f152f6237
-
SHA1
070d89661789646b728a8700d829fe4f696fbc57
-
SHA256
6bde982bb78db837f5f43164421f3022c0fbb0d9f51ee698b596d982ef17cef5
-
SHA512
c48f131d719c324505f8440c8ca7bced37d297d7ac5d3f82e74815e57fd4e26a3dbe4ce33840943c6ea169b97275f6511e77ed0fe05bd36a4562fe5642547556
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "403550864" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac20000000002000000000010660000000100002000000063f9556d98309e0cd3f8594706ed86bc43f1398c8a5097dd277a70e5f01a886f000000000e8000000002000020000000e3d6afbcc7810fa2f62e22f2bd685c3008a0d3e2c7a36e013fce5c2a12cd04ae90000000465a967b7e73868d4a722543945b428d650c681e953d6b4daa2720d0aa9034012c7bf1ae835ad938b41fbbba5f9c4c21a374e13a51181acf7e3157c71168f7c3b37af96d01406a5b2c6a5fc5757f5186291020ab3839d423b4f0fd499ff0d2da5f1eca11ea29d580d69c63895cafbc3405dff3da9a0bd0c4feb1f0cd1109e4fbecb33d3d71495526ee82ae60b8912302400000003613eea52860e0ff4de6e18a5dec06c008308237a1dfb9658740b48713a756beae53a1115ae6b0ac3d44843a7de753c77c33b26b734741d3dda6a7ed945c33f5 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C06FC561-6B7B-11EE-A967-7A253D57155B} = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 404a5e9588ffd901 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f908080c5c8cf442941c5db076e34ac200000000020000000000106600000001000020000000b841db9fa23bb414e74d0f4e1e5486fdef6dc1e9654652a67ddd438161e7a9f3000000000e8000000002000020000000708cbe5366af2e60aaeb63578fbddc4c5246d7c7e2ad9f8136bd73365e952e072000000073496d3d23392650eda7fb2befd489a100792fc63f1c51f3a87aeca0fbefa6774000000064f6fe5430f3d65241ea398a8a4ae082e63a9f8216f3a24df9c83f7a41fd4b8e4657e03efa5651d45b260fa5ad662fa2ec5c236b8a8138f46a727e65620d8dd7 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2180306848-1874213455-4093218721-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing IEXPLORE.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2432 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2432 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2432 IEXPLORE.EXE 2432 IEXPLORE.EXE 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE 2912 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2256 wrote to memory of 2796 2256 MSOXMLED.EXE 28 PID 2256 wrote to memory of 2796 2256 MSOXMLED.EXE 28 PID 2256 wrote to memory of 2796 2256 MSOXMLED.EXE 28 PID 2256 wrote to memory of 2796 2256 MSOXMLED.EXE 28 PID 2796 wrote to memory of 2432 2796 iexplore.exe 29 PID 2796 wrote to memory of 2432 2796 iexplore.exe 29 PID 2796 wrote to memory of 2432 2796 iexplore.exe 29 PID 2796 wrote to memory of 2432 2796 iexplore.exe 29 PID 2432 wrote to memory of 2912 2432 IEXPLORE.EXE 30 PID 2432 wrote to memory of 2912 2432 IEXPLORE.EXE 30 PID 2432 wrote to memory of 2912 2432 IEXPLORE.EXE 30 PID 2432 wrote to memory of 2912 2432 IEXPLORE.EXE 30
Processes
-
C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\word\settings.xml"1⤵
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome3⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2432 CREDAT:275457 /prefetch:24⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2912
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf