Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    29/10/2023, 23:23

General

  • Target

    _rels/.xml

  • Size

    590B

  • MD5

    77bf61733a633ea617a4db76ef769a4d

  • SHA1

    9d7abf0ee4effcecad80c8bbfb276079a05b4342

  • SHA256

    e19238d7a71fa7a2490776252686f70e2de6238c87cd509b5e3a3cc07c2ea4df

  • SHA512

    4f1d48a8273436dbb710bb5f26bdbb701e6c6346511d6ac2e4c7f92db705fa1332e0a4ef9063dc0886e2e5b8b01ec209f8f99890957fee635177c41b09bbe769

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\_rels\.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2064
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2696
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2696 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2720

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cd690d9f51f32e8365e0d2956089c200

    SHA1

    39aa35df15ad9575b0b420a3ca348d7f1e4c1b47

    SHA256

    212a2526685e0bfeca2cc8cf50a339155aeee983dd85157e78d3a355e383036f

    SHA512

    303fb311ce05e6ff800997f8fcee97b02a2cc2311716235158c2e7ec364f4063493c91a6bd55ee118b45049b88b65a162e6c72692fc954c4a9ad315fa130467e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9cde1561afaf57c18c4fade4a8001995

    SHA1

    a14546654afd3602c76a9dbae318b680a6a3c51a

    SHA256

    4689ff588f608ec26b35ec43dec8250baa8c392196f3fd1cfcd8323dcdf191c3

    SHA512

    c9eef1c125c0d2e104bc0b3b0f4fbddd1ed873c936533d2d0938647997b1a37f27b625579d73ec6c2ca11cb592291bf6c903fb5ff2ab96d75afa640def1bd8f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    888b177eda5fb4c6e29fa26ae3aecf44

    SHA1

    26565977fc01dcbd4c0db7e375ad51ae84fae518

    SHA256

    3496b25e6d8647675b804b198b4a5d5d4f016f26d9f45dd44cd0453d26eb53b5

    SHA512

    bd57fe2fc85d015b28751ea7ed0cd06fec51db8e4478d9e1c62d99718f63048167844e942df431d368885bbd1464380e9a276a036e6828fd89093b293c1f0c1d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ed449a7c34adc0f7e3f0565dc2e24e48

    SHA1

    ca6eacfe00b0a124aeb0bd3235b4d5e92446d83e

    SHA256

    7ef567115771c5e8a9fe94f434aa16403a4e15d13fb51e276d2f6a74bbfec238

    SHA512

    437fb0fa5a1cfcbac69bad042a345cc52f48245a22da4164fe874c185a1ddb86910c202b476dc333c24b8a5a56165ddb2c801eac7e88fa771b65eedc6c53f11d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f3bfd677786a6bac73053f19ed0c74cd

    SHA1

    9323a9376f0bfa965d8eb6b0e217e12e0326c87d

    SHA256

    5db6de5bffc70cfec7d67fc2c354491d0b09263b0912bdf2ec29dad998a7ccea

    SHA512

    9c8b3414bbb0ddbb7314cd57767e19f43ee0eab41c7da85c818e72bc23cb3a97fecac0762b44f563df6c11e1426d44026e5d7978f437a6bddd841d3bae2556a9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f8e7aad400a08f45db532dbbcaaf97c9

    SHA1

    450b8998bd28621aac6ed541a76fa22ffa99812f

    SHA256

    48558b08699865c3011ede1de634e305077c15810410b8336837fc3c2a6e4b0b

    SHA512

    982a86733a70c5f61a9a068e1a9648ed5abbd96c9a41851e345c8256fca6fcaaa148e0b783f0bf464e4ecf3291668af99b0a0d07a3df0af9279c6107a2e192cd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f4d97748f1d06d57b3194a51d1b49904

    SHA1

    db6918b206f8fa6262c7f8b9e7e494ac7c0f21a3

    SHA256

    270e51547e66d843162e012986cbc2b0623c6a436ea2b1957ca1359e68b8461e

    SHA512

    aebea31714aecdbd0235e4fbcaad68a0af977268e67f16b562ad19734052e8817fc0250294ed4398427fb6715f9ca1308036490014088b4d825475068055e9ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e28976aa25fba2d6d42ce4740b3a68fc

    SHA1

    42193544127232066f3c5b5e0fcd6d0b71959e01

    SHA256

    f5af631dc7ebf2f73c9f2b0657d14f1422d63ba7ff6913f66804533e5a7734f0

    SHA512

    43bcc9803e2c3c2b5dc4f1cd72ff237700a8d9f9c7a4f9ba4651a687da8a221a63a4c3edb2936c18bd7f76ac942d488f43c74ac853a211747363881e6cc3f5ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b40388ebba56bd445ff21379c664472e

    SHA1

    19d71e9b9213522eaa5f0917b3fb31c9b1638021

    SHA256

    d1491742d71d5321b9d78176c07fea4efc38317482852002564eab78ae52243b

    SHA512

    5bcc8d421627feb4916daf7913ad0a8e64a4b5dabbcec985b38a27b9fab99d5debfc0426bdb598e8b176465082851f99635c6ac91a744ddd9b4a91a1b5b9520c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a107ede411526744264afb6857812d6c

    SHA1

    4e4a344257014b53a6170f9906075c0789d8d5a1

    SHA256

    4ee78009c440ddf33e2b3282ca7526d3e05d7138152fc0473ed4e36288c367a6

    SHA512

    7bcd6d0644e7118bebed9b92a4b4399e2ae4e264766999a51e05214546ffb2ceeac6db725853bdf02cf058dc868d5b10c784157fc0fd81ade8c7437582009346

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    907713aef2edd67ae138026d9b2480fd

    SHA1

    ae546d3aac06cd1abbd39ff8c3ccab1c4d2410c8

    SHA256

    3fae0b4200cb2101c923f9a22c5af688e644308f67633274abee9f7b93fc63f8

    SHA512

    75427cca118b4ac660e1d3929963f57f9829a1474b950512b717763180742b6ac12eb3383e266e6035c29001f622e91e0a005d60b1a2cb6350a3df671c78c4f7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bafa41f9a5d3cce30dc240cd9a7191f0

    SHA1

    743278294d3ecbd560be7781444fda454e0a6010

    SHA256

    4dd7803a5ff77563d9526b0d3fa08f6d9653a6b406c2aa9ef90b5171ec7d6a78

    SHA512

    a7fe2cb7c3ab5837f841a425f0c2f2734f192d021112f2be228f37e01626ddce0dfa398d65060cd088ac6c9f3314dc17f23c9e8c0d5b7123c6b5c3c681e0deb7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b5f1f6f8e8dbf8521d748ef2aec77584

    SHA1

    9b39091e8d2396fcda8ebb327d8e63c4c860e7c9

    SHA256

    a1f98364291abba8c0a0b10f3c31c41436bd71c162f65e290daf7cd8aca362b6

    SHA512

    93a3f803c9d4081dd9ac836d887da4ba011dda92dc7ebc0afb06d380cd7418154bdc6659ef2f62c58324dadeecedb1fa77a119772051b4d25883292694ffbcb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f9786808d6775fbcf5fd41bf113ea174

    SHA1

    748597de96d06b6773e942c8ec1e25e7b47468c1

    SHA256

    0c6eedddc056e3b0c5eccea2a10ce1a8486d8fafbfc399770bbb5ab8243cbd95

    SHA512

    1b7a5a63794aacb9d279b80d2834d597eb30dc737f7d3c95dae298ec2e781078aafec6a8864359485b17dcc0589b15638129f5e2a27ddbb22a00249b301213c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2489d01287796649accfd1cb5788f484

    SHA1

    56b75914f79507e30b27e87bcdadec6a0dbe5cba

    SHA256

    c72d2e27b5d64acd20d7abf2b51e8050e613ea6133ad070a21942193e47affbe

    SHA512

    7e61b5b5ebbe30c8e1be8656ebd4c903e57a02943b38633218b284caa805a383ad705d0adf95d2e2e7e088aeb95dc960ba19f71c735792d4733d62c4abb8b4b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    97e17a3ebae2b6af189ff784bf96765b

    SHA1

    78d1722f445e3c97c6b803cc2e9ffd8182541080

    SHA256

    5d728600d4ab380a17cb07603eb6dcf1aad6441f1c7eadae271fc269a3f42305

    SHA512

    21a2947fc3fe2a717bc80a763f2c371bbda375c784868d144292bf620d0c0953a6fa3b021aade652595b2b9355ee97ba4f96c294c804751e2afc28a995d7a4b5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ca4ce51b98292616a460bc1f4ecfa733

    SHA1

    4a8dc8267dcca8ec22cfb44abaecc885c1a9d0d3

    SHA256

    8d7c709c3becb8fed09a6234290759ca4f70ed74df75ed3b6c75676dca194eb6

    SHA512

    caf8dbcc2abd21273deb8eee8f944082d26a43d424c0a4f1ce8bf33c631a2508f37bcca83209a2df0a59f82f17264535fc524298c2e792a72a02eb842b951586

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    51a04bb4f8b087b15f15990cc5a9f814

    SHA1

    23972470798d3507778ca85ca0164cbca42110c4

    SHA256

    ecc8bc8f6ceffa959999da8ce2882c1f5ae4661e5f82eaee4e35f7937ed76b1f

    SHA512

    83384271ba76d8dead1060f25d149c907cafebadc0238adb2660420adc19a1bcb753ce976e10559b10ea248a851cdf380b24df50c20489dd187b8544293c4a16

  • C:\Users\Admin\AppData\Local\Temp\Cab8B61.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar8BE1.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf