Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    139s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/02/2024, 00:10

General

  • Target

    wPalw_cwukn9gn/About/en-US/Biometrics.xml

  • Size

    4KB

  • MD5

    d8d0bc5b42ef7ea543f6a433fdd55e29

  • SHA1

    c206420f5f08f178330c5bcddbbd22ba92f32f2d

  • SHA256

    4cf64ea0a9d948e8779813e0b785e12765598d8ed2c5823bf0fcfe454cb66d6a

  • SHA512

    2aa9481541fe0ed55da25a0a6e36f2d1603ef0387f52a60b42938bd98e338cb52e261cf990bf0465f134333cbd231d05e43a412a75d0a4860b7990c92585ee5e

  • SSDEEP

    96:oD5pmJxp5A8M9DIn0C3ppMdiD+QPCRyVl4qCV:+Gp5lM9M3ppUiCQPCs4P

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\wPalw_cwukn9gn\About\en-US\Biometrics.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2360
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\wPalw_cwukn9gn\About\en-US\Biometrics.xml
      2⤵
      • Modifies Internet Explorer settings
      PID:796

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2360-0-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-1-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-2-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-3-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-4-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-5-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-6-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-7-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-9-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-8-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-10-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-11-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-12-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-13-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-14-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-15-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-16-0x00007FFE375D0000-0x00007FFE3768D000-memory.dmp

    Filesize

    756KB

  • memory/2360-21-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-22-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-20-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-24-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-23-0x00007FFE38760000-0x00007FFE38969000-memory.dmp

    Filesize

    2.0MB

  • memory/2360-25-0x00007FFE375D0000-0x00007FFE3768D000-memory.dmp

    Filesize

    756KB

  • memory/2360-19-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB

  • memory/2360-18-0x00007FFE375D0000-0x00007FFE3768D000-memory.dmp

    Filesize

    756KB

  • memory/2360-17-0x00007FFDF87F0000-0x00007FFDF8800000-memory.dmp

    Filesize

    64KB