Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    26/04/2024, 16:16

General

  • Target

    Nihon.exe.xml

  • Size

    1KB

  • MD5

    7d19eb310a21b0aa152d02e3f5d98693

  • SHA1

    c53b56aaa9e15d4f6cc837c490bfc4be19ac01c3

  • SHA256

    6aca3177b0fbba5bbffd7163645ff5d74f97be015c916893f6b761423a90f4f9

  • SHA512

    2722497034f387d1975b0fe34e9efcce330159771d59e5b1fbb3948277a5d3a5c80546c6872166a75d8f1471c660784c5bb98ddf60bf796211387a14bf117a4d

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Nihon.exe.xml"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2948
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2832
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2832 CREDAT:275457 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    092593c2b2b4792dbdc2c9bad9a8a92b

    SHA1

    f1c164b53c4bc8b83df7cb9d272412bc4ec355d8

    SHA256

    c1bb0a01fcfa3885572dd57edff8926403a7c0784ecd1e68c851486adcdd6484

    SHA512

    c541be20714493c10faf0456aa1c6d037061c0f0df6e24314a6a46dd3bb43d2b1aabff385eb3ad40e0e18b1d7117927b044451ada59635cd364ebf461339b6a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c1bde023194e69b1b8c22619d5739291

    SHA1

    e7cf0e3c1405ee4c2c8b380f7aa2d25e60a9e19d

    SHA256

    bb3f6fb4d233fb47e76b9699fa3d3c6a964f56b4c2a9d14b7cc4cc91228f6452

    SHA512

    93cb44afcc4ea9f0b91f242bd0ac0bf01128338e6c262ca4cecea03183f6c1bf2799d55e2f314f4ba48d6df14fb760dabc774b56a1607f5b38d9a94c4ced45fa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3214b309b60873f0ae497198bba1c266

    SHA1

    cc45c0eb71e5d406ae20e8aaf2efe59b305b5cc5

    SHA256

    63e217b287d12df1e12f5ba784591f3b7b6cfaa92294f50faf3fef3af37a54db

    SHA512

    073a96c2b300fedd0c77e4bd2c91a215c88bc599499718f6a47928fb0754e513a8cfd7853709ef9643f4e3e313c1347ffeb47b7d1346eb462402310f4abcdeb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d3635bb88da98461fd7fe1b2af3a1a6c

    SHA1

    c465e4bfdf0f2c9aa594721dd53e4b2e09e10376

    SHA256

    6b1daef6edde044da5c67dccb18ec556beb4163d0c895529589348d23fcfa916

    SHA512

    1c90fa7b5edf89a8ba90cc5ba902a8983df2c5a8a0fd072775b5688fa26f02988310ee028f0bddf3eeb2631414dc94ee5be7d09a35341b0d4b3ddaa3f73d44b8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5410f49d26305c59e4960ed45a0e1ab2

    SHA1

    878d68ad29575b367e29456624709cc69f2da3a6

    SHA256

    15e451a788e7873dbf2cc0321b9795520f5b6855977698328a0705aa2d4557fd

    SHA512

    f4563dab90a78e7b63eb8a16b79caa1338ea76cede87609cdf11645b2bd6bcfc41c2a3ea053868b3b899e0fd762571c7462b60af384d15ff79367444b98112bb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    95d8a379e1cfd640fef3c633e4c6d758

    SHA1

    561ef672fb8562560520d5b50986d96411233801

    SHA256

    586415ff0c7c7817eea96cb38733dcb3246111bbb56c9f2326dde11b2b3d0647

    SHA512

    f8e102158d222c9701d96693d1aec91c19dba014ee1de414927621c47373aeda52ead465925ee2432193d1affb09f9a530de846c666a254277015552527f211a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    603a10d53e6093d7991d86eec8d0f762

    SHA1

    5dd1368f31212047ba7e7a95054818f9415d5692

    SHA256

    43604ed71086e6dccff6aed03c2c74f64653b053f31a3dd5684d1ed649a19b81

    SHA512

    3fae24cf32855d561842e816d71f968ad2f744aaaa60b7672697759771a5f69cb84cce3e7daeb5541ccb79f63f6dc276ef65477c6f4b217074274b54edd07d74

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    55a7b2a40c9a9fb4c0c7370930ed6997

    SHA1

    34f54654a29ea3b26a03d0846c8617b0266beab5

    SHA256

    728717fe2c84eaa23d63fb91080c5099bdc362a0bcb57d9ee187b7da9739203d

    SHA512

    cf8fe22c87404468c675c490e04eafb1273f0d9fe104e71caddaf8352eff8c1662c27c00a5c61fc76f43b038986460ff142c00b94a83a95ecc429f927e411c13

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    588896d76afac749ad86c07259a60783

    SHA1

    3276bb4a0c62c4a76f380ab0abf0a9e72d83dc4c

    SHA256

    0a71edcd3518f7fd63ee67d75b6d145c0fe52cedfeabf4de525bc4d206f977bb

    SHA512

    5eeaeadf1aed31a9f99b2213e698b6ce1067fa42b5e297edb67bd54cff11b97f6c2cc39f189c5e1d78f327ba8ade91ddcb2850e26800e1ceb9702598aff1b319

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    aeb05e4547fa77af7c22f250b5005172

    SHA1

    526bdadc8e20aa51196e21502d1b542aa7f8831d

    SHA256

    8a719cc8f14a670c99e01d8d86dcab8c9f04bd41d42d9057b7e95d29eea29f5d

    SHA512

    a998df9b70c79897f41f0a075caf689840523788a698c906cb3138296acb03a5e4e03b61294b579788745fd8735907b003dbc1f3bcb9cc222cd00bcfd914e0c4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6b9a60c1c414f6b1d111b9960accdff0

    SHA1

    f9cd976f11f4ebe6e1cc8183a07008e522cd9a50

    SHA256

    d4fb5de2f31a2bb2ef92a030c08eb1a0dec817f5ea06f4e0e371b7b1ebcb2b46

    SHA512

    7b190db9c1d9deed89d61c88886af0a8596c29ad0d010ae87fd8e70129aa9d48b00917767c8daac02d6b208db7abbd4447ae371bfa6c6a0f5ca81a307b9e3b45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b810010bd78f4641aed044afe4e0ed61

    SHA1

    55894cca633d82d68e0400675bfa20d92f225ed1

    SHA256

    c6668d5893b2edde7c9474c4ee24c0a1163aeed310712469c80395d89a03a119

    SHA512

    91d4767f24a1186252fef8f3bfbf79f7fb7d06cf869a5a1a299016a690b69ed48d60539fb67059ebd096f9e00722c0dd38226d02b7e6ff75a4a496677d35d5ce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a8c0c90d83bc4402636a626d5bb5447c

    SHA1

    b327b840e3e3a21ece50c0bf9a39494791ada31d

    SHA256

    98c3d782ddd4e9dc5f958e44adb05a77757f8d63bf778275e3d8f030f4373378

    SHA512

    72a359b2fb37afff1b502a39f6832c49ec155a73a0aa1a9b752e9b577e7fb018e8152c31c6dfa44a5c4fd3076e7fe19a3cf01b8db8616a3778f60dd7b7847920

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4ce97a82155f3ae069ed7a19ee4e04f8

    SHA1

    226d8715090ad7326de1a05e12c333ccc7a9e8bd

    SHA256

    68278b9964b9b296ab9fa0eda8d8f94b3ccc0e270db961e10c93c80f2262c885

    SHA512

    d01cf18ecf5f01b0fdc289334538a3819827bdbe7ee02cf6a45c549b264c64cfa46824b74c3245a2f4bec7b1d426677f4df24dff171c982ef07f4da58a7491cd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    abcfb53130cc62d20e5f01bbfff36893

    SHA1

    ba2f179a18877fa936f883ad02f2da5bb9148253

    SHA256

    475014d1933c4e594e6948880d0e1bb65a7096d9f79611749e7cdba6a031d8e4

    SHA512

    2df0eb8557ca4af92ed9cb0f9666f1113f99e220f56d2692ab8d0e3767d8d38c0a668b6438bb02441c7e36b600488002ba904b4b9ef417e2a39f8991e4082e71

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f9486425f44895d6efadb97ab46dae53

    SHA1

    e89724022efec9fb9c5a336af8f334f32ccc2461

    SHA256

    71577c71fc8fc6754ab6a1cf12cc8bb4496a50a76768bc83987ffd3e3c8e1c29

    SHA512

    7cae241eea5c248b8a4d7bede9d10ae9c63b3637ecb1dc177591004f71e0bc088ca3c5b332f2062971267c9c999a6df21e65478f27020e09a1a87daaa33094ca

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7ffd4247f64cc16897639ea88c642aa0

    SHA1

    ce7834030adced9102c6526b409e616fab93f4e1

    SHA256

    600f891915403601966de444ff5137d806caf57a44309f31dbcdf41329dda822

    SHA512

    e0548df08308671dcaaa3ae2cf03eeb9b19f313b8aae30e0c590dfed1850081efa21679516a936a99aa9cfb24f968ce6e2e77f7e272a5068317b1e29ecfe3da8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4258c316da2b4b2b41ededc6f5fcf7d2

    SHA1

    4a505d484055160ce45a677efaf21168d2d52401

    SHA256

    90b5f5472d2c530f9c38fc3cea832be644dca0bb0983e6b13188cc66ab878e55

    SHA512

    08c9270c11e8edec7b54ea9c839d83faabb22f68569706223bdfa88408f23604e445274bf43d11f7cfe2265b1163836a642dc138cff71c2a87324b224b96e5e0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    443eae2371330b4a5555a7c2aa19a9c7

    SHA1

    612408d330ddcd39c1aabae8230c6f372a330635

    SHA256

    e48631a4fde7b9d0f909edf92d662d02c62f69fdb5179f5bb0474c28904ce170

    SHA512

    60c66ba4e664c7f30c91629623ddeacce6ac8cbd6a1ee9e0a3a3b9a2ade52c910dc42e8bd256f5545be46e1477c39b08f28ca4d4271ba3738afa4c747461951f

  • C:\Users\Admin\AppData\Local\Temp\Cab4B17.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Cab4BD4.tmp

    Filesize

    68KB

    MD5

    29f65ba8e88c063813cc50a4ea544e93

    SHA1

    05a7040d5c127e68c25d81cc51271ffb8bef3568

    SHA256

    1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

    SHA512

    e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

  • C:\Users\Admin\AppData\Local\Temp\Tar4BE9.tmp

    Filesize

    177KB

    MD5

    435a9ac180383f9fa094131b173a2f7b

    SHA1

    76944ea657a9db94f9a4bef38f88c46ed4166983

    SHA256

    67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

    SHA512

    1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a