Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3rmaildxp_v...ll.exe
windows7-x64
7rmaildxp_v...ll.exe
windows10-2004-x64
7$_14326_/$...st.exe
windows7-x64
3$_14326_/$...st.exe
windows10-2004-x64
3$_14326_/B...er.exe
windows7-x64
3$_14326_/B...er.exe
windows10-2004-x64
3$_14326_/H...x.html
windows7-x64
3$_14326_/H...x.html
windows10-2004-x64
1$_14326_/H...d.html
windows7-x64
3$_14326_/H...d.html
windows10-2004-x64
3$_14326_/H...0.html
windows7-x64
3$_14326_/H...0.html
windows10-2004-x64
3$_14326_/H...1.html
windows7-x64
3$_14326_/H...1.html
windows10-2004-x64
3$_14326_/H...0.html
windows7-x64
3$_14326_/H...0.html
windows10-2004-x64
3$_14326_/H...1.html
windows7-x64
3$_14326_/H...1.html
windows10-2004-x64
3$_14326_/H...2.html
windows7-x64
3$_14326_/H...2.html
windows10-2004-x64
1$_14326_/H...3.html
windows7-x64
3$_14326_/H...3.html
windows10-2004-x64
3$_14326_/H...4.html
windows7-x64
3$_14326_/H...4.html
windows10-2004-x64
3$_14326_/H...5.html
windows7-x64
3$_14326_/H...5.html
windows10-2004-x64
3$_14326_/H...2.html
windows7-x64
3$_14326_/H...2.html
windows10-2004-x64
3$_14326_/H...3.html
windows7-x64
3$_14326_/H...3.html
windows10-2004-x64
3$_14326_/H...4.html
windows7-x64
3$_14326_/H...4.html
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
21/08/2024, 12:10
Static task
static1
Behavioral task
behavioral1
Sample
rmaildxp_v1914_eng_full.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
rmaildxp_v1914_eng_full.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$_14326_/$_14326_/uninst.exe
Resource
win7-20240704-en
Behavioral task
behavioral4
Sample
$_14326_/$_14326_/uninst.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$_14326_/Base64Helper.exe
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
$_14326_/Base64Helper.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$_14326_/Help/Index.html
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$_14326_/Help/Index.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$_14326_/Help/advanced.html
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
$_14326_/Help/advanced.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$_14326_/Help/help0.html
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$_14326_/Help/help0.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$_14326_/Help/help1.html
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
$_14326_/Help/help1.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$_14326_/Help/help10.html
Resource
win7-20240705-en
Behavioral task
behavioral16
Sample
$_14326_/Help/help10.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
$_14326_/Help/help11.html
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
$_14326_/Help/help11.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
$_14326_/Help/help12.html
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
$_14326_/Help/help12.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
$_14326_/Help/help13.html
Resource
win7-20240705-en
Behavioral task
behavioral22
Sample
$_14326_/Help/help13.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
$_14326_/Help/help14.html
Resource
win7-20240708-en
Behavioral task
behavioral24
Sample
$_14326_/Help/help14.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
$_14326_/Help/help15.html
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
$_14326_/Help/help15.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
$_14326_/Help/help2.html
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
$_14326_/Help/help2.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
$_14326_/Help/help3.html
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
$_14326_/Help/help3.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
$_14326_/Help/help4.html
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
$_14326_/Help/help4.html
Resource
win10v2004-20240802-en
General
-
Target
$_14326_/Help/advanced.html
-
Size
13KB
-
MD5
c1a1e63fd815f24951ee0c3677c2116c
-
SHA1
1ea584b222d359209dcbc5dae9755dcb534c3abc
-
SHA256
d664e3ce79957058060fff3652dda6a14856f77cb676cb924ed744f825b4f7dc
-
SHA512
517c09c5b3bac2366be58f420283d92bdf5ce930f7f824f7f668261cf8603f7c313a30726a24d9be70df84cb173df395c557a94956cdeae48833f1342c1d8cee
-
SSDEEP
192:ECKK/3YIqdJMaiLy+LwZPJdSOMsHJMJPClT5HTB:QK/IoyxXMCXht
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{62DBE701-5FB6-11EF-AD79-76B5B9884319} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40307e37c3f3da01 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430404115" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c000000000200000000001066000000010000200000008ab03553e4ea4a57255c8efe7658496d9faa86b8e3fa6f37ae6cfdb0c621750a000000000e8000000002000020000000d095162ce4b08e2f474bf1e7cde0fd6dfab4fa0a3ef0abda1a6488c2b65dbd3990000000695f7a760010b14709a02f50329bc0e63fcaa048992ced344a7928d140514b76681871c46d8c1bc301fe931c64ab2d8902e42553f3905000d81c45863e9388fc9a039039d8405974c563c5fc42263bcae3fe5f74ca467c135293cae2432861b44b830f209d36bc4b01a147c2ebdd43716cb30752ef0837d69976f6c1bc8c24f6d74ca7c31ff7e3f45a145c52d5fa409f400000002e39a82b5b27aa94139221fe0d366cf39ea49af7e04937b688361a2896c5c3eff8db6f56453635e6b2296671bd1d794a1a6f8776ab819782d061ca6b47618534 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000007f224e6780fba586cc0375bb0f7c293dab2e2aa1bb4caaedf365766c3a137ac000000000e80000000020000200000006d1981f87f2b6eac51ec645aa301fe06b96a4e94efa476e9d7821dbb27afce1c20000000d47fb07af5656ca38c3efeded706f1b0ba0550e7442bd045541491c07b77eded40000000c8478a00cbde85f4c16aeab71ce326dadf0c5ae496e5e5a64db150f214503c49ddde74f4d520d8b1b63b9150945080737fec9eaef6d35898473f33e3187f5750 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2604 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2604 iexplore.exe 2604 iexplore.exe 316 IEXPLORE.EXE 316 IEXPLORE.EXE 316 IEXPLORE.EXE 316 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2604 wrote to memory of 316 2604 iexplore.exe 31 PID 2604 wrote to memory of 316 2604 iexplore.exe 31 PID 2604 wrote to memory of 316 2604 iexplore.exe 31 PID 2604 wrote to memory of 316 2604 iexplore.exe 31
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\$_14326_\Help\advanced.html1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:22⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:316
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD539e9c0e1b50c296892faeb856994b818
SHA15ebe554cffdeaef9a9ce1eea257b4793da9758e3
SHA256f9f084ada5f9a6dbb7a4c0ce6a4e5fdff5e45e8ac92605819f5f87506e79c562
SHA512055798079a49811addaa9a7d84c4a38a1571e58ec00cd7d1c1d3699d9b844a33976630b5e6f0250d8d82f9c2d42f29c1d0474c90992731ed0fbcccb7ec6908b4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5aac27d4d1e6bbe4646b32c11944831dd
SHA1eaaffa8cec8bd95acdefabdfd6ae24e460a20e65
SHA25626d94990b4f8faa66308ed55afe577a83dcae8dfbda7aff35f5476bfbded2e1b
SHA5125c10eb3c32e9abe6468d8adb6a8d99f0dad1c5fead40160512f97c92ec73286ff806d5a2521b0ef5d8aadbaa26d6cf426d2007db205880998006d2b0f5bfd984
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5c2d8195496426a82c9eb2ccefac85d34
SHA1ac0fa0e5265dcfab6faccd1fc4d7f788c24ae846
SHA256efa045ea4af0fa8758f4c4fdc79f21ac054a598bc49d877dd440cef32776e500
SHA51221fb5f3ae631f615f2511738775459a38b3b7ef20715f380a54009c8541284fcc338aff8be034289c781c6862bb2f8dd851b05d9e0a3c85e87ff527f50c6d1a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD568c34c67d892b24a23c98a233193cf82
SHA1fe9179cbe297f9a90bac06ec59899bd25aa15760
SHA256ed96026fc0cfff14d30d2aa31bb88337bcebb212b1b24b38609539e6cf9694ee
SHA512be56f5bd0512dd10f570b5548d4264b50a1115362a9fe3765ce38c448c72d57fda78c512e42bf3aa903b2d2400ccf8c15b652e26a2676a59ba56d51b03f7bd30
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD5f097e9ada8bb7eb6124d0fd610912751
SHA17fa26a575c418dca1be8d0e0a3dcb9f68b1cbbf7
SHA25696324413fc002a12e2d4be90acbc75efa312bc750b1fa7184dffdb152b99b526
SHA512759ca54fed8a33cf3ed90bd6ee8c864af2030e4bc8fbbea4a2b03a66489bb3db1b7f4322307f5f23c3e113302fd088e712684ed3aaf7f0c45460751fe89037df
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize304B
MD536edf818b51871287574d4ec7df37682
SHA1a7fd7a7ec45e428ae846f147cd1b863295493677
SHA25610f318be16d2725da0058f20f788cf1a952b38cd7c7578e7242fb8eeb2091bbe
SHA512153a9746f58b4db23cd46cb241145c4ee58a4ba379204046f0bd22c3039308404d7ac3a6046fc09dc5ced6127b93d1af1e73e3917b115612a9273529e2874206
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b