Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 03:28

General

  • Target

    krnl/krnl/Newtonsoft.Json.xml

  • Size

    489KB

  • MD5

    edea00514ddedc60736475ebb6d7e8d0

  • SHA1

    9941062bc3a62bc6bbe4be9fd2c3817d769312b3

  • SHA256

    2c3fafc94275ffb1b5f37891c452285e1fe7797cf02371def687627903dc4fde

  • SHA512

    ddb912ef462e052f50db8903f5d2c8eddfe8fd1a14b635862b499b751ca5027f2c0098b6ac1c285acf52665c33ab70dec3435bd4c7bfb3387add65d4e3b443eb

  • SSDEEP

    6144:/Gkf3fW1Nt0/IhSBVIeR0R+CRFo9Tt82mafmKj+spjoqoyO185QyMYFLsgfl4:6

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\krnl\krnl\Newtonsoft.Json.xml"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:676
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2964
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1620 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2728

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    66cfe877202d24c8fb8cc9e21ac8bec8

    SHA1

    821d07c8f2e5d41ef072e6ebba2a7ddccb379f21

    SHA256

    a65fef667aef9e4c68cc1f3dc2f6054911f36abe67146f9fb92a30a2b1ce9c37

    SHA512

    09caa9790a031c2c0dc9549fa02a523012569ac017ece64ca62f23e425e1f5a238f826a05f8effa0fdcb0e10226dc1ca08ef464bff6929013d59e9b31ad8cf9f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0c84d79feaa45a8f603178fc846c2b11

    SHA1

    c0bab2780b8a25cfbeabcf1598b34405e0769063

    SHA256

    4f35ee3ac9bb59716dfeb1a45ff99029e969f68efca4a0ff99eaa1d7ebd26e93

    SHA512

    ba3f8be0936347999d01fdeac031ad5d1325cdd22378906a57684d2ccca0ade1340a86d55325eb9c5a092c7a261e547d70ba2178f3d6eb48b21e1a88cf82d903

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    824854204752619bfb8f2f7da35f3511

    SHA1

    60a71fbc1e27c209d2d447cfa2c152f9aafce5d8

    SHA256

    03595b2ee50c9b69d0989e57d2e46a6474cc97c77ce6cb001270e6b395ceaf25

    SHA512

    638b12f32bddf89664cdbe09b67fce225cc0095e16db34def1cf040130ed7d43ff568a2beb0a650da55a39a5f7565a6567022eb2f309f8070e8cf55b40b37b00

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    112fecd7b731920e5aa008cf3edd719b

    SHA1

    9d3c81741029852ed2126cd71df6fd9db84c6a75

    SHA256

    4ec9bb19517d1b5b0442b1cfab89ab6c65f9d7762bbb0690eff6dac18d898488

    SHA512

    25b80cadcb864deea1b73e4486abb20cf9b78d6207f523a7a9ef77da7382bc147732f7bfcc5d992e3165469e65ffc99eaea0333bb93526948cfe1921b1bcf6b7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c0f07e3290d9316f4a1c33a8e8f669ec

    SHA1

    77afe094924675c62a757b86980cc822ab2bbab8

    SHA256

    bcb69fbd81a7671a1e89f32e1b5cad666e681999d9ba575172b2b11f8542f6f3

    SHA512

    f6f0f2ac1c6c876661f1474ce5f9705defd55d85bd4f0f2faec4830c563fb90bda2d254f6925bbc35850e0e7bf10e1ca7ebbd6893069e8ca27959c5cc30d34a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6d03deaffedb5f267888a25ac8c49173

    SHA1

    dbe269706c3d1ef733da0144425ab0f03ce8eee1

    SHA256

    88d391c050f4a5c1699c8ed648bb249186343383e041f37117d40e334891154c

    SHA512

    8bab9e1f86fb04d2d77179500fe28cc4349f1fc922b4bcfc594a8252641212764c9df8f6389e9a963844addf2e0bb57417715e901431709498244afbe76e34ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4f239c5baa96a2f67c18b5d1539b3732

    SHA1

    0e2d1b0e8398ac1e35e7eb286a40db09050af2a1

    SHA256

    d5b4e2b3554d65228dec5244600a23c504962b072d2410bf9f50a5236cc53c48

    SHA512

    d4893d71a0b04a6e0c231684bd66439a4db21016824a395acd35811c90328864d950dd9207ded02876e636b4da3a4d97eaf0837ec5e859e1c052927666e259d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7a53835ee34e19abc9541ea6f0fdf764

    SHA1

    04c627b1f4772e74742af90adc4a426b76ff6863

    SHA256

    c5d8b38a465a2e1552b457afe274d4d49aee95672e0b6d7eb15fcb05b5b83cfe

    SHA512

    165a57e0cc06bb5f6c2233cc5fbbc52007a25c8e572ef05426c14304a7c63e194233e0f1850072892c8b2f1bc1bb35eabf1eff77f38214db45f94246e1b9206a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    262f619e066ffdaff96a6c4e43fe7dbe

    SHA1

    549385efe2e58b6a982dd7e53bbd7d78aa1ed420

    SHA256

    b634a0ad336ecfd4c1ac0586594383928882755eb68d1c5d7dd097956c3adcad

    SHA512

    a8f79757595d7e53b82ca00ed50b4f040be0adb4ab070b321ae615def64e34cf04f778b128e679f376b37eaefa750275464b1e5e5dd547c5727b6e6e0a4d9802

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f1ab6ffa185a65569faef559855beaf8

    SHA1

    dfbbef8d1312ede94b7240a2ec7c69caaf1d36fe

    SHA256

    7ff6eea2f2bc3b05e209ce3f04ab35a9b198cc8f9de4a2cc945057538dcfd776

    SHA512

    42543b8f27ab636572b18bf6abdca2cc08665dfe8736e7f1c964302683932ade52efa263fb9ed9c572501df75a43fd833a201fcbe337e2cc4b3216e0bf294365

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    50c31c8319950881b7753986104757ae

    SHA1

    a3d8494c178b304665aa78ca93b1d05f4f9d8a1c

    SHA256

    c688edf3b3c3abba5684251411e291f7ef4771f9a4c497316257b0f1c68e1103

    SHA512

    eb43368b6529d76b56af17a63863707769307cc1903f282fe1ba03013090eea0c070af6c7a3b983ecda5facb3fa0f848fbfb87efc9bfede3a933eee1171f5993

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5831755abc36d15166eb5ee54d6c9645

    SHA1

    0a7feee8b76de9244f32021fa5375a4946b4aee9

    SHA256

    95c080049082387c70ad107be4b3e8f352377ca6e0981a9c48be1f822f731cc6

    SHA512

    0a6859f98f353b892d1e58a52195af55af0bc51c1f5efa75d6951f13a949f620c67555eaa5817dd9add1ba8f33bedfcb31d99c53c65c61adfee4896c3cbf610c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2cf7c7e76ab314fac244b8f1ce8546dc

    SHA1

    6aec75e32394508e206f3f57bbe06de70052428e

    SHA256

    1c953331a4effee6dc5db81597e37930e16fde52b2498b2507fac168efd68696

    SHA512

    9e1372368f32329a9553e40ec8b1447b916c4a6fcd1f244a9f4c597f700e9eed1b75bcd1f5d6c02c0a163507d836d240dbe4ccd776881be7bfc683519a425f1c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b29d8d599461581a3f70bba26f879d12

    SHA1

    ae9f67709544f5108c07c012572ee237b8d41579

    SHA256

    382effef4058e52c57c477f0239229adbdb4ee64d30d7efb1966414e570ba5d3

    SHA512

    ef9783334b48878af375cbf6cf17428e2ff7d16cb3423004793943b7da120c0614536da26296f9851d66f80199af3f172b18d0ade332699c32724b485a3ff4dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ad629016596c311e57033774ddeaa7fa

    SHA1

    062131703e2601beac48ca679e97623bcab7106d

    SHA256

    4b4c6d76b903b6fb0a1f63ee99426f77993d25437251648a9ec92d6d620bfcc0

    SHA512

    8eb172efcd4e21b17b8152321a7dbc2487efaf63516eabd5fa09b11a528350ed9d30c9bc6b488a1a2224bf7dd7d1a97bc7b392b50ed211b8991aa4704cc760e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2c93ab9fe377ae76f0e0b28d5cd08326

    SHA1

    b52c31f85aa3cfbf32676a64c91a6e9cbb411d81

    SHA256

    5481dc745fc26082c5768a2ef5d8321246e674e6b587d4e214a45eb6b4adad2f

    SHA512

    92c1d78ea15177c6918ac444b48907479bff385c916bbc17b730c55adff4470a1e3392b16add73a7ad6b5606faffc1dddf43d31ab8da412d007fb4ea0528caab

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    51a8d0373a88dc3eb8502c630de3e90c

    SHA1

    50b574e6a216d5c7948cc8fd7fff8f11e769e2ef

    SHA256

    b20fabce20771c94831b8d1022554962c1a30c3dbcf136fbe0f061f8dec0a9d1

    SHA512

    b08ee0fe6f78312215db388c7f95e17680178f775a39e7fe9cc01dc42f62ff6033570bbb04c4ba1597297e307e0356316ded6255cf08288f181b0877e77b1ff8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9e50d3ee50df94c531bad9d12051b8ef

    SHA1

    9d4c3dc766220b805a42857baa75044bdad710f6

    SHA256

    8070883ff216707580645a0e2bd92b4610934d427df23ebbee83cf6897f213b9

    SHA512

    97f25c0dc197812766a7381387ccb3d5aee7d92b5431f8fdae72490b2ae483406a91d595577e4723f31005c54edb06e43f4549b53779a22eac001fdb0743e7fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f5de95c1fa679d1771f22f0c4421ab2f

    SHA1

    ecde45225aa0dd9cfbf290633722207d3bd4b1d1

    SHA256

    bf4c6d03520e29f50c4ad35bdd6d21c347b9fec1e828324f0bdb7feabdfb1548

    SHA512

    6ed6a21a685d6765d99829ce241b408025bcaa0e034f23741f99d3be1b1016f175aa7e0d225161ee68aeb7961b32bed7426875c0f849a2ae298386c92f7d8634

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    44295eaa8d16bbbb5644a0e7ca1ee1cd

    SHA1

    ac1dc3937a42624c22e7998c010a9701e5b07c55

    SHA256

    7d005887725c82f7dfce16eb6e9170476e81e83dfc88034f4633e6298fd106a6

    SHA512

    096adefe34532d90b48697f6ce34187daf046a36d3fcf69cbfbc1fb50c3cccc845270bbd9f07902d6476b7176b63324e3bf44e8a8fed10e3a82a534c870f7893

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    80456af7e6a41eb61994643e55ca4337

    SHA1

    71ebdf6c2588d871308f901f453d0a33570b5abf

    SHA256

    ac812b47a4ff82e35ad2a5310a56c5c8a3a8a4f50106208d7a7fcda86b24a249

    SHA512

    7f6ab1f37c69cf14fee6e76691e96cc03cc30f8b178900e56dac70608348d3ba910437253062870befc2854bdede065ba9d34e765cbc9e0776f851e023429fb0

  • C:\Users\Admin\AppData\Local\Temp\Cab1A27.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar1B25.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b