Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

07/11/2024, 21:24

241107-z8z12ayfnb 8

07/11/2024, 21:23

241107-z8jdaa1pdl 6

07/11/2024, 21:21

241107-z7ptnsyjdx 7

Analysis

  • max time kernel
    119s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2024, 21:23

General

  • Target

    Delta V3.61/bin/lua.xml

  • Size

    3KB

  • MD5

    e2b537e027b3251fb82e213739e66376

  • SHA1

    e47888a238dcf90097ecd3c8860b0f9b02ded0e3

  • SHA256

    5c508701141f851aeb0ad9088759f7da15bc33f9e7459ea8c8d4e1ec7b4eaa60

  • SHA512

    1e347301cdc75933d709eddeace7cc9d62a7e9685f5badde3e1ec6f3cdbb37bbb8b95c23632e11b283e0464ab4c84e79c644660a1f0c09f51729e30571555f7e

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE
    "C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE14\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Delta V3.61\bin\lua.xml"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1628
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2036
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2036 CREDAT:275457 /prefetch:2
          4⤵
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2324

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8f7ed1cd13bf85b7718bccba631de67b

    SHA1

    58ebc5f529e8fb17bba6ea99a22440cce914af51

    SHA256

    0e3c16452025b2d9cc4c6a0907ab40541803a2aa6e8bd48df607e84b5eb5ccb1

    SHA512

    be38bb58036ef71781cb9836da55874f31fee076b72385b5531eff20ae651bd5bc465a92fe9691176bcc944a0f0c8619d5e434cb8367e71ee56645c0f89f9b5d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c866517cc99d77cfcffcc0aa791a41cb

    SHA1

    d09f835fb714dac28b298e0d561ccb17d9d6d846

    SHA256

    437397d07394c89fca068a569d2332e86ef791a754e2d3bfac2cff8ecfae882d

    SHA512

    33a6f2ca41d4c594c007b917876989b5a36df9c3253f763832e0308aa16979f047cac92ce94fa2e82bd63f764458431595978ff9aa742df8efb9047c6ba4523c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    40723c7aa0c9eab8d395fc53722c86e1

    SHA1

    05bda2b5e6bc997fdcd0058c612c3e5043e61a6a

    SHA256

    a7d9a579ab16e2c60de0d31905ae2c4352f8ef8c3c5a829b222813d0c2d302b8

    SHA512

    e513149b523df15a2f6ce33b92c40be2eeaffb67fd79c9231721afed1b956a34b15313ce3c5760448843fc857a3f7b60aeaac07a46b42a2280e223a029d0f9d2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    41eda4687c80478dc1eb4885dd4e1414

    SHA1

    50bdc99bd5106f47b48e410c355f94665f3fe427

    SHA256

    027cfe5cf77231476c74129ec53f5cca87a931acc1971267f3d74f97c37bafdb

    SHA512

    f21d4a82350652e43f2c19d1fe7a51ec6315d8dde6e40ac89bf4b14680c97921f766a91ccebd6a1a7a0a1894308c4e091a2e7a035170c56a796398fb48f8c4a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d13043af33a3b580766f0b76f961d2a0

    SHA1

    bebe7c3db23c1d8821595332036e122376f485fa

    SHA256

    51ba04bcc9a35f21d76149fbad06ce9d7295362600bd78f801e23c97cdd10327

    SHA512

    8cf63b8d241b77c4368f52da99e7c7b8dc836b08f54c214062d9fe96bb11b65e9e9148ad16b0fd46915b3d7dcb280940040628cd509c451550c3a1b8dca5965f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    857ee18d698932e5ab59504589819006

    SHA1

    fd9b8f9cda693557f8e004f7a3cc4d361ca1aa14

    SHA256

    658e4b754c9a5ca18f3db251f21fe4865ab0f55c6f45fd2f066625d8a02009be

    SHA512

    62355225ef7d563721996af0770a98973f3771c76f6d7b9d46b8c51f216f2bb24cb70d92099cc90838c89d80a6a8ef341a2d1482f9e42d83d6f2e544dcbfc998

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    49584c6d1d53b74e1133d51aad70f043

    SHA1

    034bd40ca54c923ce31f1c6e9fe1362307d17047

    SHA256

    f5ab336286fa836b2774b7fefb5663d239bbd3c1bdd4ab46a678502962757283

    SHA512

    f6e6cdb751415de25651098c56ba6cbb6a699fdf6cbcf8cd557a0c8bbd331970fc6891ce6ddc473c040ba9bb1b13be534e3e3deee15e81fa2c03468c5ac3b3a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    3c97266ebd0ad247bcb6a9be33d4d529

    SHA1

    7efbee54cea072060f8c21affb3b494912ae34d0

    SHA256

    689bd2e86e07ae516c225f6630563d83e0845299a37a9e197c9ac8cabbe0d1eb

    SHA512

    81fe7b545f43d31a129c791ba5bf986075371d0107504589ac6038914fac7a42ffa15822d36259a53242b9494d3a1f38284009f1736e8f369e86cafc086ba11e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cab54841e23790586ef74e66e76e589c

    SHA1

    8b5fcee5cff2f95ac73ba22c4a4966c04e2251c7

    SHA256

    83a73780ad16b55c5e9f1d13b744e1a2220ca8a8c75913e7aa19a2e9dd4ccc56

    SHA512

    56321b1a4df25e11380b68e420d008dae6328a2a5dee6917c11a72e7ca6d597edc50c00900a4a83debce037bb664ff78344219d749ccab5da1af74f21fd7a833

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5887314a210f2db0cd518c4318cb26e6

    SHA1

    ad43a18b32441cfb1ad5839b9d0870119741ca89

    SHA256

    10237baa539ba8be135cea93b7760ded2f075fbbeb02a0439cec70ee6fbf3832

    SHA512

    77e9dd329eb12075bf25842cb3dfd113e7751366418bd6de6c521f987fddb3078cff72b728f8998b8c496d6a263339e73522a4148f18954a11b94d5e5d48048e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    686fcc3df146c688065fabd3ffda2c32

    SHA1

    08bbf0008cb317b45a3e88023dfae84c08986c6a

    SHA256

    54f8f0a5b4b3192e08a01c50d6705ee63c860ef57560cf8e2376159b88425bbf

    SHA512

    828ae86d907d1b9a120b1e0cc8c2080c38a9d44ced943f069297b85b470e00d5245069dca3447112a46103742bc2022408c2544de06c90ae94f793b471b17474

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    522c3a332e099edffd1e8453de87d0a1

    SHA1

    4107bd463062a2ae3c9e84cc6007419ee8ce1306

    SHA256

    eb86d6c7c8284725d9f0511e3d37207b2450ee0dcad42f08ee6b4f0f4ac233a0

    SHA512

    dd63a0d8dced056c21e1c00346084e668312357ecdcf1513604de0a35249885703eef939323b105b0a25a1fa2d5ecd3a06f74df4cb12877f7a72aa9d70da2b5d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    f8f999144d933f30886942a66fe444db

    SHA1

    9cb15bee18c14e6549dc3e6beeea952bb0974df4

    SHA256

    be3ca91e3a300a2238bd248681db6273f2d042c9538432db0dfbb08a9513dcc5

    SHA512

    ebd606253e3957a59bce43a7e8cd90db0e4dad2daf690921c39974047195160de014c7e013a4a71f5b20f36e2a6c62fee2c2468da74fced1a2507e8355deb77b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    22a191fcad2fd3f9b6abe50ea152277b

    SHA1

    cb8ca3e3af7102027fafd4e93566d83d9386a53d

    SHA256

    9fe70e4be05a2137b65a52dbcea9d0c604b68f6a10ba5a56bc5543689c818033

    SHA512

    b83f88e9350c3e3765578490fd5cc6aecf8bb3228c699e3347b4196ce18a3e3548c616ed8fcda947f72bb8d02d4a22c9a2fbd037ee0ae56fd5b056da88265f35

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    90eb6202cf895a6b52f3b9300b818f51

    SHA1

    b8c9b40b691682914d79ed6900319c648d50a1bf

    SHA256

    08cb92059274e3750caa6d9ea9708630d6b2f92fd7d8737bbd72091c3b90076b

    SHA512

    2951c042827571020d9874d692068a1cb636c09b396b731bd8d59412cfb73799daa5fd282edad14d82711fd8ef86cc8dbbf6947e6f44beb2608ea3a9bbf7690a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a198bdbfc54f631e385fd8415c56081b

    SHA1

    242c7a64f7a11b20fbfafdcdb007e4235543c6e6

    SHA256

    25cc2c20b2bc9118e27e86a91ddd37b4bca0637061c7860c48a872d45ae58ea6

    SHA512

    40732a109de7895fd4ba7b157e8aaf693288c4a01509cb3d2925184b57d4b0a5b13a6c0ec8d5dbd67f86f0a81fed2335313e7e6f16430f5fcb31935299dcd33c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e769b65b63d28adc3dd905661d5e082e

    SHA1

    df44e8e6c7f027ad6a3bb993a88233aac4d01bd7

    SHA256

    e6d25eba1812cf7da4319be7e168edebd4b5a47809d8ec26c8a229eafe1f8191

    SHA512

    a683dc677f0b856470130580625e5862c6849b6458697e02afd025a9accb826e6c0581eacacb2879634377ee83515300604ff93ca31dd90f34dc66f91a3423ac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0b7fc9689aa6585be560a9db711ea55a

    SHA1

    09c79cd233d47cbd842bee237138e050115acc44

    SHA256

    6c885b5e58408f9281855ed130906ef9adb0dc87c0242886e1e7dfc40d2d5bf4

    SHA512

    a95caaf5bc83cb130a1c67a55dfa2171ef7607bd83436dc1ff43220cf244e832455572d7171464b2acdd0ed7fed8b4f15f709d692bc94880efd807ca841baf4d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    79edb19aa3b7ed798949069c8c767ca7

    SHA1

    cbf41958eb4a5b0311a078f860e27564f379361e

    SHA256

    84763b56b2df888e94f55d016abc147b36d175727224c5a536e6df52fd481e04

    SHA512

    ce8ee843e3c2da26a087bf62d11d01a94bd6f290d625f6ae6df48a313028c1808834d711571ffca77fd53e14d1ec514a4480d1ba72dc65145a0215589ecdc1e3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    87a0257d0aa0f35da361f77052ce66bf

    SHA1

    e609e69e1e06e441d60798f6d3d2fb33d8d34795

    SHA256

    66082f425723465899bdb71ecd3e4db2b796ac18ea01b4dd5ca9bdd84afaaaa8

    SHA512

    c6ad08df800707ca875457424ee39e5a86eb625656cba9ba7928d4b6cf3bc15c7ccf8dd363a173eea0eb1f12daa3107015bbe84a41a6338d49be22ee2b0f5495

  • C:\Users\Admin\AppData\Local\Temp\Cab1289.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar14CE.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b