Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
9Static
static
jycms/捷�...pk.dll
windows7-x64
9jycms/捷�...pk.dll
windows10-2004-x64
9lpk.dll
windows7-x64
9lpk.dll
windows10-2004-x64
9sxw/admin/...or.asp
windows7-x64
3sxw/admin/...or.asp
windows10-2004-x64
3sxw/admin/...tor.js
windows7-x64
1sxw/admin/...tor.js
windows10-2004-x64
1sxw/admin/...or.asp
windows7-x64
3sxw/admin/...or.asp
windows10-2004-x64
3sxw/admin/...ut.htm
windows7-x64
1sxw/admin/...ut.htm
windows10-2004-x64
1sxw/admin/...or.htm
windows7-x64
1sxw/admin/...or.htm
windows10-2004-x64
1sxw/admin/...bg.vbs
windows7-x64
1sxw/admin/...bg.vbs
windows10-2004-x64
1sxw/admin/...ig.vbs
windows7-x64
1sxw/admin/...ig.vbs
windows10-2004-x64
1sxw/admin/...ml.vbs
windows7-x64
1sxw/admin/...ml.vbs
windows10-2004-x64
1sxw/admin/...ta.vbs
windows7-x64
1sxw/admin/...ta.vbs
windows10-2004-x64
1sxw/admin/...dj.vbs
windows7-x64
1sxw/admin/...dj.vbs
windows10-2004-x64
1sxw/admin/...il.vbs
windows7-x64
1sxw/admin/...il.vbs
windows10-2004-x64
1sxw/admin/...rm.vbs
windows7-x64
1sxw/admin/...rm.vbs
windows10-2004-x64
1sxw/admin/...ml.vbs
windows7-x64
1sxw/admin/...ml.vbs
windows10-2004-x64
1sxw/admin/...ly.vbs
windows7-x64
1sxw/admin/...ly.vbs
windows10-2004-x64
1Analysis
-
max time kernel
169s -
max time network
183s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25/11/2022, 23:58
Static task
static1
Behavioral task
behavioral1
Sample
jycms/捷扬文章系统0.4.1/程序文件/lpk.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
jycms/捷扬文章系统0.4.1/程序文件/lpk.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
lpk.dll
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
lpk.dll
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
sxw/admin/Editor/Editor.asp
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
sxw/admin/Editor/Editor.asp
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
sxw/admin/Editor/Editor.js
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
sxw/admin/Editor/Editor.js
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
sxw/admin/Editor/Format_Editor.asp
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
sxw/admin/Editor/Format_Editor.asp
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
sxw/admin/Editor/include/about.htm
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
sxw/admin/Editor/include/about.htm
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
sxw/admin/Editor/include/~$lcolor.htm
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
sxw/admin/Editor/include/~$lcolor.htm
Resource
win10v2004-20220901-en
Behavioral task
behavioral15
Sample
sxw/admin/admin_bg.vbs
Resource
win7-20221111-en
Behavioral task
behavioral16
Sample
sxw/admin/admin_bg.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
sxw/admin/admin_config.vbs
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
sxw/admin/admin_config.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
sxw/admin/admin_config.xml.vbs
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
sxw/admin/admin_config.xml.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
sxw/admin/admin_data.vbs
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
sxw/admin/admin_data.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral23
Sample
sxw/admin/admin_dj.vbs
Resource
win7-20221111-en
Behavioral task
behavioral24
Sample
sxw/admin/admin_dj.vbs
Resource
win10v2004-20220901-en
Behavioral task
behavioral25
Sample
sxw/admin/admin_email.vbs
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
sxw/admin/admin_email.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
sxw/admin/admin_form.vbs
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
sxw/admin/admin_form.vbs
Resource
win10v2004-20220812-en
Behavioral task
behavioral29
Sample
sxw/admin/admin_html.vbs
Resource
win7-20221111-en
Behavioral task
behavioral30
Sample
sxw/admin/admin_html.vbs
Resource
win10v2004-20221111-en
Behavioral task
behavioral31
Sample
sxw/admin/admin_ly.vbs
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
sxw/admin/admin_ly.vbs
Resource
win10v2004-20221111-en
General
-
Target
lpk.dll
-
Size
217KB
-
MD5
aa28054265b1c2fb7748fb21ab5984a7
-
SHA1
2fd0396a49a7024ce53783995c4b288e7c596342
-
SHA256
004785903afd37cace27aae4ed28b2130c2691798b82132debb42659d223b615
-
SHA512
aaa000f7947a92e834b3175facfcefd1d9f53e3204f1b26f10c19c4c1b5ea720b6d6fc45d88a909ca0dbe425c39a6885496f8673e4ff1ebff6a709a351322e28
-
SSDEEP
6144:u24mCyHAWyPgWITYJ0Ax9N17xM2lxq27Wo/GEvdt:u24xvPgWGYj9X7xM2Lq27D/GEvdt
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 4 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral4/files/0x0008000000022dfe-136.dat acprotect behavioral4/files/0x0008000000022dfe-137.dat acprotect behavioral4/files/0x0006000000022ec1-140.dat acprotect behavioral4/files/0x0006000000022ec1-141.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 2012 hrlF273.tmp 2320 asmgsq.exe -
Loads dropped DLL 4 IoCs
pid Process 2012 hrlF273.tmp 2012 hrlF273.tmp 2320 asmgsq.exe 2320 asmgsq.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\asmgsq.exe hrlF273.tmp File opened for modification C:\Windows\SysWOW64\asmgsq.exe hrlF273.tmp -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2320 set thread context of 4332 2320 asmgsq.exe 82 -
Program crash 1 IoCs
pid pid_target Process procid_target 4760 4332 WerFault.exe 82 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2012 hrlF273.tmp -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2012 hrlF273.tmp 2320 asmgsq.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2900 wrote to memory of 1484 2900 rundll32.exe 79 PID 2900 wrote to memory of 1484 2900 rundll32.exe 79 PID 2900 wrote to memory of 1484 2900 rundll32.exe 79 PID 1484 wrote to memory of 2012 1484 rundll32.exe 80 PID 1484 wrote to memory of 2012 1484 rundll32.exe 80 PID 1484 wrote to memory of 2012 1484 rundll32.exe 80 PID 2320 wrote to memory of 4332 2320 asmgsq.exe 82 PID 2320 wrote to memory of 4332 2320 asmgsq.exe 82 PID 2320 wrote to memory of 4332 2320 asmgsq.exe 82 PID 2320 wrote to memory of 4332 2320 asmgsq.exe 82 PID 2320 wrote to memory of 4332 2320 asmgsq.exe 82 PID 2012 wrote to memory of 1124 2012 hrlF273.tmp 84 PID 2012 wrote to memory of 1124 2012 hrlF273.tmp 84 PID 2012 wrote to memory of 1124 2012 hrlF273.tmp 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\lpk.dll,#12⤵
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\hrlF273.tmpC:\Users\Admin\AppData\Local\Temp\hrlF273.tmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\hrlF273.tmp > nul4⤵PID:1124
-
-
-
-
C:\Windows\SysWOW64\asmgsq.exeC:\Windows\SysWOW64\asmgsq.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵PID:4332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4332 -s 123⤵
- Program crash
PID:4760
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4332 -ip 43321⤵PID:2292
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
209KB
MD5e22252dba6642b4247d7ba4ca0411ab9
SHA15b3a1dab65446d2a1e27edccf87304d0bc6335dc
SHA256947c45d867a0b95b08ec84cb21dc96e8557e2450dcb2853d7c8d1f7a58d00848
SHA512e7a1bf3820df573412452173976ad48d137d1e456b361c6079167f5dceecd912a4ff5e0023bec9564fb9cedde42fb4dab55c0ca6c380fa8186c614f2d7f4332e
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9