Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
9png/draw9patch.bat
windows7-x64
19png/draw9patch.bat
windows10-2004-x64
19png/lib/d...ch.jar
windows7-x64
19png/lib/d...ch.jar
windows10-2004-x64
19png/lib/s....1.jar
windows7-x64
19png/lib/s....1.jar
windows10-2004-x64
1xUltimate-...pc.exe
windows7-x64
8xUltimate-...pc.exe
windows10-2004-x64
8去脚本�...��.url
windows7-x64
1去脚本�...��.url
windows10-2004-x64
1服务器软件.url
windows7-x64
1服务器软件.url
windows10-2004-x64
1Analysis
-
max time kernel
173s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
9png/draw9patch.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9png/draw9patch.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
9png/lib/draw9patch.jar
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
9png/lib/draw9patch.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
9png/lib/swing-worker-1.1.jar
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
9png/lib/swing-worker-1.1.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
xUltimate-d9pc-x86/xUltimate-d9pc.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
xUltimate-d9pc-x86/xUltimate-d9pc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
去脚本之家看看.url
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
去脚本之家看看.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
服务器软件.url
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
服务器软件.url
Resource
win10v2004-20221111-en
General
-
Target
9png/draw9patch.bat
-
Size
1KB
-
MD5
0e12481de3bd3f22284dbfcc0c2ba3d3
-
SHA1
814bea86174d5bf1c9d8ce2928f494957fc5e9b4
-
SHA256
aaaf0dc8e1a5dc4c4d93a0ee0622228e236ed829e4505d6789fd78adac1d7c6f
-
SHA512
2a0d2024dbaab2aeec9b711f6ab6bf0bd5c4800c1c2aa3be2795a5a3aeeca923f8400041740fffa6f15dcc8debdc463a162e53b72b6e89de4771b3ec9dbb4110
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5108 java.exe 5108 java.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3396 wrote to memory of 5108 3396 cmd.exe 86 PID 3396 wrote to memory of 5108 3396 cmd.exe 86
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\9png\draw9patch.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\ProgramData\Oracle\Java\javapath\java.exejava -Djava.ext.dirs=lib\ -jar lib\draw9patch.jar2⤵
- Suspicious use of SetWindowsHookEx
PID:5108
-