Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
9png/draw9patch.bat
windows7-x64
19png/draw9patch.bat
windows10-2004-x64
19png/lib/d...ch.jar
windows7-x64
19png/lib/d...ch.jar
windows10-2004-x64
19png/lib/s....1.jar
windows7-x64
19png/lib/s....1.jar
windows10-2004-x64
1xUltimate-...pc.exe
windows7-x64
8xUltimate-...pc.exe
windows10-2004-x64
8去脚本�...��.url
windows7-x64
1去脚本�...��.url
windows10-2004-x64
1服务器软件.url
windows7-x64
1服务器软件.url
windows10-2004-x64
1Analysis
-
max time kernel
154s -
max time network
184s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
26/11/2022, 23:11
Static task
static1
Behavioral task
behavioral1
Sample
9png/draw9patch.bat
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9png/draw9patch.bat
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
9png/lib/draw9patch.jar
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
9png/lib/draw9patch.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
9png/lib/swing-worker-1.1.jar
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
9png/lib/swing-worker-1.1.jar
Resource
win10v2004-20220812-en
Behavioral task
behavioral7
Sample
xUltimate-d9pc-x86/xUltimate-d9pc.exe
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
xUltimate-d9pc-x86/xUltimate-d9pc.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
去脚本之家看看.url
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
去脚本之家看看.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
服务器软件.url
Resource
win7-20220812-en
Behavioral task
behavioral12
Sample
服务器软件.url
Resource
win10v2004-20221111-en
General
-
Target
xUltimate-d9pc-x86/xUltimate-d9pc.exe
-
Size
11.4MB
-
MD5
cccdbd689ed89d899552590f883aa0b1
-
SHA1
ce65cee756b70db8e2ca625b7b01884ece55baed
-
SHA256
681bbae32ae9f1be6405032dab3012db2aef519e3a80cd991fab1a513438a638
-
SHA512
7f5a904a04471960c1bdb24ab4af5c08b3aa50c507775f769c41ad13619666422866a4625236381c4433c034acaf7d3921756e717c185dee5360d03e0f086005
-
SSDEEP
196608:qc6RqvqjfyLkBfRosPZz8L3yJdKkT+OqHkfRsb39:qbUSD2kB5osPZoLCJdK0ekf0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 4580 aapt.exe 1608 7z.exe -
Loads dropped DLL 1 IoCs
pid Process 1608 7z.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2160 wrote to memory of 4692 2160 xUltimate-d9pc.exe 80 PID 2160 wrote to memory of 4692 2160 xUltimate-d9pc.exe 80 PID 2160 wrote to memory of 4692 2160 xUltimate-d9pc.exe 80 PID 4692 wrote to memory of 4676 4692 cmd.exe 81 PID 4692 wrote to memory of 4676 4692 cmd.exe 81 PID 4692 wrote to memory of 4676 4692 cmd.exe 81 PID 4692 wrote to memory of 4580 4692 cmd.exe 82 PID 4692 wrote to memory of 4580 4692 cmd.exe 82 PID 4692 wrote to memory of 4580 4692 cmd.exe 82 PID 4692 wrote to memory of 1608 4692 cmd.exe 83 PID 4692 wrote to memory of 1608 4692 cmd.exe 83 PID 4692 wrote to memory of 1608 4692 cmd.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\xUltimate-d9pc-x86\xUltimate-d9pc.exe"C:\Users\Admin\AppData\Local\Temp\xUltimate-d9pc-x86\xUltimate-d9pc.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~FE3B.bat" "C:\Users\Admin\AppData\Local\Temp\xUltimate-d9pc-x86\xUltimate-d9pc.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir /x/b/a:d3⤵PID:4676
-
-
C:\Users\Admin\AppData\Local\aapt.exe"C:\Users\Admin\AppData\Local\aapt" package -f -M "C:\Users\Admin\AppData\Local\AndroidManifest.xml" -F temp.apk -I "C:\Users\Admin\AppData\Local\android.jar" -S example1\res3⤵
- Executes dropped EXE
PID:4580
-
-
C:\Users\Admin\AppData\Local\7z.exe"C:\Users\Admin\AppData\Local\7z" x temp.apk res\ -o.\done\example1 -y3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
709KB
MD5ca41d56630191e61565a343c59695ca1
SHA1774584ff54b38da5d3b3ee02e30908dacab175c5
SHA2566c80e3f49fcf561e6a0b52f9b4c81d1d07b22085f7864ee4cfd30dd10f6b3b12
SHA5127f2eb8f773951c5b682b208807235bf4d7d937ece3d9d5c30d17abeb8f74e0be016140e74c64f9d38440269784308ed53c9c76dce6850afa1c7f9cb701229fe1
-
Filesize
709KB
MD5ca41d56630191e61565a343c59695ca1
SHA1774584ff54b38da5d3b3ee02e30908dacab175c5
SHA2566c80e3f49fcf561e6a0b52f9b4c81d1d07b22085f7864ee4cfd30dd10f6b3b12
SHA5127f2eb8f773951c5b682b208807235bf4d7d937ece3d9d5c30d17abeb8f74e0be016140e74c64f9d38440269784308ed53c9c76dce6850afa1c7f9cb701229fe1
-
Filesize
146KB
MD593c7b7a3e3051bbb9630e41425cfdb3c
SHA1849c937ed5a429448f3f6d1b6519a7d76308d05d
SHA256c0791fe9d96325f3cf42b263fd1f5fff65f734fa3b64fd4c597234653a26a711
SHA51264363951ffc0fe9d17b4b0b98dc9e851db79e7cdd34c55e7984503b0f637b2027a96769d40f2012f60bcc7addae9387ea1dd45545dfb33ffd4a574010f1f0d62
-
Filesize
146KB
MD593c7b7a3e3051bbb9630e41425cfdb3c
SHA1849c937ed5a429448f3f6d1b6519a7d76308d05d
SHA256c0791fe9d96325f3cf42b263fd1f5fff65f734fa3b64fd4c597234653a26a711
SHA51264363951ffc0fe9d17b4b0b98dc9e851db79e7cdd34c55e7984503b0f637b2027a96769d40f2012f60bcc7addae9387ea1dd45545dfb33ffd4a574010f1f0d62
-
Filesize
149B
MD51d765ffa1790c1527b00231c460f4a9a
SHA1e9e5b5b568ed5407a6a510d2413af95493530927
SHA256964c338026da6ade76c667cd98159ec615f7b9d8b98e20ec38a077f6aec22e78
SHA5128b5abc25856c0a1c9d2f8ff90d51933110de2927436a8a136c353b9812b5da9189d3cd883729dfc25b6a8b6d6be6f6e2d4a67ed90300e34622ffad2ee3db453d
-
Filesize
314B
MD5f5d2cf05acc5e0e745cdc7295b6c0f57
SHA1e383b2add4eb2c5868d167186cf23eda4972431c
SHA2565a6aae9a55b4a03399e8875278e2d6f2463f5ddd1bf4816d2101f8e4e1c2f6b8
SHA5129ddae410e0907ced8de9bfe3a09421197bbb030d1dabbabc09dc8d903493277aaa58a2351b77ad0cb8d94d747fcb5802801a0cf0be31fc1321af1ae5b92713b9
-
Filesize
685B
MD587c45d47de2ffa839451a914b2f38434
SHA18d57337f1f745d8387cfd064f4b78ea504b1447c
SHA256eaefafc76d316b13308685216827cd672dddaf059862e466dca835e4a5e6fd04
SHA512af6980e248003d90a621808e900e93fa8ea243222e05a35658e357ffd37f9197395898e68172ab5d9b76085fefef13570a529f41d900065b88155cd005f0fe10
-
Filesize
5.2MB
MD5d9387bcc466c4509d863474200d139ef
SHA1c628ef03dd139b588d644588728d9c292d952a60
SHA25658f757154bb7cd72f56fb2ef78894ef93d1dd1be802b3aa45d670934f7cf2db2
SHA51293d3c64d50551430f033f73af8a27041c5b6603377eddcc042c667ef9cbd27922daed3fb041913827880fd065770a1298dfeda3eb41ffecb00af9cdbdedb6925
-
Filesize
5.2MB
MD5d9387bcc466c4509d863474200d139ef
SHA1c628ef03dd139b588d644588728d9c292d952a60
SHA25658f757154bb7cd72f56fb2ef78894ef93d1dd1be802b3aa45d670934f7cf2db2
SHA51293d3c64d50551430f033f73af8a27041c5b6603377eddcc042c667ef9cbd27922daed3fb041913827880fd065770a1298dfeda3eb41ffecb00af9cdbdedb6925
-
Filesize
5.2MB
MD525e567aeb14498d926d4d0b158eea9a0
SHA119159c56979c7f3e24610098a4dd2bf1ed33085f
SHA256327195c8647eb254bb74acc6648474955120cee561a3ca6c58c026454aa11f5e
SHA512475212323fb9870a228d31ced30a3c47e2b0c6f331f27cc3bcce7b911acd25e334c7046f6aa32c3e8b5ec5a3d42d1a8850de1204af7b15c66ed4a57541512cef