Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    187s
  • max time network
    183s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 00:56

General

  • Target

    LOL老干妈V3.7【无限视距】/LOL老干妈V3.7【无限视距】.exe

  • Size

    2.1MB

  • MD5

    2fbf4c7d09243e9fe22d38ff518bfbc3

  • SHA1

    949764d5f2a084ee4a40a5350144219ff30a1c85

  • SHA256

    f4a5dc939688a96b43d89cf3fa76c2ffaee928e6daa1185f29baeb1235c898ec

  • SHA512

    862500c530de3b101d0a29bd91ef061e5a7642e11801cf0cfde2df41ffcdb3b4dfb4a6e4b581bfe2bb2a2cd8b5d7b7d685d59217e1bd2b9f63d762bd663cd3b4

  • SSDEEP

    49152:WwgGGoPDhl3eiu495vdFCjjw/anzU2fkrWXe1wiRL+SNAZWIx6:Wk/ex0dFCnw/anjkG3iTAZWI0

Score
6/10

Malware Config

Signatures

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 37 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LOL老干妈V3.7【无限视距】\LOL老干妈V3.7【无限视距】.exe
    "C:\Users\Admin\AppData\Local\Temp\LOL老干妈V3.7【无限视距】\LOL老干妈V3.7【无限视距】.exe"
    1⤵
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Enumerates system info in registry
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:560
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.lollgm.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1712
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1304

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X7AMEYTK.txt

    Filesize

    601B

    MD5

    5b76594a12507b41c6149881d1f3941f

    SHA1

    324948074fe2ff96722a82c4ffbb946bf1b5c803

    SHA256

    8172d39fc824f4653d6dae3e2072a20ad9e3ee037c25b0139d4af991d8810527

    SHA512

    dcbea2258a86a71846f32fcf9e0d2d248c9d4b0cd67ebd1688c10daffa4db375b85e3445332df6fb90df1d51da29b43555093a520a365729177257a2606a1312

  • memory/560-54-0x00000000753F1000-0x00000000753F3000-memory.dmp

    Filesize

    8KB

  • memory/560-55-0x0000000000400000-0x00000000006E9000-memory.dmp

    Filesize

    2.9MB

  • memory/560-57-0x0000000076960000-0x00000000769A7000-memory.dmp

    Filesize

    284KB

  • memory/560-463-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-464-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-465-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-467-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-468-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-466-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-469-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-471-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-473-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-472-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-470-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-474-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-476-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-475-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-478-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-477-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-479-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-481-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-480-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-483-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-482-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-484-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-486-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-485-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-491-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-490-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-489-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-488-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-494-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-493-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-492-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-496-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-498-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-502-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-524-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-523-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-522-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-521-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-520-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-519-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-518-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-517-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-516-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-515-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-514-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-513-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-512-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-511-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-510-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-509-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-508-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-507-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-506-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-505-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-504-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-503-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-501-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-500-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-499-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-497-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-495-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-487-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-1550-0x0000000002230000-0x0000000002330000-memory.dmp

    Filesize

    1024KB

  • memory/560-1552-0x0000000002370000-0x00000000024F1000-memory.dmp

    Filesize

    1.5MB

  • memory/560-4809-0x0000000002620000-0x0000000002731000-memory.dmp

    Filesize

    1.1MB

  • memory/560-4810-0x0000000002230000-0x0000000002330000-memory.dmp

    Filesize

    1024KB

  • memory/560-4817-0x0000000002500000-0x0000000002601000-memory.dmp

    Filesize

    1.0MB

  • memory/560-4818-0x0000000002020000-0x00000000020C1000-memory.dmp

    Filesize

    644KB

  • memory/560-4819-0x0000000000400000-0x00000000006E9000-memory.dmp

    Filesize

    2.9MB

  • memory/560-4820-0x00000000020F1000-0x000000000210E000-memory.dmp

    Filesize

    116KB

  • memory/560-4821-0x0000000000400000-0x00000000006E9000-memory.dmp

    Filesize

    2.9MB

  • memory/560-4823-0x0000000000400000-0x00000000006E9000-memory.dmp

    Filesize

    2.9MB