Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
187s -
max time network
183s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 00:56
Static task
static1
Behavioral task
behavioral1
Sample
LOL老干妈V3.7【无限视距】/LOL老干妈V3.7【无限视距】.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
LOL老干妈V3.7【无限视距】/LOL老干妈V3.7【无限视距】.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
LOL老干妈V3.7【无限视距】/点我购买.url
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
LOL老干妈V3.7【无限视距】/点我购买.url
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
LOL老干妈V3.7【无限视距】/老干妈破解补丁.exe
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
LOL老干妈V3.7【无限视距】/老干妈破解补丁.exe
Resource
win10v2004-20220812-en
General
-
Target
LOL老干妈V3.7【无限视距】/LOL老干妈V3.7【无限视距】.exe
-
Size
2.1MB
-
MD5
2fbf4c7d09243e9fe22d38ff518bfbc3
-
SHA1
949764d5f2a084ee4a40a5350144219ff30a1c85
-
SHA256
f4a5dc939688a96b43d89cf3fa76c2ffaee928e6daa1185f29baeb1235c898ec
-
SHA512
862500c530de3b101d0a29bd91ef061e5a7642e11801cf0cfde2df41ffcdb3b4dfb4a6e4b581bfe2bb2a2cd8b5d7b7d685d59217e1bd2b9f63d762bd663cd3b4
-
SSDEEP
49152:WwgGGoPDhl3eiu495vdFCjjw/anzU2fkrWXe1wiRL+SNAZWIx6:Wk/ex0dFCnw/anjkG3iTAZWI0
Malware Config
Signatures
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 LOL老干妈V3.7【无限视距】.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer LOL老干妈V3.7【无限视距】.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS LOL老干妈V3.7【无限视距】.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376345555" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000417976795ce3a09c0ca3ad3b602a459641830466bba9ad272616cefac90d085a000000000e80000000020000200000004b08108b40ff39cd9551aed91c4cd02f087da308c7ef2dbd0c04d39b911f5e2e200000005af210ce8cad412e81e97a9b0a5d05f4600e84bee8b6c7a1dbc708d83f46ec2d40000000437e568a08978a008b3537eba9d1aad85aaffa0b63d44deb2653514a6a3fe4590535c52990201e474242fef63becb6e7ecc9c4d8af17652fff8f363923cb593d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af0000000002000000000010660000000100002000000048b80097a6c08887e9c1e2a535640beb3f5f237f5c5ebdf6a8875b27292ac9c9000000000e80000000020000200000001ac213bc80ad6c1fb75a684ec38c955a04441d5adb033360113d323600e407a99000000016a32485a6957ddf7e66dd4d7d5fc06d52afa7df411fb424e4a8f00f596b463192893be5fcad4a03871bbd5dbf465acaaf5d6482a4385db5fd5ef797062d3a757fe6e21018f7d01f90e0edfd98884c408fbebcb2bb3f74b40f6dad755da4b8c06b94ae544185f6bd371eb8dc420aeb6a81e88e0fcd9d48657ed7d206ed60eef1500eda528c8f24161d06d1ecc6fb7acb400000000e904a3e1cf4918b8c02c6456232e4bcf2c171a53250b7c31cc020c999e34adfc10b515b56f51d7fdb3b682431a3fd39caae6385f70f85dec933aa65f75b1a9d iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{47C4BB31-6E91-11ED-B58E-4ADA2A0CA6C6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MAIN\Default_Page_URL = "http://www.2345.com/?kfi1997" LOL老干妈V3.7【无限视距】.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900b99279e02d901 iexplore.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.2345.com/?kfi1997" LOL老干妈V3.7【无限视距】.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\shell\OpenHomePage\Command LOL老干妈V3.7【无限视距】.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1712 iexplore.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 560 LOL老干妈V3.7【无限视距】.exe 560 LOL老干妈V3.7【无限视距】.exe 1712 iexplore.exe 1712 iexplore.exe 1304 IEXPLORE.EXE 1304 IEXPLORE.EXE 1304 IEXPLORE.EXE 1304 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 560 wrote to memory of 1712 560 LOL老干妈V3.7【无限视距】.exe 28 PID 560 wrote to memory of 1712 560 LOL老干妈V3.7【无限视距】.exe 28 PID 560 wrote to memory of 1712 560 LOL老干妈V3.7【无限视距】.exe 28 PID 560 wrote to memory of 1712 560 LOL老干妈V3.7【无限视距】.exe 28 PID 1712 wrote to memory of 1304 1712 iexplore.exe 30 PID 1712 wrote to memory of 1304 1712 iexplore.exe 30 PID 1712 wrote to memory of 1304 1712 iexplore.exe 30 PID 1712 wrote to memory of 1304 1712 iexplore.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\LOL老干妈V3.7【无限视距】\LOL老干妈V3.7【无限视距】.exe"C:\Users\Admin\AppData\Local\Temp\LOL老干妈V3.7【无限视距】\LOL老干妈V3.7【无限视距】.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.lollgm.com/2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1712 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1304
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
601B
MD55b76594a12507b41c6149881d1f3941f
SHA1324948074fe2ff96722a82c4ffbb946bf1b5c803
SHA2568172d39fc824f4653d6dae3e2072a20ad9e3ee037c25b0139d4af991d8810527
SHA512dcbea2258a86a71846f32fcf9e0d2d248c9d4b0cd67ebd1688c10daffa4db375b85e3445332df6fb90df1d51da29b43555093a520a365729177257a2606a1312