Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
137s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 20:54
Static task
static1
Behavioral task
behavioral1
Sample
最新西西游戏外挂网.url
Resource
win7-20220812-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
最新西西游戏外挂网.url
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
ľͷˡ10.5A .exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
General
-
Target
ľͷˡ10.5A .exe
-
Size
3.1MB
-
MD5
6888bf89383dc531b5f48565473ff282
-
SHA1
8a5637aaabdf6cf33f01497a8a30f6df1d3c8423
-
SHA256
28277d5645f1d59fda3b93f301ccadb051a4de4263ae3e26f7b7347ca4ec0816
-
SHA512
44c6744af094eb9aaf0e1778069e8b591880fb57ae3d5140db52273523e43f43c07249afd9b7ab3f64d7d8f2f952b8d7ce5123c9d46ebcec3d1c1bbe64c8be84
-
SSDEEP
49152:FZzgXr4iTZaqdwk0c05HGimCJLMBXVr05fc0rw:vcr4iYqdwkLcHHpYnRl
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral3/files/0x000c0000000054a8-55.dat acprotect -
Blocks application from running via registry modification 6 IoCs
Adds application to list of disallowed applications.
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "e.exe" ľͷˡ10.5A .exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1" ľͷˡ10.5A .exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun ľͷˡ10.5A .exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "yylauncher.exe" ľͷˡ10.5A .exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "YY.exe" ľͷˡ10.5A .exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "e_patcher.exe" ľͷˡ10.5A .exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File created C:\Windows\System32\drivers\etc\hosts2 ľͷˡ10.5A .exe -
resource yara_rule behavioral3/files/0x000c0000000054a8-55.dat upx behavioral3/memory/1980-56-0x0000000010000000-0x000000001003D000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 1980 ľͷˡ10.5A .exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cb084c54264c445b34a3e3722db13ec00000000020000000000106600000001000020000000ff37255dbe677c2a3e2f5d68bd74e7569101510fb044ae0d1a08dc627937b463000000000e8000000002000020000000a7ad845f57c80df38ba58d3fa640c5b42ff9553b8beb4ac245bf892ccfc685b8200000009e1dc7f91ac318f653612cdaa8971f31ac1ab55da621dc84c7ec999bfa6b25f340000000a53980863dde11190049af7650116644d09533d715661b5a8b3037631061f9ccddc5b8df40b7f783e6c6c135d37c57f80adf7517e5bb6768036c674a2d8a8634 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "376891967" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007cb084c54264c445b34a3e3722db13ec00000000020000000000106600000001000020000000651e43690afe50e86a025154f25d22bdd67dcacf7506e41e4cdb76efd97dc545000000000e8000000002000020000000239920afca692cbbc18566552fc5d571d380a1fa16afb0484e871c2583e736119000000087461718b52024a185ed37c0f3e62b90e99828e487de45d099d1e0735855b88fdb9b764c6c7d4addddb8a8d24391cae382bf76e91fb34bd2c3c8d598963d3a576a626d27bf0646c5c38656361aa749b85deb1046957ebc894392f7bc4b2c9d175f08cc7d5af8403cfb5a6cf2f8194fd15efa85797102b3373c7c2057d2a1355504cf7e0457307d75f49b0f9b7b0ba3fe400000004b31eadadd076a149a20b77a27957afb4f32fc4eb2c97f42f12b79d1dde050e3e1291c818041a0ce6f7ec70f6c05961ff56dd6a135b3812af47476e581269d74 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{719392E1-7389-11ED-808D-42A98B637845} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003c1e5a9607d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1980 ľͷˡ10.5A .exe 1980 ľͷˡ10.5A .exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 768 iexplore.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1980 ľͷˡ10.5A .exe 1980 ľͷˡ10.5A .exe 1980 ľͷˡ10.5A .exe 768 iexplore.exe 768 iexplore.exe 1312 IEXPLORE.EXE 1312 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1980 wrote to memory of 768 1980 ľͷˡ10.5A .exe 30 PID 1980 wrote to memory of 768 1980 ľͷˡ10.5A .exe 30 PID 1980 wrote to memory of 768 1980 ľͷˡ10.5A .exe 30 PID 1980 wrote to memory of 768 1980 ľͷˡ10.5A .exe 30 PID 768 wrote to memory of 1312 768 iexplore.exe 31 PID 768 wrote to memory of 1312 768 iexplore.exe 31 PID 768 wrote to memory of 1312 768 iexplore.exe 31 PID 768 wrote to memory of 1312 768 iexplore.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ľͷˡ10.5A .exe"C:\Users\Admin\AppData\Local\Temp\ľͷˡ10.5A .exe"1⤵
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" www.x5mtr.com2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD5e7c191803f5274e46d1f1c3321ad3e4e
SHA173511a7c12ca2f85a9afa2c70a890517cec76402
SHA2564e872063161cd2134bb938d32a1344f64b5705071f75b5d0171f36656acd48ec
SHA512f9ce8628c5d209cb667caa530a43249ab3fb73e2a9028f72f2f3f3c6dfa4abc16f69e75efdb1b4d6aa30c4e8614da994348a48429a0ee765dad4a6a68975edba
-
Filesize
86KB
MD5147127382e001f495d1842ee7a9e7912
SHA192d1ed56032183c75d4b57d7ce30b1c4ae11dc9b
SHA256edf679c02ea2e170e67ab20dfc18558e2bfb4ee5d59eceeaea4b1ad1a626c3cc
SHA51297f5ae90a1bbacfe39b9e0f2954c24f9896cc9dca9d14364c438862996f3bbc04a4aa515742fccb3679d222c1302f5bb40c7eaddd6b5859d2d6ef79490243a4d