Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/04/2023, 14:26

230416-rrz1psca9x 7

16/04/2023, 14:22

230416-rpv9qsad39 7

Analysis

  • max time kernel
    120s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2023, 14:26

General

  • Target

    SKlauncher 3.0.0.exe

  • Size

    1.2MB

  • MD5

    32c7e3347f8e532e675d154eb07f4ccf

  • SHA1

    5ca004745e2cdab497a7d6ef29c7efb25dc4046d

  • SHA256

    107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b

  • SHA512

    c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2

  • SSDEEP

    24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1048
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1724
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1724 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:684

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    e71c8443ae0bc2e282c73faead0a6dd3

    SHA1

    0c110c1b01e68edfacaeae64781a37b1995fa94b

    SHA256

    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

    SHA512

    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    da26abc42d8505507e0bb6d89eaeb901

    SHA1

    f2a1743994285ab2cc9fa625db87f33f0bf8e521

    SHA256

    21caad727d538b21df9e5a597369e907542cc5bb558174d942dd982104ec08b5

    SHA512

    25a0c0756125d1b49310610b7bdf9b9a2a6328fec915ecf4c7d462412bac221966e6fecb3a99cb9b337915286e14a3e65360a0d2fe7cd1f62719851f37d450c8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    d2c959c1edfa927121a2972b39320ce1

    SHA1

    35a34e693bdc7f5cd4a8168759370b4743ba3d22

    SHA256

    ff898dcab6459ca957cdd197d8b2e3a714a0bba6863bcf69c74c688d7b3d2ebe

    SHA512

    bbd6f92b41af608ef4728af081ec84d71c0f74a24af8e76e2dd352f4f8441f6d1f35c51313ebe82036fe41f8f5f02ad40c190ec8aef80ef5c7e1928204421d11

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    6f8549f94f54cc8ca0785069d50a4fcf

    SHA1

    13d39905f6d294659ad89fe207792c2c83b65794

    SHA256

    a7993653ccbd2b86d040bad95428abe7e82884f96203659b13a7cba5d5d86ebb

    SHA512

    3061deaab50a52172fa9508e337ca48ef83b3e502dc8fe1c1e04d2c1d0d1dc52e59977eec9365f96042d870a27cb344bc1a80b75d6f653ea422af60dcd9ee89e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    0b80eeaceb290fc6de257bb26be4d750

    SHA1

    1d23a1a952b0dd379365eebeb4df9f6b9bed84a9

    SHA256

    f33527003dda61118d7f355e6f620ab9b00dedb002457d376e112d6f8034f175

    SHA512

    e778b16df08e68e2d783aca5ca5b487e77853163cbf7209d21297ef37590738f35040d883c662af15fdb843635a73d99cd524843e26a4c66fcf2cba7d1afd902

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    9a83b2f6335101f5916a33a50d02eb31

    SHA1

    3cde10bdbb9e41928acdead186394f3ab61ebdd2

    SHA256

    a014fd7f0a6fa181523724feba6204ba59fc0cf9fba755364280b54035a2f510

    SHA512

    ea7e8a7a01bfd67aacc6956315e0aa94fdce89545bcc4ba907e22df04ab84b9450f64e82c1c24bcdfaaf814d2a9622b83426b73167ad99e6e851d79d4db92359

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    1529c0ea0bb6b8c81c684cb4986a9fa8

    SHA1

    7dd1d79c95cde072fa4a0661d07cea06076fe6b8

    SHA256

    f20a794fbc1ebed0ad67d221cac6902080a259d2da7ff7ba438889b029be00b4

    SHA512

    c131e84bad6c69fb037a07b4518c641c04a5114acd24f812fe458ac519d1b0a4b2738bab34175811bcf50a336fb705d40d2bc92fbf2a8779c713ce5c853b3de7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    d19253875c19a6f2554a05610180547e

    SHA1

    89c1f1a4371e756d89c4bb88efed5f4260c22eb3

    SHA256

    20ff4523614e9e8d09a7ecf051c62c23965d3918a65de85d7a049d3e45647081

    SHA512

    56c3383b484bb9d4d1dea7b8be68a4c3d371588d838ebc8ec09b95358470469e2b3ad6eb89d5e40e9a76db46d7364f1614c0ec59ae1ae77b3d7b3c07521e666a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    7bccba20bdbba4e47cb0f69fd409bf79

    SHA1

    376f0ac61d49cb999b0ee68a87d7cb3d749568ba

    SHA256

    9502abd42efe12f11c0abf9d99a6bd1f60934aaf52b46df0e6d011d29357b4a9

    SHA512

    a49374b7364b44bb1da4b3520ee075939b5e4181e7566df89d0607410bc5ddfd0a1a4e2e3de57056796671b00631cc541213d36fe17b7237afe4427ee70cb38c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    0738834c40845d9034143686170ff764

    SHA1

    03b2d9d3e08c4003a7393ca514bddb3ee08b9922

    SHA256

    8d3f7ae4189feee0fd0365d85bf577243db28c64d08754a4f5c45005653cf59c

    SHA512

    278d7458ec9ae3f2d112aefc536c8a41604ed3c91f0aa3ce430fa0f6cd2fbdf7e94ecafb5df6481b2e1f59c183baa4b06949065dbc9fbc591d68af7a9b004278

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    b27e9da84f7f5ab8ae00471dbb11cfd9

    SHA1

    06e402a2385be0b525596a836110eac49707a88b

    SHA256

    a11ccc88dcde8bc3ba38a6733c4a204a43168fc3e7aa6c7f9ceedd759ed21c68

    SHA512

    7bc1fc1a023ca70d9a41d01ccae9de91d7a58b35e586cc4c6b6cd07ff455869067014bd1259e3272ad8cd41213c2f536955ac7b386b2d3f20b25555f80e3fbad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a4addfeb0c4400537eb1ab262eb928aa

    SHA1

    b63e1f93d60e7243a9f7952510a95907a61aeb1a

    SHA256

    3259c2c5b5cbbab84f09957a8c0f80865c97e2ca43f5f4799b672c37635a25e5

    SHA512

    9b862f084464eb05bf38781889d4f7faee71de10021777e993eb0a441f896b140c9fe0ce356a340e5d4abe5296eac30d4ea53fd1f81b429a35501384e21f0575

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    bce8c687789b020cd24d4a262e8138b8

    SHA1

    79c32638675bfab617dee794002cfb97bf2d60cd

    SHA256

    f729cb7ce014ac3c826242c46ddad1898c3d97f7b4dc48c2819795948ca4bd04

    SHA512

    3a8bad9c47c644142497b713165822fd90192ab76df9512e1910d5484cd5f209f1ee0386178e7b717c3f33bdd49b6bb6ae11d48aea095eb2cd78dce8bc923f6b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    5718b066a97d18aeb8ce138f885cdab0

    SHA1

    46c93b9901c233e3d8c878f4bf64306ddb4ba680

    SHA256

    db1d480d62ab082104a18cbe67526eb2b2fee5c1745b845e8715e09e84f08ea7

    SHA512

    7b5917f795bc334f0baeda9a7a691dd954a16a15d103a0b4018034ef1086e6d2c81aed2e45434ced2db658e647594b9f9194a2c37eb1c76f9d98a0e1b04572dd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    35bcd079573062d6191ce01bd929769a

    SHA1

    47ba5bb17fbfd22f02675da38e02b0ec048cc6ba

    SHA256

    84992a4b0b85dfd8dcedb8200ff6dea09e19c938f7cb1038d9c87eecb5322c7a

    SHA512

    fe5c27862e6305ed1cd56935d4b9063e1a01aa4afb0b34f4275b4a7cc3254704fb7dc64942ce9b10ebe4d547ad14b553dd429a3c88ede102c90af64531324fd5

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\62yy7f8\imagestore.dat

    Filesize

    7KB

    MD5

    f6e4bed3587be3faab65f5fa407bf321

    SHA1

    b55299c22c528bbaec31ae7e5a959aa6b964eee4

    SHA256

    c72b620632f554cd5d861eba19d70054a39908d57f48371294efc182cb99278c

    SHA512

    f28c8d56e18a687aca25fcccc0567f3a49bf56fac0a9a3237bc380748212d323f97266bb7dd49765e35750f7cd99014636c7f5e8a6f9074d1f1b5f261ff54b2d

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BJWXLGAS\favicon-32x32[1].png

    Filesize

    2KB

    MD5

    dfb98b35bec083cddf7e575ccbc12efc

    SHA1

    f77c5e6f37aec582c5977a76691f992e3ebc3a05

    SHA256

    f053cec8f37df661ce13646ff5ecad7050bd50c4afb4f7ad12cd252577207e66

    SHA512

    17d2d675bc677f126fabab826b4fc79a05eece52cf586a97b7d8093dc402d0160f273fbf9d38978f01befc9f85a979208c2355cc0a4c129a2232ffa4554961ef

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VQ77JNZF\suggestions[1].en-US

    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

  • C:\Users\Admin\AppData\Local\Temp\CabB82B.tmp

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\Local\Temp\CabB87D.tmp

    Filesize

    61KB

    MD5

    e71c8443ae0bc2e282c73faead0a6dd3

    SHA1

    0c110c1b01e68edfacaeae64781a37b1995fa94b

    SHA256

    95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

    SHA512

    b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

  • C:\Users\Admin\AppData\Local\Temp\TarB90D.tmp

    Filesize

    161KB

    MD5

    be2bec6e8c5653136d3e72fe53c98aa3

    SHA1

    a8182d6db17c14671c3d5766c72e58d87c0810de

    SHA256

    1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

    SHA512

    0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LMQ1396Z.txt

    Filesize

    607B

    MD5

    bce007255d9b75de3e2c91b2e42719ba

    SHA1

    4f6b6b4ae93613559cda6f7b2eb9aeac50fbe565

    SHA256

    ea235a743467c341816aa018ccbc35606e3774b2009010d19c2d7a28e58c14c9

    SHA512

    22950c053dbd22d716b3953c9cf74f93cff619a6908a21ba83eeec27e5fc78d78a433f73ffd5652404a237cca2aed1aad393e910dee57d9674e4236948b7af2b

  • memory/1048-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB