Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/05/2023, 18:56

230502-xle18sdh8w 7

02/05/2023, 18:52

230502-xjbwssdh7z 7

Analysis

  • max time kernel
    31s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    02/05/2023, 18:56

General

  • Target

    SKlauncher 3.0.0.exe

  • Size

    1.2MB

  • MD5

    32c7e3347f8e532e675d154eb07f4ccf

  • SHA1

    5ca004745e2cdab497a7d6ef29c7efb25dc4046d

  • SHA256

    107bb526c374d6fd9f45317c0c16e83ab50076f2bcd630caf3d6794596fae69b

  • SHA512

    c82f3a01719f30cbb876a1395fda713ddba07b570bc188515b1b705e54e15a7cca5f71f741d51763f63aa5f40e00df06f63b341ed4db6b1be87b3ee59460dbe2

  • SSDEEP

    24576:Dh199z42ojP6a7HJlF9eu5XFQZSIZeNGdmEE8H17UBcegl:R9zbgH3euNFQZr/oEE892cfl

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 27 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe
    "C:\Users\Admin\AppData\Local\Temp\SKlauncher 3.0.0.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://adoptium.net/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:468

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a6997745524776bc11ad35ec73e13f85

    SHA1

    4290c6ccb9ee328a722dba0dbf4b711df032871a

    SHA256

    d6ef8781653dd6fcc83f60079a264bcd6158527f1b6e977b09b06e4ada54a67a

    SHA512

    fbb6d08a93d341b4ad0ded97723bebf7081fcc81a42b0f2126bc30dad998c45b3b8a5a013de1af4b1bd8476025d4046a8d6501d6df8598db3a79ee48cbee57a8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1daa49ee28f08297181a1a162c39cf16

    SHA1

    a2399d0b04b93c15aa06c7e92a95e65cc2b2632e

    SHA256

    c93aa9b1b0f4210c4c6388e18b6b009e97b13f50d5e7fa34443fcc31214cfdb7

    SHA512

    497e79ef9e0e6c0d72dad3478ab3bb63c315252d0481cddc3ff8a359051ef644f31f5789e7ad5fc6792d90ec8ff1a792537f88dbdcfc3aab45ed8d46516b853e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d4b0a928aaa453b78b8b7c6f730a2d79

    SHA1

    53e6a690b40ab8c2ee7199e016879a509dd0be44

    SHA256

    eb058afafb6f8979c285c1e2069b5df5ac4e05d4399fa0a3865e8bc565f7c1c6

    SHA512

    42d715a284eb0d06921dc3e15004e653e6fcc1d87011fd7013daac76a7c3d7f9dd7f8bc3d7af81a39e220776a4feec6e98e8fbf583de1ace903ffbdd4a09cac7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6e3351b9644623a5ab1172f43fec8010

    SHA1

    2d448d2b92fc44c6671c999c51a547b0e5874f98

    SHA256

    32d95692c0c585affb8daff8799dcbb61c2e9d8c2d8ae71554bbc94d761ff76b

    SHA512

    530711e125a5588a0118399fb00ebb30719e088e2967fed6c525a0e511ccf92d436afa31f418cd79dbaa3813eed36aa8b6925fe8d32610d5db92b11920308f62

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c47ab5869f90c9f12ea5bfb5c09d8934

    SHA1

    948b1ee654e4b36ae5cb3c2248ac632f9ddf7d1c

    SHA256

    63c58e969dc588d443d25c59ae0a704de0d06965d33fd03c4539456f72e7dc21

    SHA512

    195a504da912b3fd4de0a44a04264e4be37d72e6ddbb2cc60bc106d40296296199b5a9e61f3099f90dd188aa47f85b9f3ed46a15aff8b18493a2bedb052448d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1bb0c05d2573a14f3c7ac4add7dd7f33

    SHA1

    66cc1fc38d6bc48bf23426834c57996d8bdff4e8

    SHA256

    20a148dde7e498b641d89c9e996472790893254762c9f585adb055800fdb7d63

    SHA512

    3b35e720b3205ae970fb173389876b098a686f8c09f309a368231dcb54f835d4b3719aab6becbfb07ed9f8a5edf8cb2faaff7b6ca5821d0038cb868226d92779

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d9a4ed0c609c5e7f3f724c4c0caec6f8

    SHA1

    d010d86f27fecc3051ffc72d0ef15347a07b592b

    SHA256

    f072935de1a567105290148ee5e8c65c1bb9fd7633ba29279cba4e46c66c6036

    SHA512

    8783c3294800f40bc95b22b55fbe8da6132ec9a4069ea6ba2fe8bdb74394315282ae14509040593f8366dd58559a30f210b8b39b4583a121ff6857249a2e36ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a7d180bacbdabb8c9a05ac70f773b2bc

    SHA1

    b36cdf9ba04ecc3c5e44f1708119e0569c0dab3d

    SHA256

    42564d375e7a88be84728a65bf0ea39061411a268a3c805351ab498c46ea4ca7

    SHA512

    7b5770ce20bf700b133442e9b6a8baf2d69f8308239976b7c933b67c0b29d72eb8c608940cbdd5db54ce9b22df1c6ed58b0514fc481053bdcd0db0e4fe7e26a1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    17848e3e10c5fb484454e09f4cccc0ec

    SHA1

    31d787eeb3befcb575479845aac016dbce47b10f

    SHA256

    048389297a4ae760d018537256d6e36a8c69bcddc6f5fc258193d2610b29feef

    SHA512

    2067b0a702d207477f2ad9ec27afa806bc3b3ac79988207d88eb917b7acee5bc7b4aa52af7bb5ab1b02b9db6ca57788fd5caa1aeb9950b49432265968ef19260

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7f837bc4a0414313c3b280b940f63061

    SHA1

    512c9d43b55a2f23c80296b89bfb69184354c4fb

    SHA256

    9f1f79f940ff6cc57e81afc14d311a0b150e56bfa58cf1d58166e0fc3642a25a

    SHA512

    314843df2ea4ca5c231f7bb98093752cb6b9a076c0c852b4069cb68e27e14e42e4523ea30a16e971085d3f88019713f010632db1fc59229aa6a8289dee5b3c7f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    872494b78746cd509368b364a44b3c4d

    SHA1

    c8171d5b8391da61ce6992edf022385331780947

    SHA256

    4dd32dfca2261449432e8cc1a8341e6a62f7ba2edd9bead1ef772596fea3506d

    SHA512

    9bd57d751db67e7b40aacb5d3d16c9b424efb04b98228fd73a23915d5a813b252cb5a4a3270742c729f9fe28561d4e655a5a40a0fb7bb04dd44525a0375b13a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8c4589e7a4737e103d38c5b84d8173c7

    SHA1

    be163b68994a791cf5921ef33b757b5b5cd9fa01

    SHA256

    46e73a23312489a758c1c37af6546ae77dc59bdfa38dbd73a35505e187e01077

    SHA512

    c3fb9228914943d0ef7258e5951a6871b1495ce812cd9c23e8afa4f85cf8a63767c412ca9ff2784f12bc2668d2eaf59dd4afe367a1aa85936b05ee81ae2b1d23

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    971dc74ea7c7207db7fc06c85e93ea7f

    SHA1

    5756a75f55a38118156f2720c5c0dddafd469e6a

    SHA256

    3ad39280e748b9ad194aa7d476f39ba5cb83cfabd0e1e42a5fc0ec621fc77a15

    SHA512

    f560628dc78d7aed60949c9a25c66b22f1e17c24e7a8c7597982124cd3529d1165b655486717178c6693e4f64999732a83bdb1f6b0fe548bf19a7a233d7dcdc7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9077f9d396a369ddb8dcf23c86a46f54

    SHA1

    5435b3356d6827eee259d216dd5faf6c8c9d01eb

    SHA256

    c436d0400425401553fb3721ec80c2f9cf66498e0cf99cbae93b9d494551b003

    SHA512

    daf942d3b35f26629becee18cd97c2fe08d5b1e23980118803233fffc29e10d56fe2141afac336b85a024ca67963de5ca56282297c78dc4a270b5400300891e3

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\jo5ozfo\imagestore.dat

    Filesize

    7KB

    MD5

    db5893c752bba9e6291ce9d2f930f066

    SHA1

    145c9099ff948549d2a62ad3475b1c8084ee5122

    SHA256

    9a48fb7c0c58835d5f707fc230b3496218df4afb0790f28ab541963959dd5b03

    SHA512

    e3b45891d2c561234e3bf82f3dee1b035f0d627cadd2222c94b293ad1745bfea18747689ec676631ce36dfb02d7a6dc8522b958bdea772b9d2123eda1b988e45

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TOS3MI7U\favicon-32x32[1].png

    Filesize

    2KB

    MD5

    dfb98b35bec083cddf7e575ccbc12efc

    SHA1

    f77c5e6f37aec582c5977a76691f992e3ebc3a05

    SHA256

    f053cec8f37df661ce13646ff5ecad7050bd50c4afb4f7ad12cd252577207e66

    SHA512

    17d2d675bc677f126fabab826b4fc79a05eece52cf586a97b7d8093dc402d0160f273fbf9d38978f01befc9f85a979208c2355cc0a4c129a2232ffa4554961ef

  • C:\Users\Admin\AppData\Local\Temp\Cab4210.tmp

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\Local\Temp\Cab42FE.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\Tar4380.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

  • memory/2020-54-0x0000000000400000-0x0000000000435000-memory.dmp

    Filesize

    212KB