Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2023, 07:35

General

  • Target

    2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe

  • Size

    11.5MB

  • MD5

    367754643367215b51b8c62c27d6990a

  • SHA1

    76e2d30b857659b44a3ceb6f7fffc4357ed2de73

  • SHA256

    2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde

  • SHA512

    1ccf22bd426be26ada7a8d19acf79e265b77f344a468eb9e37e15e55ea879ee08817ce33346fac3d99921c1c8a93c9c6ee74b87d62291362294c72fa642afaf3

  • SSDEEP

    196608:m+G0ziAOy1+0ziAOy1e0ziAOy1+0ziAOy1H:dG0ei1+0ei1e0ei1+0ei1H

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 44 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe
    "C:\Users\Admin\AppData\Local\Temp\2e849c6ca14b1557455e40e4a2c0962500aac9bbbbf4623e8b6e3186b56ecdde.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://game456.lanzouj.com/b0cxsd4gh
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2480
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2956

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    7d0c8dd93e61983e2f1edcd21c532fda

    SHA1

    f2e65cc6957d6bfcec25d041206524bd5690af1a

    SHA256

    e4e940331b1e68961b79b8cfee180490bf1be09e044fd743961a117bad2cfdd1

    SHA512

    4a1f62e56188252932dc8d9649a928cc491bb7f699ca7b20342c1a661171228d0cf6bd905612e66cb3d1d0cbed6415d317c27c59d44bcd8a0a78402acb9a1047

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    266672336777f28b69bc435d00597a22

    SHA1

    702ee90caae60f15c4a797e7b01b17092d8fa2b2

    SHA256

    7a8d27df92cc592d637be3b95d083c9134596dab6c84e8f6bdb1b8b673b039cc

    SHA512

    281e391bd2516f8766bbaed35625aef969bb1142b6e4160e462aa8f8a017b1a5091726c8d921f7c67240e7a7857d2c29525b34b4ed35b507a229814119d21fce

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ffdef7ba00acde5c5e12eec0c4f14f22

    SHA1

    65a28ad034f436b80d7e6cd82019fbd2d7529ce5

    SHA256

    ce6d6253e0cae07978dbab4e1c9d6b156820ee46fae6b70f5d2f838726f1ff7d

    SHA512

    86aefe7edc788eec7c96a0bdebdd6a1590537c228a3c95012f6b73d79f67d936fb05a299a5d599365a4c21e5a4bc0a946220918a6c4ecbfc6ee9aad62c83c6d3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    66ed01d951db736a68f7eb0817193389

    SHA1

    65204a45d3bf0f55610ec03cc68c30223a5c4a73

    SHA256

    1c95ddd0367e70f9072e685e015e3db09a2c7aaf4cd345a814b211a51b504eab

    SHA512

    e7260c7380a30c9b54d57886f479fe89a1a46e0fa2cfbde621f12b9022c229088a9b32167ac47c927cce7a9c079b017d937eacf329e4cbe4c919f45603ae5ea6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e6d6d27a9071e96f2f41160cfc8f0542

    SHA1

    2a7c177448bf58cec72a5a63b0a32bf9ec4cd11d

    SHA256

    1c79b410afce6a5501ad609ebb3250d41acb1a64e975e1fbf9d4a4ec2ccad848

    SHA512

    88f428a14dd8b99d80bd51df9efae2ee4dbc99d3109f8881ccde1e6958e98ee477148c3fa1fa6111faf7d7a100c085c7e716d9657c83b1c7930b52aafe83ccfe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d8042a57d480e149088dc8fbdaadab39

    SHA1

    5ce0fa846b99f0c4fc3d892811d221461070e27d

    SHA256

    0840a989ea2f5480dbd5ad792ba949c098db5df73ebdce98831e96e4f36a202a

    SHA512

    c3ca309fabddc5cac1f7fa95fab185b66f7017d3d6769004428fe6eff8da1e0a5dab702da41e2f27330feeb24c7c6e8a2073b66ff9bf306c3d3edc08707e8af5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5c9734fc0c1f7fcd7c6c13b180536ce9

    SHA1

    df6d108ff658770a5db01f89674b57572ebd29c8

    SHA256

    203ea5e36b146a4527b5727136b8c99232f791412622d552106ba5858d15cd2c

    SHA512

    734f373ca314ce7b5658a6996e93dd1406895c4c94c4c6e9cdd2130be0bed56846563e094e4f6e27933e28e6770f3f17c370b667f8b941710960f406f8c12803

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f142bdf25c97bc45c6389e7acfcf49e9

    SHA1

    2648c3e413aec1a1beab1c6a2f8356ac348ca79c

    SHA256

    0e41c5d133129f461fa0d6b2ebd22fb0257eb81e3f491aa3f5ab8427bb6a9a61

    SHA512

    7ac2a7a9e66dca35471478bc35bb3813e5486bc83fb7c545d7858b7591d6c0d9d040d8e7bd72bc157ae5d7fb077c3e438c4cf1ccd133a4d92d0e42488cec761c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cd3850e451dec814f6f316f50a95c1ac

    SHA1

    fbf011704af51b5a4a8fd00c3d81dd87cc6e5c3f

    SHA256

    6e9cb266e7cab5d6ca46f3ea2fddbb82a135513cb799cb447b69ecc383d3d305

    SHA512

    ade3ad45c7d28a51cb63a4ace62f04ea7482d9ae733098c80d6f966dcca0548a746f5aada538ce65decfe168a50f36aecd1882b88bc092bc1501e96c1f45e58c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6be644ecb062c9d3ddc347f9c88b2d88

    SHA1

    4450a236ec64278d720d03d0d7ee6cf3306b0539

    SHA256

    54aae7fe1ddeb6b4944925b450cbe364315f7ba84d1070924f7956731deef067

    SHA512

    43642dc7961b55d5f4bbe4a7ffe49da140163dd2113af55859ac41fea222a55e5cde51689823337b7bb5e867f2f9d3f9c1f484061f759db9bb9f3ea7c25b21a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b2aac409d6e72c455c4b5963b37850a8

    SHA1

    b989146d1713ba521714e4e83b898e15786b6a91

    SHA256

    d64b76c5a098c3c33570cdff1c618f3f9e47d36e4e335a980a0bc2315695f2e0

    SHA512

    eec5cb5daab951fbc7d14ed00f976630fe984ede9ca31cde24b055112affc09af66c3f0dd7b3b9f45eee0743f2a5f69f29127d7233739d983772f3bccacbea1b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    88f5b2ceaf52fb584d1c43699534f12b

    SHA1

    6e1e04d319ecbb1309ae738f6dcd7d37e6754f4b

    SHA256

    b6d48e68edc1753cc28278e0d3904ea86a38af77b1fb75c2f1797fda341b5ed7

    SHA512

    6787e80a2b22ec1e941fa9cd6019700f24642d0016574036aecb7950aae0d3d280cd338ed252207260944673181fe35f37d86655470fefd643673985da8a342a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cfe4293e57fb5fb1cac8e5de51f47ec9

    SHA1

    8d1e3153a9b55d579336883d751e72dfcac6fea4

    SHA256

    00406c4cc5d7be1a43b1d854415d925cdf35c9502fd7ce3f5527378e43ac29c2

    SHA512

    a8d8fb79b4c1caa954756e6ab6bc559eed8a06c27a7086015b75133303fae578a4c0afa9f5c97bdd3848c5f1f7802b28ff34104bfb10bf39aa8ac4e7062d4457

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    edfbcbca68896b98078c00e42ac42ab0

    SHA1

    e8df6bb530c1feddbce4d85ce80a530a6b060510

    SHA256

    911772dc0cae0ffcdece5d6598531261110d46b96612ee2500d17905cc01943d

    SHA512

    fcc391c3de8affc2157e71246dfcf36077f45e1ce50bcb7c30d5ac947a706100cf244d82dcb8c5861ff855ae3d77c54b69b982a633f663c30ce7d13cfa23541e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e6fa71c0d7a1b6b78dd3c2054820abb0

    SHA1

    a868d5e7b3c04409b35c98433f4cc8e22d75bd4d

    SHA256

    6377edf8c398e33029720732b1286733281d3bcfd162e70299d953a3ac29f7f3

    SHA512

    8f8b85e16f9815ff5434c77703d539839baabf6c594050b8369482336472e8903b74413e45ac94666d6d9c38b4afe8ecf4c7334aaf689c45636f66ac64d24a69

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    88e6cff149971907eb4e33af39755577

    SHA1

    2290d0bcd1baeed5b6a1f0389989b6a59501729f

    SHA256

    b43046665464f5bd53ebbcea621ed8fc18b3e5040a8d6a5049b05f2075237c58

    SHA512

    4efebe912108a9f63984e00d101a46c0841ef1470b8e533b4b87924a7f19aae278f433d7eec858711070cc38f788dccacb29df3188641627360fb346493a649b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    09f71d90bf67dbfdfd95506a753a53e6

    SHA1

    9862111a609993d0f8fcfb06a98c0124914c1d55

    SHA256

    241e15aed2c1503d5191531cea2b96b2c51f330e3cb8937bceaaddc24cbe3018

    SHA512

    d23bddd92fbfed33150508472981186fc1fcb3a7d4f617aed6660665c9c341a968d93fc29b0a52d3af6540512a0a7316878cbaf0d8b0b85144387b1bd86e772b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bd169c60878223daa2f37e3cde754142

    SHA1

    125e5f6d7ff7564a6180aa70d554da18edf2200a

    SHA256

    c016358f6b7ca4ce8b9060cca1c78f99fe2c15e9569fda55fa842adb320b3af6

    SHA512

    c7b0af9f83d3169fd7916df557851ff58ee7419cf9faede9ca415841012f638a445dddb4765b569bd0a5f03c17ea9b133aa8929146d510fd7a4064a06c684812

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8e96a73446b2e7d4c8884d3a305abf47

    SHA1

    bca09cd2e2b5473dcfd37a3d2b67dca1773e404d

    SHA256

    a80ea65a7839f3f2a86901bbbe0f139989e7973c6ac30218aa8c6d1d4b447ee7

    SHA512

    e8877dd4e005904c4e6ab5520e9c232843753c157d7c6f3375a3ff851e4cc08cbbd2f96e38885eb78a9711eb4a958ace018edc41a00fbe2d24f65763a2f496fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9075023f0fa6a32ab59ce7b86fe64c69

    SHA1

    a4410fbbc801d93469b685d938e284a9eb5eeddb

    SHA256

    7df2c352c5aa7aec9a75fcbb2310f86f6146267bb72b0cc95b1ba5aa8b49c037

    SHA512

    9d7c38880aeb016b5975096c6236a0b06233071e295db765ff86631ab5f311354b788ba990307dd5ab4904beb5c02d9954e126ab3896b0091a30acab8839e877

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    122549166833d294a77046608ddb7a59

    SHA1

    c984bd37ef4c3f3e6fcb6460787b8426d28cf15d

    SHA256

    55dcba2ecbc73cb3c70b493cd0c4221331fcef7e6904debfd2de836908d22311

    SHA512

    7b24ddc255777e22d02a2445bf2acead0db9856be883e8d25d298eeb415cdf00e3fc996440b36fd69b7c96a16a0ac5adaba613521814d4b332f3facabfcd1dbf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    1519a959a31b4a3e753f69d36d65792f

    SHA1

    03e505bf80d985e86a5312bd2adc3ea1dccfdbd5

    SHA256

    55f2a5bc28a7e47d487ee9e864847bf25acba62a3bf4929b3a7ac7ed1291353b

    SHA512

    c0ffb28a15e79c8faf7f95a5de8ebd602cd5721e2755924b722f02ccb148a7761bf1ba3af4ff46e41b106bfa5661ebba1f410e4fcf933b50614ff10696486b0e

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\ba0y71l\imagestore.dat

    Filesize

    5KB

    MD5

    f603af539846bdf3d04c8410e2e4a187

    SHA1

    43cdda6310be9a914ac6811a14be63886b0f25fe

    SHA256

    28649f9feb5687f51f732904bc87aaff973328e7aa5a88a647a88e83a9a70ae8

    SHA512

    333b460ce05de767636c6b93b11798deaeb9bb630d0d8be062a99a99c6b157a10787ed7f9e24143ecdf9efa08b2b766e1543a70319407afc68fd6d2f9bd9630b

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\U9ROV835\favicon[2].ico

    Filesize

    1KB

    MD5

    e2a12d30813a67034ecef52f8f5447d9

    SHA1

    87cbf0958c40d8c61c591020fae3f5e2b5dfb6de

    SHA256

    22489aa1578915c922e7d16566a5b926a6c430961f3327e90f0b10dad21f0781

    SHA512

    f9743821b5f4a1253e600813a3ffc81ee37bdc0774379227f9b5dfb2fd7aad3270b01246580fd73e8d42cc0611b6d4078ef09b4b53f2edb2cc6cfa2c83d54c48

  • C:\Users\Admin\AppData\Local\Temp\CabC6BB.tmp

    Filesize

    62KB

    MD5

    3ac860860707baaf32469fa7cc7c0192

    SHA1

    c33c2acdaba0e6fa41fd2f00f186804722477639

    SHA256

    d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

    SHA512

    d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

  • C:\Users\Admin\AppData\Local\Temp\TarC6BC.tmp

    Filesize

    164KB

    MD5

    4ff65ad929cd9a367680e0e5b1c08166

    SHA1

    c0af0d4396bd1f15c45f39d3b849ba444233b3a2

    SHA256

    c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

    SHA512

    f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27