Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    138s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20230824-en
  • resource tags

    arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
  • submitted
    26/08/2023, 11:26

General

  • Target

    8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe

  • Size

    363KB

  • MD5

    f8ff4c3e58467c6cf508406d8e310d4d

  • SHA1

    0f184a551ed3fee20debb2e62e22cf2aeb6c9712

  • SHA256

    8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665

  • SHA512

    a3db0bd51604f347c00bc151e11d573cbef1f3e1b256108900a536ed88467f93115c630b26331a8f3ee1692664828cabe071c906b9ae3591c1d075d3eba78c33

  • SSDEEP

    6144:5NgF4DxNuJc06j4YBa77xMQxA5i5knmv1SL/mQXhmFDW:5u4lNAtYytvS5Aku1YLgF

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe
    "C:\Users\Admin\AppData\Local\Temp\8e5609cfdc1d9b4e0fb1c1489df924b09860db0aacf34e142273e69bc3cbf665.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1580
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://skjp.zcjczj.cn/bang5tao.html?s=140&v=141&c=148&a=163&m=&t=1613640219
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:932
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:932 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    7a4b4f974bb203cd0621e664036d1586

    SHA1

    92a0773a0a4cf5524e7787cf3b3ae8325cf51c8b

    SHA256

    daa6bab46beee3196fb2ca066f8563d7700379551b4cd94a6e6da37e3b1392a9

    SHA512

    0e6e79f19aca87879e9d8228e2dcaa01462c689e8c5335e78a18291eb457a487dc711424da06d178d6091a04167c7e207b264a22d260d381a3b787b5d99d3a25

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    c4987d2a17708b0cace966f22204b1ac

    SHA1

    221c3347f29b9934bc014539e87bb5425615f159

    SHA256

    fd5d4f18f83efbb0f33e7f3f21bbc08000604c6ed1340f35bef885d2b0337988

    SHA512

    fe6b2b7a9b9aa6c86f601dd6e160ddaec868c1e1b5f522d1ff5c5ec6983704c5a4104ce413751a5d337e1b5e4b568cc9b0df272cbecd0a41c92ae1bf3998eae4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    775f63132f1f2470869f814afd784fe0

    SHA1

    fad4dd03d868c6f7d022564fc6453947d073b530

    SHA256

    8bf8648c0a9760964445d87e03b74ac251384eb878a70812bdc40482b5a3414e

    SHA512

    3b7edf989fb841256d7ca290b44543dd93a11e55615c8c3a601f247cfef87cff409ef1b5b92a8a2a2d3c2b9f5b7df6701334715dc600f036dcb4072251468f86

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    59e906fc74a3d1075dc4fc52d3d80075

    SHA1

    321170c039cc977de73d3173b93c967949893615

    SHA256

    375b57bba78a4a1f9ea16c3f2920abdc557159ff224514473dd1117e48682014

    SHA512

    7342f9927124245f12f8d2efa78c1a9f6e71d3133f0c060e14c010e8d75232dc65c693cb260debe799969f3387544292abffdd887f152d177e072528f9026954

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    395a9919cd50ce47d10857c2165ab84d

    SHA1

    70d6fee65d594eb6e5cd1f1677a58b297ff0c3ce

    SHA256

    6a6a68339d7dc5162d8196ef5171e78b201781b70eb2effce32b06aa77e16d86

    SHA512

    cf7444ebdf6f860aba3091917f8630435d78314a00c23267f1d10e69385a81ac41ed5976226951773def242b036018b0ed3638afdbd397557ae2906eb249e375

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    0b8d265775a669dd5a064e64e2026f91

    SHA1

    d713c750db4637312bf902714b2a82a934853ca9

    SHA256

    40bbcce579d5292aceb7fc07711d30a965661120fd7683bd27e1ab22dd83e9d6

    SHA512

    c68d9f655542b00a499c9031781aead7663673d777521200bc1b676d27ead43c3d3dea999f8b9870a709ab32b74126f373a23aab88bb06a9d5b4f6524e2eb3e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    a2b837ab7ce9cafcbd1906b3da29ed33

    SHA1

    19af8dbb69c277e4ddc8e431d6138e09c62eae90

    SHA256

    cf8083de7a9d6beaeb960f64c5cedda12504dca8174074e7bd0c756c164ce388

    SHA512

    68a0defdb7f5d6935c307e7d06aae5de850e4b09b435532e04a239754ad6938b804f985d695a858083dbdaaa2c10006d6e54046d2de6465fd3fe00212a9637e5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    f3706230bb842c9c834a16b8750bf1a5

    SHA1

    c951f76e544d3ba0feb78fa5fef2a29f43e8799a

    SHA256

    4e45d763c1a15361ca27582bea92f09fdcab1faeacb3f027b33387d71b34a9ae

    SHA512

    a569bd474c3da2444cffe99638665a7d85960aca8aa5b4fc3f0e36d3de697e4e4037a86abea36f2f53199d1d15eb8ca48f3a8d24f6bfec24b875e06714f5cf03

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    eacbe5d1ccfc23213914c51a3fa5cbae

    SHA1

    79c9e2239a15c6b03444a0945ae14211b30f0b3e

    SHA256

    bebe6416cb616fe4daa07de31716a738a8547f4d4bc8364358357644b920fe7e

    SHA512

    aa5461d3a58fd668d2564c517681a35f5a3815c161c613a658234f7e558aab85798f4c6235f708cbcda68f2cec2b7f8d1c75186dedc38ebe9c62f99f72cc62e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    b46a277397975e12fe34fee9f7ae7d55

    SHA1

    121f932707218cefbc51f4b8018686e5d1efcb38

    SHA256

    16869cb646c0c06d524e7c1069d149f090c3d41a7eacf93380b817f007a8c481

    SHA512

    feb1b82104119ba5091ec3bec2b5d87692e1b57ccc3fa18c38ed85d323044b916ee98ae141685f8782257ec5f7f6031e50e2758120fae5f81175088bf238322c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    1fd3e5d8b0d52ae3bace55fbd977467b

    SHA1

    198a74b6eeac699be459376e32665fc1cefa8d5e

    SHA256

    ef1c0b8990a1533082d0433328dfe933a40774e57e7307b4ad2cdf5e4d018949

    SHA512

    16f2e4ebb3a30adf7e901cfccf76ba522d88a764b1d1ac37243759b09b633ca9d9e670c3c420783047b9eec8215c1b8cc4cd4c837fd393c994a599d75fe7d5f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    e104718f551b971e70d0b8ede7622340

    SHA1

    75720409432a1eb3476f2bd43d42da07c09dae23

    SHA256

    6f4074384cecb257c585b47b99a602618d67b4091d975d4b97413409ef8ea7a2

    SHA512

    94d9e6e1784f26326db49b2d348840e58aa3b9da7f21dda52d076788e22d52d0239c9c1da576d34517f0930f4e3d073964e0b9de10e5709b0744a8c4c4503acb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    5317a3d808a152ee5ecb83ac37744224

    SHA1

    4fc9d8663021a54b810f56b9d8ebcaa83638d0cb

    SHA256

    b9ab696111c29d30000d760c078980fad35919a8017b0a2fb0d83e95c425a738

    SHA512

    5b9d2065fd59db4418ea4f7f0ca90444e96342b7f11560b56ae472156494f7600729fe4a2bace4dbae3202435aa87e886cda97f0113e09b4acb8f4c483699b07

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    1129c86fb73a374dde996340581c53d5

    SHA1

    553946257aaf877c338010ed209ef36f1ae6e183

    SHA256

    aa332905afa0d6f0f128b3aa61276659812870febdbfa28c7710977b5f640f08

    SHA512

    cbf2908d89979ff4e0098387cd3651ab4dec10a2713b26d3d6c32ecc670c30ae3c7dce0c5ab8a715641e3e6fcbcdbcb8befffcb255d8f2e7a57ae5087aeb0ac6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    27f54c7e6be41871d901e8009cbd4ec5

    SHA1

    cb900ced8fbd4ccead862203112c85256f1d1ef7

    SHA256

    632740c6f37d0f213b26aa59d844f6abc17ec1dd30cb79ed1884149490aa0805

    SHA512

    70833f4c128fd3265978eb50057693c9aff89dfae81e36ae71f125d286e1b998db3ddb777d2243cd81553383eb2961850f1394fb967c4f8556019d375bec2ebe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    1fd3e5d8b0d52ae3bace55fbd977467b

    SHA1

    198a74b6eeac699be459376e32665fc1cefa8d5e

    SHA256

    ef1c0b8990a1533082d0433328dfe933a40774e57e7307b4ad2cdf5e4d018949

    SHA512

    16f2e4ebb3a30adf7e901cfccf76ba522d88a764b1d1ac37243759b09b633ca9d9e670c3c420783047b9eec8215c1b8cc4cd4c837fd393c994a599d75fe7d5f8

  • C:\Users\Admin\AppData\Local\Temp\CabA46B.tmp

    Filesize

    61KB

    MD5

    e56ec378251cd65923ad88c1e14d0b6e

    SHA1

    7f5d986e0a34dd81487f6439fb0446ffa52a712e

    SHA256

    32ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0

    SHA512

    2737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa

  • C:\Users\Admin\AppData\Local\Temp\TarA62B.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf