Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2023, 14:53

General

  • Target

    CSGO Osiris.exe

  • Size

    7.9MB

  • MD5

    a819ebabc79374d6b8acd4d6a02e729d

  • SHA1

    2640748f1b3e64fe8519cc9f0bd041faf56339b0

  • SHA256

    119bf1bbbf45a69475ce460428b114770e04f46e23db526f4ec4165cb76f42de

  • SHA512

    83b34e7a7485872472b02c482b546123e737a875706d2140a8e379df9c65e3fae720b8c847beddf5acec291a00ff1630eaeb775565b5001f1982a5f98e6fd9fb

  • SSDEEP

    196608:AA24veRfYrTiPHJrLQKjwH5E69J83U7ClnMvga:AA1vVTS3QKjB69b7CS

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CSGO Osiris.exe
    "C:\Users\Admin\AppData\Local\Temp\CSGO Osiris.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1648
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://wuyong.fun/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2588
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2588 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    914B

    MD5

    e4a68ac854ac5242460afd72481b2a44

    SHA1

    df3c24f9bfd666761b268073fe06d1cc8d4f82a4

    SHA256

    cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

    SHA512

    5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    1KB

    MD5

    a266bb7dcc38a562631361bbf61dd11b

    SHA1

    3b1efd3a66ea28b16697394703a72ca340a05bd5

    SHA256

    df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

    SHA512

    0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

    Filesize

    252B

    MD5

    0feb6c7528633d5e7e49e393c052d739

    SHA1

    418384855c7a096baee960baffcbddf6d3cb317e

    SHA256

    b7ae1a01884eefb1d3c2b00143991f5b3fc668dc88a34a493405b4c62287fd23

    SHA512

    c343f4b040f789abfa7fa228e433b1e9e67e15bc3a6786e3b8b1d16db24c5e55060fc5e3e8e55828fe8ac90af2e3dcc5a9c1f0875212d6ade60f2d3505358688

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f42f209e711dc9a25e2eb2f03acd7847

    SHA1

    ca8328c01a9077ec5cb11628e92fae16317f51dc

    SHA256

    c2109aefbb21f308181058313d0cf77beab19876790700959aaf3a3adb90586c

    SHA512

    f42888f16005df12b7fbb4210980fbc6d4d928783f554de9c43e1ff683e7c1dd606abf700192fa463cabb122457f2f795ef6ae11be41b7af22d184a10593d55f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c75e3c64c60cf0fdce25160877664781

    SHA1

    d00fc5a08078a4f780d0823562bb6fb4f710d4e7

    SHA256

    d0387be5b1225f75f33822ba79830517788c3c4b7d48f5e0837dd7755674a760

    SHA512

    bf391611900dba69a2687bdd69e293131ce261d461a5a5b6471ef7f7d8b9af7a71de26d08d37753d54edefca137551d81170859f35c94fe2595e277f1d6474ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    be3114824ae3b9ff23c4a7be5bef09a4

    SHA1

    ba2c99eaab69c958e73513705d34203e34cd9ad6

    SHA256

    44671e378ba83ded7430040db75ef4944894e3557d53d38dda2455a32f3c0d4b

    SHA512

    7b95d228a2d2bbd963c10ac9ad388cdfb2bec3a7beffd937efbc85684fdd2984fe5ec5bd9dc0d7983b48ef6edd7dbe79508e9a82ca874d6b818c630092de2bb3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4d14fa93905f1a93d611f58873857263

    SHA1

    b637beb18cc790d1c71c004cc7bf35ef7c94c6cd

    SHA256

    605f71d6c9a6f2e3d28d9f13b94ac54b21d1b4ff40908dcd676e3dce15335692

    SHA512

    abb50289cf136a1ce9dbf699f8005c86bcc87899e9f405813ace0beee750da83c74c06e511b783fdaba6357465355261cbab25de2c7a35d67575056b98643f9b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3838398a64722042883681f9064bae75

    SHA1

    8877ca7e577a9772ac919af18f968155a84ab946

    SHA256

    75d9e1a9878efe9d71d6b57f2865472263f021cbeb5f988bba811d40afe5da49

    SHA512

    2aa82e0f9dce2aa6de4562924ba44739529874d532ce188a3e61351091c64f67b61b29add281942e40c02df5a7675b9d3319adb3b0e45065f66b1f392c6ae56c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e1f3c669cddf4ded8ae5e63145a72d31

    SHA1

    7a1d646be44a118f7ca400c80315ef9929b53f41

    SHA256

    24ecb5f424c9fc2f7772909f0da3d9972b1134d54620e0347fe281617c47a8fd

    SHA512

    576b99c2a17a7bb7de2481e72794ca2fec2cf3580d7a12da479a586b4e841a1f931c1aa6817b47652ed1280a168a6d30b1eaa466a3fda2b7d249e0af5daeca75

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b00f5799b980ace6ffa100fa99ad5d07

    SHA1

    ac4e35fef00f5928e08bbfe8cc53ecb90cc13a26

    SHA256

    bd2cbd21dca3debb4ac3ddf58ffb4f277b9d660401492ec771ab8b2f8ee801aa

    SHA512

    d52bc2aec2cb551eefb6aeabbd8dde718df91fb5c2c68bebc53f6428fd6ab6c712b72cdbcff176bea243c4f3a3a8219c09d4522d020c039b41f137b37df73ff1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9bdff64f68be34350ef8e82dc7d4fe7a

    SHA1

    baa14c5a11120fe750a0ac06c711e6db941fc8b6

    SHA256

    50fbd63c80b62a7a19d066a3b20568dc705ef5eef3936378eb8df79ad86c349b

    SHA512

    a4d1ac11db6f67765eac526c01a22a73a3b8d7cbb82089ef34111581c70f3cc82bc6473a9ff61ab0d025abf842a7843746424acee36ba75be0adf114e2d60686

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8264f639260983d97243a3c6ebdef0c0

    SHA1

    3088cdb00c91a016d74ec04b5a718008ea85d6e8

    SHA256

    89d476175ab4ce0647aed61d4ad43dcbd0195999d8d4cb9e33d135cac3c7ba92

    SHA512

    43b41a8cf2205f667d49e1a42bcd4e2521af51c517762880eaef45ae2eb7bc4ee891e393d54afa14c664ecb63d2d03dd91e7ddf3df209b51821e5d90057f0a76

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d12a96c8d3fed326da098d0681f8f2a6

    SHA1

    7b19b3b0cedd2fd7ef6c7e35e01a0b7e90b3a3cb

    SHA256

    f99663aa8808d5660a790396e35cf78d225da8584b7488a64ca3c3d96c65493d

    SHA512

    ca38299d1b0547f24ad9778274e1d18021bbd6fc133100318c812c759aa434cd11bb9243a1c4464452482069d4fc6d58f20c271eec7c102bfddbff372adbba45

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1d509d59673ba23735ae547b64feff2b

    SHA1

    115872c75a4a49369f7deac24c77d57b1335be45

    SHA256

    2a8aaa06aca07f0d5a398f02a7b9d962206bf910989dae0c5375149f65438c5d

    SHA512

    1137cd79d0bc60a747148c2cac8dfafe6fb736b0c698f12cee7b81c52d1765304c204f80f22985bba2016301ee4eff46d8f81dc3f33918bfcadbcdd94936fe32

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e5aef87b8b047a134f1dba403bc1b55c

    SHA1

    9b6651947dd70f511e6370a75084411d9abf3b23

    SHA256

    d56378e424e468904f90041c6b1ce6bf244fe6abc5dc0c3c2649c0bb671b4683

    SHA512

    eff84123af35052d908f76f5a8ad5a1eb2a728c7e70f2a67af46903be908be8aaf1e4555082ec6041cfb3f0a00f56dfd92102748122175af79648677104033ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    08744af0ae953ee895651e8cc8dd762f

    SHA1

    145fdaf2658252e2aec0ed0c0491eb8357f0f5b0

    SHA256

    71589df59346006d6a28e29c3a7ea16695b7bc11565bbf23f308e9981ace14e2

    SHA512

    358be3a6c9b41f19548b418bd5ec1c40a28b6aeee762587c97c42edc26eabe75cdda84f0353c712b9cf01ce4ea79fbab6831bcd1226c4a6f8eb28dd8a3d311be

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    37c3546d394e14cab548e09d1ec50d24

    SHA1

    372a9fd4f695fe971fb9bcda3dd2e25bed89fc0d

    SHA256

    ecdb17541f1ca9502bb46fab1b2dff41e6c04a4741010c1901f1695f675520b9

    SHA512

    6aed91075a72d006bcfdb5a7b6276933bb192293b73478df4aeea914fbd09b2d33d90f53acd16fcc56db59c20985f8ea50ed04b244b478413e9b5065875a2aad

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ad4448364c2e97d18973df2064ae255b

    SHA1

    f95ede427c77b8c6e72397dc54ef529163017078

    SHA256

    9e945bbc7090d6d40019a124ea2866d45f3ba001d3697a0048aa0e0ed0f6b7ab

    SHA512

    8c46d399ab9e7de809edaf25e31709c28eb678c6ebf9df23960ec482217abf5831b72e5a2ea09d8bf871f30d68cb564d82dc7c3d7b3038d9ccb136f9d4b792fe

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    987ac949bd47404c871d213798de765f

    SHA1

    7d846a04a743671ddd7c22a26c32b9ab2f0eac9b

    SHA256

    3817a8f1091b929b272c8a5d753c33f1816e56005e84fd52b310587111f6acf7

    SHA512

    9577bd57083d5bcc22a3bfcec1b369f040fb4eac29e694ba6c4284171225e90f8a5fc904c755b501bbc9e2c56992355289dbc22349bd9482f5693078ecfb5cd4

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    035eb09fffffb80d8bac63b202c2dbde

    SHA1

    e6e822d40f692bdcc96d04288c12ef3b48da2fba

    SHA256

    bb962c2db75258296108632f21020058fa7b48f40da30d67c99a7e6b62cb8f28

    SHA512

    dbd1205ea78d53bd73d2a443c23487084fa2c4f71967d581a2bb5c329d4a035225e2d436bbd9067567ae747357c087af2f2e0fda2337e4a559d2a503dd6d38b0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    58e8c13aa6ffb290578a334f7c1d8458

    SHA1

    3273d7237d6450846a1de60ee2e06c4b73eaa53a

    SHA256

    a108c09ce50952af2521343eabefb061f374cf8bc37b6c17de54a401a758fc9b

    SHA512

    f15d7f3dacfda84fd0f8ef7ef93ac5656825c58f50da599d9385c0877f0930ca88047fd835ea86c04b2439688925db2cd4e2bdf01725d2118e0b922ea4a5c2cd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0a4d2e7467cef6c51c8beac97800000b

    SHA1

    804c3de089a163c6ed3ddf0ac13729492fcc3c90

    SHA256

    dc5cc829757cf39d8cbb458155f82dad37d46c1a7a6993ac4de3c837f57c920d

    SHA512

    11fee84ee072dc13a75dfeeb44c429e0877952d2c6edb7f80d789f7c5073147822f6bf2537e8d35bc4b8e9fbe11ca913f4004fea7ffe725c630b847f3b5c744c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e9f95e2343f59592c7ef295c305df317

    SHA1

    a720d1801b63f901e96ca22f17f8b30a5d2f6c48

    SHA256

    c6e9276a6101d599b845a953c76a4522129186d00fdf9ca0db9f0bf1ef36e72c

    SHA512

    7a1631f422683f1feed8b45b0c50ac65c54f7a662f29d270df36853303581523d0e866364b9cd7bf00a4816388a5d82ab7ffb2a1480aacfb351ed029b8512fe3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4c80201650b61d243b944eaf49d5809e

    SHA1

    d1a344c0745bf1f388fc7f9e98e6bf20bbecef13

    SHA256

    3f9000886c8eaca9aba38efcab077818c1f57e19dd4798bd61ef1f9b56ef074f

    SHA512

    fdbd3572f76cbe73d2345243453f9df4146ca665ba2138e1826098538b7983a85a98e2f34f28e99cc63e7414ced573d5584e8d782752fc3cea9962f222f826ed

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    51d953059228c42d6e3685d967c65dc5

    SHA1

    d8be748127101e74e6944898dc4b9b4cb071ddba

    SHA256

    800e3356c8496b788f5228146fd490b2acbf9827035d2331042a79ea442363d7

    SHA512

    2cbe955f4455efc737fb4a0cdd84049d9b95bc5680f2f2b01c7e21f68875e763a01cf7067bfdacba7658702049678ebb149736217b199346c7146628042a6b63

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

    Filesize

    242B

    MD5

    7a3c6d944b8eb0b780b3c4255bd47c25

    SHA1

    7040805f0b36395fa1cb852e5c6b35bb03d0dcc2

    SHA256

    1cc4712ef199ab2b18963228e5b0e2ed12a92938f8fa111b7fc2f48a520235f2

    SHA512

    07aa2521977c4f7905375377ac870d08dfc735d991bf549b1dd0cd5f55380963b58c91e19ab7d1277c23b003a1bffe85ffbc889892b3675e2085afea57b492b8

  • C:\Users\Admin\AppData\Local\Temp\Cab9DE7.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\Tar9E86.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

  • memory/1648-27-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1648-22-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1648-15-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1648-13-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1648-12-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1648-6-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1648-7-0x0000000000400000-0x00000000012EB000-memory.dmp

    Filesize

    14.9MB

  • memory/1648-10-0x0000000000260000-0x0000000000261000-memory.dmp

    Filesize

    4KB

  • memory/1648-0-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1648-9-0x0000000077920000-0x0000000077921000-memory.dmp

    Filesize

    4KB

  • memory/1648-20-0x0000000000280000-0x0000000000281000-memory.dmp

    Filesize

    4KB

  • memory/1648-17-0x0000000000270000-0x0000000000271000-memory.dmp

    Filesize

    4KB

  • memory/1648-25-0x0000000000290000-0x0000000000291000-memory.dmp

    Filesize

    4KB

  • memory/1648-32-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1648-30-0x00000000002A0000-0x00000000002A1000-memory.dmp

    Filesize

    4KB

  • memory/1648-41-0x0000000000400000-0x00000000012EB000-memory.dmp

    Filesize

    14.9MB

  • memory/1648-5-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1648-2-0x0000000000250000-0x0000000000251000-memory.dmp

    Filesize

    4KB

  • memory/1648-37-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/1648-35-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/1648-3-0x0000000000400000-0x00000000012EB000-memory.dmp

    Filesize

    14.9MB