Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/12/2023, 13:18
General
-
Target
9e93954b1b1464748a0b18f7c2c59a9b.exe
-
Size
14.0MB
-
MD5
9e93954b1b1464748a0b18f7c2c59a9b
-
SHA1
cfa6a2185311fabc4eafd6b845c1d6b57622c62b
-
SHA256
f2beafc9c07213ded42ab2c977086901a4c2c27fa7cc728aac76bfd615409dce
-
SHA512
f466c9a2171ed7e5ae93805d71de9142f5fcb09f2db44d5d9498c2e5fa948d887b85fe09804191057a35e54ea547210ffc536e66015dc9009fdb30dfc11aa212
-
SSDEEP
393216:tah/nVE7bryzaPsVpURhWRwTItLfaaZO8MEZm9Ct2d:tWdE7brXup+hF2JTEgt2d
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e93954b1b1464748a0b18f7c2c59a9b.exe"C:\Users\Admin\AppData\Local\Temp\9e93954b1b1464748a0b18f7c2c59a9b.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DKD06.tmp\9e93954b1b1464748a0b18f7c2c59a9b.tmp"C:\Users\Admin\AppData\Local\Temp\is-DKD06.tmp\9e93954b1b1464748a0b18f7c2c59a9b.tmp" /SL5="$A01CC,14231157,297472,C:\Users\Admin\AppData\Local\Temp\9e93954b1b1464748a0b18f7c2c59a9b.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im QQPMInstall.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im QQPhoneManagerWeb_990566.1.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im adb.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im zhuodashiupdater.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im ZhuoDaShi.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139KB
MD5b23b40a169b17c388f0666bb4374c13a
SHA113b8c9cc6111aaa330e8f26d878ccb6044c2c9c2
SHA256c7494288c6b7bb9660b46661aeefb8f6371b0a9fdc9c2d902f5e176c368a11c4
SHA512872e9c9c1a4efdba91b59c15bad5de362f80c0d33018a6db50a84af23b0d2e03ee3bf5e1fdc5c71e61f8eba26b06d57b82aa3cb2f30672a823cadf6509799acc
-
Filesize
116KB
MD522ec759a8ea22b763b3ca65140aace89
SHA1fdeef5747118160970857a6acd4be57b1c02b901
SHA256dcd89e76bae3f7a6b557295ee5532d41db5714ae838cf6190c63d1e45ce7ca91
SHA51202b80de1efe7b5a44f57e2e3f1d70a066f795980e3190e18d630fd48dccbb5a2d6a85f9e4e75c4c7d63565a93a150b5d8abb39a61b372dac10fd8aef98b372f7
-
Filesize
132KB
MD55def04ef1f2b05c116d0536a8c928488
SHA105f69833c52da0f0589f3e15285302392f8ca541
SHA256d5cdc1d18d8a063d81805c97063cc923b604e86d8e7b647ac04ac7e1c87c3836
SHA512b71cc36e69956b6319f50a6031005950d30731e388dc3a9c832e94dc4882904e8443ea9f794f919ac3c9bde588cdf6c50069ca83d60a4c1b7b99ab129b7aa0e3
-
Filesize
64KB
MD5bf4201440da50a26146ad94e89aff62d
SHA16a6ea67b29d45ac370d35346a7c689f6b9095e7b
SHA2569fea7cd4830c2af2ec65cabd6b6f9d4015c7a1ca7a3c522e63184661e3359adb
SHA512874e38378c76e8fcea8a6af8a16f72dc3a76968f6a099a2d0b91fe0fe05e8297fb1747e891801a8c6c43d41651b30ccd0316cb00daa91d01e5a94c0a1eb88675
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
335KB
MD56e0095e7fee30b8f0a22bd5fac868a7f
SHA18206e3ec3c8d20be7f7a7e8b9e383fb812b43207
SHA256c8ec49ae58706b4edde1f566ad2782ac6b69a781236aa56450eb9440f20f4a17
SHA512de30365272d8f2b0ad3b5422e4c5ff5df0c4aca6816442c9c2f4d4cf4546210a7fda2b614b8f495a7d20695ceb29766379bc15c7f8091954af6175e7280e19b2
-
Filesize
383KB
MD5bb9a4d803d722c87d7f1992ea9ad2ae1
SHA1c5eb886cfa6a2c6774a75db4e95bbb9bf1855c1c
SHA2562e86f8cac08d086351ac524138dc5c0a8b183b71d7ce77eedb399cfaf6e07958
SHA512fe1e2aa5517cccbbc9622f37bdfc5f02d777d092cb9e7c38e33a398edd7b92e5ab473da964774f590c0df42e0e1516fdc5898e4b722a0c206216603764ec3c5d
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
148KB
-
Filesize
384KB
-
Filesize
908KB
-
Filesize
384KB
-
Filesize
5.7MB
-
Filesize
384KB
-
Filesize
908KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
5.7MB
-
Filesize
384KB
-
Filesize
5.7MB
-
Filesize
2.1MB
-
Filesize
908KB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
464KB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
880KB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
464KB
-
Filesize
1.1MB
-
Filesize
464KB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
1.1MB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
5.7MB
-
Filesize
880KB
-
Filesize
700KB
-
Filesize
2.1MB
-
Filesize
1.1MB
-
Filesize
148KB
-
Filesize
384KB
-
Filesize
148KB
-
Filesize
488KB
-
Filesize
148KB
-
Filesize
488KB
-
Filesize
384KB
-
Filesize
488KB
-
Filesize
384KB
-
Filesize
488KB
-
Filesize
384KB
-
Filesize
488KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
320KB
-
Filesize
320KB
-
Filesize
320KB