Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
1360.cmd
windows7-x64
4360.cmd
windows10-2004-x64
4360SE.vbs
windows7-x64
3360SE.vbs
windows10-2004-x64
7361.cmd
windows7-x64
1361.cmd
windows10-2004-x64
136OSE.vbs
windows7-x64
636OSE.vbs
windows10-2004-x64
736O安全�... 3.lnk
windows7-x64
336O安全�... 3.lnk
windows10-2004-x64
336O安全�...�3.lnk
windows7-x64
336O安全�...�3.lnk
windows10-2004-x64
3Internet Exploror.lnk
windows7-x64
3Internet Exploror.lnk
windows10-2004-x64
3copy.cmd
windows7-x64
8copy.cmd
windows10-2004-x64
8cpa.cmd
windows7-x64
7cpa.cmd
windows10-2004-x64
1ha.vbs
windows7-x64
3ha.vbs
windows10-2004-x64
8is.cmd
windows7-x64
1is.cmd
windows10-2004-x64
1runonce.cmd
windows7-x64
8runonce.cmd
windows10-2004-x64
8tool.cmd
windows7-x64
7tool.cmd
windows10-2004-x64
7winare.vbs
windows7-x64
1winare.vbs
windows10-2004-x64
1Analysis
-
max time kernel
91s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/12/2023, 17:54
Static task
static1
Behavioral task
behavioral1
Sample
360.cmd
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
360.cmd
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
360SE.vbs
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
360SE.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
361.cmd
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
361.cmd
Resource
win10v2004-20231222-en
Behavioral task
behavioral7
Sample
36OSE.vbs
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
36OSE.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
36O安全刘览器 3.lnk
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
36O安全刘览器 3.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
36O安全刘览器3.lnk
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
36O安全刘览器3.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
Internet Exploror.lnk
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
Internet Exploror.lnk
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
copy.cmd
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
copy.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral17
Sample
cpa.cmd
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
cpa.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral19
Sample
ha.vbs
Resource
win7-20231215-en
Behavioral task
behavioral20
Sample
ha.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral21
Sample
is.cmd
Resource
win7-20231215-en
Behavioral task
behavioral22
Sample
is.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral23
Sample
runonce.cmd
Resource
win7-20231129-en
Behavioral task
behavioral24
Sample
runonce.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral25
Sample
tool.cmd
Resource
win7-20231215-en
Behavioral task
behavioral26
Sample
tool.cmd
Resource
win10v2004-20231215-en
Behavioral task
behavioral27
Sample
winare.vbs
Resource
win7-20231215-en
Behavioral task
behavioral28
Sample
winare.vbs
Resource
win10v2004-20231215-en
General
-
Target
361.cmd
-
Size
567B
-
MD5
feb810eaa38eb0890ad2034d322e4c79
-
SHA1
a7c7ddd0bd405b949ddbffed364269d145ee78e4
-
SHA256
e346f4ed81e3e7974c4a9978789fc08737abc4c7318f31d747b1ad23ce5bf800
-
SHA512
f96b5e8129ab8fd4703a2e4bddf4245e9c4a64a8d69663f755386021cb8fd34a75bd0fa53b4579145bf50be2948d9ae5d0f4bdb556ae73b4cc85e6a2130f5ab9
Malware Config
Signatures
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.dao666.com/?cmd2" reg.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main reg.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main reg.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.dao666.com/?cmd2" reg.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1540 wrote to memory of 1640 1540 cmd.exe 23 PID 1540 wrote to memory of 1640 1540 cmd.exe 23 PID 1540 wrote to memory of 696 1540 cmd.exe 21 PID 1540 wrote to memory of 696 1540 cmd.exe 21 PID 1540 wrote to memory of 4664 1540 cmd.exe 22 PID 1540 wrote to memory of 4664 1540 cmd.exe 22
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\361.cmd"1⤵
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /t REG_SZ /d "http://www.dao666.com/?cmd2" /f2⤵
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
PID:696
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main" /v "Default_Page_URL" /t REG_SZ /d "http://www.dao666.com/?cmd2" /f2⤵
- Modifies Internet Explorer settings
PID:4664
-
-
C:\Windows\system32\reg.exeREG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}"2⤵PID:1640
-