Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
710.exe
windows7-x64
310.exe
windows10-2004-x64
312DNF小马.exe
windows7-x64
712DNF小马.exe
windows10-2004-x64
7521DNF-HA(新).exe
windows7-x64
1521DNF-HA(新).exe
windows10-2004-x64
3DNF掉线�...��.bat
windows7-x64
1DNF掉线�...��.bat
windows10-2004-x64
7冒火.dll
windows7-x64
7冒火.dll
windows10-2004-x64
7查看最�...��.url
windows7-x64
1查看最�...��.url
windows10-2004-x64
1觉醒.dll
windows7-x64
7觉醒.dll
windows10-2004-x64
7风暴.dll
windows7-x64
7风暴.dll
windows10-2004-x64
7Analysis
-
max time kernel
5s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 04:17
Behavioral task
behavioral1
Sample
10.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
10.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
12DNF小马.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
12DNF小马.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
521DNF-HA(新).exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
521DNF-HA(新).exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
DNF掉线数据清理1.3版.bat
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
DNF掉线数据清理1.3版.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
冒火.dll
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
冒火.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
查看最新代码.url
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
查看最新代码.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
觉醒.dll
Resource
win7-20231215-en
Behavioral task
behavioral14
Sample
觉醒.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
风暴.dll
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
风暴.dll
Resource
win10v2004-20231215-en
General
-
Target
12DNF小马.exe
-
Size
18KB
-
MD5
e076485da1aef93f3621aa6b7c05ba73
-
SHA1
3653395ed051c2524a057ddd3803a673d4ba722e
-
SHA256
7af91034be743da9149c18584ffeb71cb0db100a15739f6169a5b29755a25092
-
SHA512
fdce6b959d1fd8a1e61379b25d57f0b09c67ba274c9634a301fddefe1cc45ec1eb1b6c158afb37ee8c4e5ecbae14c5c59518dad65210807397c2118c214acc86
-
SSDEEP
384:IkJcqs0mP5C3SyeTfyEdftyVVhxY+uuyhGy1KSYz:lLhopTfyEBaHxY+uuFVz
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 3968 12DNF小马.exe -
resource yara_rule behavioral4/memory/3968-2-0x0000000010000000-0x0000000010013000-memory.dmp upx behavioral4/memory/3968-8-0x0000000010000000-0x0000000010013000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\jlfdnf.dll 12DNF小马.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3968 12DNF小马.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\12DNF小马.exe"C:\Users\Admin\AppData\Local\Temp\12DNF小马.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
PID:3968 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\clear.bat" "2⤵PID:3964
-