Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    14/01/2024, 02:24

General

  • Target

    5767ac9151711b27bcfd30aeae1f44f5.exe

  • Size

    9KB

  • MD5

    5767ac9151711b27bcfd30aeae1f44f5

  • SHA1

    78e8f4ffe25b396145e4f49d40c4c374c3083974

  • SHA256

    792d56da2c897661bc8afd5e9e543970d1a76b723155a6f90b01c44fa02a27f2

  • SHA512

    cc02f104286981eacc4e7273d5c78eaf8b9da081ed4c3e8f58c4d0d94ba83931e501f6c0a824efd4f49b6a6d0362035ba015838d8567aa96f06d60d67eaee563

  • SSDEEP

    192:/TlMi6dUCC1WZTqoXqVLlGTT4UDaZPLJoJuasrVKEkx:/TaIJ1UTqoaVZGXYP+2VKEkx

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Program Files\Internet Explorer\IEXPLORE.exe
    "C:\Program Files\Internet Explorer\IEXPLORE.exe" http://www.baidu.com/
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2688
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1232 CREDAT:209923 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2680
  • C:\Program Files\Internet Explorer\IEXPLORE.exe
    "C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/Loader_jieku_977.html
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2108 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:1648
  • C:\Program Files\Internet Explorer\IEXPLORE.exe
    "C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/vplay.html
    1⤵
      PID:2776
    • C:\Program Files\Internet Explorer\IEXPLORE.exe
      "C:\Program Files\Internet Explorer\IEXPLORE.exe" http://dl.kanlink.cn:1287/CPAdown/haozip_tiny.200629.html
      1⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2244
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2244 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:1616
    • C:\Users\Admin\AppData\Local\Temp\5767ac9151711b27bcfd30aeae1f44f5.exe
      "C:\Users\Admin\AppData\Local\Temp\5767ac9151711b27bcfd30aeae1f44f5.exe"
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1736

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      914B

      MD5

      e4a68ac854ac5242460afd72481b2a44

      SHA1

      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

      SHA256

      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

      SHA512

      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_50D7940D5D3FEDD8634D83074C7A46A3

      Filesize

      1KB

      MD5

      cf76def2a5b86ecc42a892818cd562c4

      SHA1

      40d81b0421d5a5ab369fa5f252fe47f8010c4064

      SHA256

      f9d6690ef7bbdb672f268af8c9f00db7282d68e9c886c06b1d3c5fd0639c2257

      SHA512

      8c2862596216c5e8568339fba42374c9f08fe71a257a7bcbc2f8d7b992bc4c7be3a05fec3677ccfa41e71989f3c556ad837fb7dc716de1972447674d56a45a4a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      252B

      MD5

      e6dbbc048643a391f8c5ebeb57b5bdc8

      SHA1

      fa2555645fc762557f35d8e3d6e6d8f763ef6e90

      SHA256

      15f5205573a2cd234cd8050f6f9be013bd2a5a2383a53302607a9e45e7912271

      SHA512

      14986e7266edae5ec200ef9396624367222ae148bc80a2ec33c087a75726f01ebe60dfdc4bec146823fde6d5bdbbfa5728c6a08f490ea4f53f763fc7e19b7da8

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      f4673a68309f8a67ce325c7e8249e9de

      SHA1

      fd6b75d8d314a609ba327f2bbc63bbf06abae6d7

      SHA256

      7e738249d5e682447a7ac8d213c8dca9bc45887ee1ea4ef1959d89ab4bdd01cf

      SHA512

      6f0acb69adde0c8070f18b3cee78de1992bdcabc19db4888425780d003a5ed4ee783513de49e7d8593575fed56a14d431bfa32cc8182f5c653ebdcd8e7dcc37d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      ab44084cc5002d841df9471ec05b04d7

      SHA1

      c46528870cb98293b5f3279711ff6f0452bce0dc

      SHA256

      d76011200df54976e7b1eaf1647ba0d8393187953c7de66da3c31f48c232d2cb

      SHA512

      437d3e6b6df1ce64bf579c2e36d5fe3a0e903a13a2664b550529c3a24d4d6cdd970956254c8bb5783178fc2fc10f8cd9f65665c13233fb55a4838327c6b640ec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      6c9dce66a69f713ca98f41245ffa0461

      SHA1

      f549386ec8fe7755584de0ab71f9d8ea2af7c944

      SHA256

      6685e1b45da50844182c784b6b54b67d9d113cb68711236cf167aca7261ff335

      SHA512

      c80d10655e6d3a4cf5b53b149c3f9fa9e4a96e09f419213ffbd4c9e53823459631bf546f9ab014a38cc499ad0e8494a4d8da6b3671bcbb8fc5501a1a849de65a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a8afff2ae26be13141f59eebdb9b67c8

      SHA1

      325f9fe0f1b27766afe060ed1daafa9fb0f2b9b8

      SHA256

      1c43ac7ca95476aa1ec40e13a248360bbc5290acce66d531348dfcbf7fc3d1dc

      SHA512

      96d54dec0c3e1c8869c3c0fe9fd22d726a37f822d9813539bb16a4741aa0352581fbb19710181382d8f9048b0805c04202087e9152fc766fd478ddd2ff12a1b2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      d7357ada05c30d43b84f73b4da1a7437

      SHA1

      44c9193916d5e5a52d30cec6aae74ad2f7c89ea6

      SHA256

      4e7ee8e3fc22eac54cbefd3bba66398e763e43031ae093d2b80f6e1dbda2e302

      SHA512

      3b5edda91a4c78b327e290f114a29a389ba4a8146863ba405bb357d0bda66c2847d316ddc4d3843921e1201ea41ab8f8a12819d0840a26f90e6a21cfac425e43

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c10d4e62631a21fde7428e318e103db0

      SHA1

      a000b1e532c464526e8c8a276acf635ee7cd7a3c

      SHA256

      989aedc036726a1195a5c1039d36435cde1dbc41709e5d2c0ef4a1fbeb05c752

      SHA512

      d1e52a34a13ef22f4fd6a291d1fcc4535eebb6d0ce6d788f204dd39dfcfbd7c1403d79b32b3d7a44fcd2888b9b094901a4083aba506b85ff718a29867abf5bb0

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e586052a7a54f08971d06e0ff962b595

      SHA1

      edc91472df655606a7d6c7552196691851a40f5d

      SHA256

      938f0e8435e271b4b13357448ece0cccb453973a9d0c12a184d407d31014b6de

      SHA512

      bbb5723d20a3c9d46fdbfb8242c87730f42ef690f73f297dc961d89e27b026198dfb34b20a3807fa64cae19f77d3517ec53095dbd95ec1122704c95f9e964caf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      6e7c331ade7fd9ca507b4eadd80fec4e

      SHA1

      bf853820aee6b57296887d94264547ae5053a749

      SHA256

      dffec8d52ae656671321cd16304c7c56dd8c12e291a2c07795be3acc0c522eb5

      SHA512

      a02bb526dbe4549041f1678efd2cc0d75776dd4ed1b1e05ad66861d973adebedd7c8667847ed3e21b63a0e5bbd7d1f0a6a597a14e440d33ad41e6a9f78c2493a

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HURX5PE4\www.baidu[1].xml

      Filesize

      13B

      MD5

      c1ddea3ef6bbef3e7060a1a9ad89e4c5

      SHA1

      35e3224fcbd3e1af306f2b6a2c6bbea9b0867966

      SHA256

      b71e4d17274636b97179ba2d97c742735b6510eb54f22893d3a2daff2ceb28db

      SHA512

      6be8cec7c862afae5b37aa32dc5bb45912881a3276606da41bf808a4ef92c318b355e616bf45a257b995520d72b7c08752c0be445dceade5cf79f73480910fed

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HURX5PE4\www.baidu[1].xml

      Filesize

      170B

      MD5

      d0005ab4f6b1448dc73c000bf0b3524b

      SHA1

      28da7abdfd31052f93cdf2504b9e6f50a66c9dc2

      SHA256

      48150ebb4322652cf1fcd5a7eaf6c30a87c23e196ccde794e856a47f739f3338

      SHA512

      4057345646b09fe7b45396d3147edbf9344c77278fb07f0c8be56f592cfbda324f0387545d8c9a52c027a4d3d7cfda158774d1e5f19fc9775db003cde08a2596

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\DOMStore\HURX5PE4\www.baidu[1].xml

      Filesize

      17KB

      MD5

      52b72cdb376d80fb0dcf828451c677e8

      SHA1

      ce1704d69bc4b2268a270a919d850629e8e07083

      SHA256

      b24b5028a5b27146a1add92be899b20e68e9cbd66b6b2737e365e0991e4894e0

      SHA512

      ca6ccb30595d54ec47a4611ffdbe0b9efa844b3dabb88d147811728c85d27904b3ac93ba8a586f76b83352111d2bdd57c68e24d94cbd4ba804f492affb3f0e4d

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B9755D1-B284-11EE-B5B4-DED0D00124D2}.dat

      Filesize

      6KB

      MD5

      2cda83e98e753861063b7098d116f307

      SHA1

      46c5cfe24e94524e5a45a82c5e52e71a4d1afce3

      SHA256

      77ed1c81052da53b8b9b3e140e829e376cf670d874321d593fcbb84680ee8e7f

      SHA512

      e51431b07657b95d33712f7a2800b8dbd0a117cebf212d5ead8b57ab78cfec0b27327ea50fbea9db0376ddd885c59e3162ea1f988af4f5cb50f31799bbb888a1

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{1B9E79F1-B284-11EE-B5B4-DED0D00124D2}.dat

      Filesize

      5KB

      MD5

      fbf85ac71d73b6225a8cab401c4c9dec

      SHA1

      c6fe5a8f697006d6017cc88e7d3bfb3881553e84

      SHA256

      5db82ce8ec6bceb6950fd27de0816817cda4bbf1bd976d05609168144cb6fb1f

      SHA512

      24c4c59154533ecaf05518101d58bef176bccfebdb640de3d3c3f41704ae682d460082034be470d9a2131c69017e7901ad629b8a63aa53be3794d77194751b4b

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\02cy2i9\imagestore.dat

      Filesize

      16KB

      MD5

      47caba4b020d58ce425e3c30ef662e9f

      SHA1

      865762a5b8b1e18a7d8f44f01edeacc562b2c558

      SHA256

      a596e3b0ee616a27efdb6ba0abb02ee81f6420d9a62d80b11fe28be162789a39

      SHA512

      d9e430a760184f4e5d3e82df0cd21b1748dd45d1b349525984f490e4e86f33edc45aad8ac9e0dfda466f18c58afb4529c3e453a661ac42db30fe23b41a611d48

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JIH1AB02\favicon[1].ico

      Filesize

      16KB

      MD5

      717b138033a41361b32b60fc5062ab2a

      SHA1

      af9841b6f0923f890f41feec52c94a0cd68f01d8

      SHA256

      c70088079fe9441a726c66ce0e73ae38315ec80051d3dd542c41b82fa0a1993a

      SHA512

      1985bf59c3ee8289bbe55fbe572371d1f401949e6a0179b35ca89e292173780956161feb257303fe9ff5fd2898ca7fd6105eb1796841ade0e1124eeb89aa70ac

    • C:\Users\Admin\AppData\Local\Temp\Cab195A.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\Tar1D44.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4DXIXYC7.txt

      Filesize

      491B

      MD5

      c274ab12af56d506504471f5086c1283

      SHA1

      9fd8b84da4c3c94d521a39b2e5dc10dd0b97c130

      SHA256

      8fa755795a76551967d769fbdf7afa110018ce0ef259b77874614cc986a911ee

      SHA512

      644b1acc834b8398bfbd0abe186145c67d049bc4e7de4dc2db5e1dd6fc649c4f97f67126f4ce7df70869934dfd2c3c7c68f67669151a8615850866430477fc0e

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RQ8D5IEZ.txt

      Filesize

      80B

      MD5

      53366eca4e897a02c3cf796feb8a3e00

      SHA1

      4824b63f8ed1f0f9a56b09b6cabd749462d98310

      SHA256

      c57355c8d1d6150901416553c5aaf97b33f92e8adc248523c63d503c8f8c1af8

      SHA512

      44f12baa9985631a795301bbdb582e5d6f387b727ba44bc8919a436cf699380b1425f4e4966016be81b3500e985ff9eeb7eeb3ecfe1863a4fb830400267ec490

    • memory/1736-1-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB

    • memory/1736-164-0x0000000000400000-0x000000000040B000-memory.dmp

      Filesize

      44KB