Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/01/2024, 12:51
Static task
static1
Behavioral task
behavioral1
Sample
luokebaoyu/最火软件站.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
luokebaoyu/最火软件站.url
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
luokebaoyu/洛克王国暴雨辅助V17.6.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
luokebaoyu/洛克王国暴雨辅助V17.6.exe
Resource
win10v2004-20231215-en
General
-
Target
luokebaoyu/洛克王国暴雨辅助V17.6.exe
-
Size
5.0MB
-
MD5
fde0635a37703f409d30d2f8eb14fb29
-
SHA1
1b55095e4d64f04995d473e36ffef3614362f3ee
-
SHA256
1c02d0a308206e6dd2bda1404c4e45204705c95fe2558c291f35a81a75bbabc9
-
SHA512
ee5287cac7723652c8e472dde28744eb1ae9d36648d6313abd49bf72b195051f6a1406ce217376377232b17348b9cad3767308e10d3ff25f9918c0067b2816c6
-
SSDEEP
98304:yQMjRICEU+VPB7mEwEBDudm0m+She4uXL:yQJCmmE3BDudm0m+Ce
Malware Config
Signatures
-
resource yara_rule behavioral3/memory/1204-0-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-2-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-1-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-3-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-6-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-8-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-10-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-12-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-14-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-16-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-18-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-21-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-23-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-25-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-28-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-30-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-32-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-34-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-36-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-38-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-40-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-42-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-44-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-46-0x0000000005920000-0x000000000595D000-memory.dmp upx behavioral3/memory/1204-50-0x0000000005920000-0x000000000595D000-memory.dmp upx -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main 洛克王国暴雨辅助V17.6.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 1204 洛克王国暴雨辅助V17.6.exe 1204 洛克王国暴雨辅助V17.6.exe 1204 洛克王国暴雨辅助V17.6.exe 1204 洛克王国暴雨辅助V17.6.exe 1204 洛克王国暴雨辅助V17.6.exe