Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

24c50d2873...18.exe

windows7-x64

7

24c50d2873...18.exe

windows10-2004-x64

7

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...nk.dll

windows7-x64

3

$PLUGINSDI...nk.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...te.dll

windows7-x64

1

$PLUGINSDI...te.dll

windows10-2004-x64

1

$PLUGINSDI...om.dll

windows7-x64

7

$PLUGINSDI...om.dll

windows10-2004-x64

7

$PLUGINSDI...tp.dll

windows7-x64

1

$PLUGINSDI...tp.dll

windows10-2004-x64

1

theworld.exe

windows7-x64

7

theworld.exe

windows10-2004-x64

7

uninst.exe

windows7-x64

7

uninst.exe

windows10-2004-x64

7

$PLUGINSDI...LL.dll

windows7-x64

3

$PLUGINSDI...LL.dll

windows10-2004-x64

3

$PLUGINSDIR/time.dll

windows7-x64

3

$PLUGINSDIR/time.dll

windows10-2004-x64

3

�...��.url

windows7-x64

1

�...��.url

windows10-2004-x64

1

�...��.exe

windows7-x64

6

�...��.exe

windows10-2004-x64

6

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 05:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    theworld.exe

  • Size

    614KB

  • MD5

    86304066455028632cb42c34a2b42b21

  • SHA1

    3b00e902ce09a241024330b122ba10a354af2b93

  • SHA256

    52b304f491abd2f4f2b364371b632eb31a99af2b9da5a63a82a00b091bac6289

  • SHA512

    b59048f1c007f33053faa776643811a34da7882243de672c3c6692a2b08af30f84949f747237d7a5ab08e34c7205f0ad340fe8c33012f0c37497c2ac4e6698b8

  • SSDEEP

    12288:kaWz2Mg7v3qnCi8ErQohh0F4CCJ8lnyLQYn:7adMv6CYrjqnyLQ+

Score
7/10
persistence

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies system executable filetype association 2 TTPs 12 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
    adwarespyware
  • Modifies registry class 51 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\theworld.exe
    "C:\Users\Admin\AppData\Local\Temp\theworld.exe"
    1⤵
    • Checks computer location settings
    • Modifies system executable filetype association
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4064
    • C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\SysWow64\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\monitor.n"
      2⤵
      • Checks computer location settings
      • Modifies system executable filetype association
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4548
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" http://www.go2000.com/?g9
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3284
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3284 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:5084
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ping -n 4 127.1>nul &del /q "C:\Users\Admin\AppData\Local\Temp\theworld.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3988
      • C:\Windows\SysWOW64\PING.EXE
        ping -n 4 127.1
        3⤵
        • Runs ping.exe
        PID:1548

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    471B

    MD5

    63a2d2b4cdc269762fe4bdb8cdfde7f8

    SHA1

    5cce14e5285ce9844b164d37de9f4ad0acc7880f

    SHA256

    8e323e0354939fd301d8db011a0b007476c93e0e048100922e3e59e34b04f716

    SHA512

    db3b35b23c3088fdf8f5215d8f9149e717d871be0c7b69541aba232e6f829e18d9d074b53f173387985a3ba4df1c016ec5b75f4387d6123c6c1ba3113c43dec9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
    Filesize

    404B

    MD5

    24efc4ae9b31a1a5d7f0b4fc54d9989d

    SHA1

    cb2f597d7f10277a91f9b4bc91040e6f65aba888

    SHA256

    fcae1e63aa2adfbf4e88227c68fb84925033419eaddf567a9113d2fef8373630

    SHA512

    caaac7e4314676d0588a671d280f96552b867beddc95ee098f5fc5f3c4f076fd2e52ca15cf10cc65ae371eb5980aadbf7eee150a84b8556d4336bee07de3a5f2

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\verA96F.tmp
    Filesize

    15KB

    MD5

    1a545d0052b581fbb2ab4c52133846bc

    SHA1

    62f3266a9b9925cd6d98658b92adec673cbe3dd3

    SHA256

    557472aeaebf4c1c800b9df14c190f66d62cbabb011300dbedde2dcddd27a6c1

    SHA512

    bd326d111589d87cd6d019378ec725ac9ac7ad4c36f22453941f7d52f90b747ede4783a83dfff6cae1b3bb46690ad49cffa77f2afda019b22863ac485b406e8d

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\RYAG7OSV\suggestions[1].en-US
    Filesize

    17KB

    MD5

    5a34cb996293fde2cb7a4ac89587393a

    SHA1

    3c96c993500690d1a77873cd62bc639b3a10653f

    SHA256

    c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

    SHA512

    e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\monitor.n
    Filesize

    7KB

    MD5

    a4bf7f9ba9b3e741c3054dfa0b5325ee

    SHA1

    2d5810b2d46596b4bbd04b565806ea7ec99d9116

    SHA256

    72f10825026c2f8fa14aaaae7a3919f96c56e6e4d2fe650b0268efe3a9b0469f

    SHA512

    b7853a9e9f451ad96f4421cb8c5dd8847813a568dc056c309a4296cbf4de05eeead66236001eea0125cb7a6fa7c1baf5555221fa5d0b76e13e4698504e592eef

    Download Submit

  • C:\Users\Public\Desktop\Internet Explorer.lnk
    Filesize

    1KB

    MD5

    4cd8a4d53ed1939fe0b7765d40eb68d4

    SHA1

    19d3f59ded3c6e7b505af834dce89a7693685381

    SHA256

    1ecfdb203fb4186d862974c976a3001d54cd47c45cef9ee3a931ac7df3e978d8

    SHA512

    ac09263481661e543a565b779472bf1841d07ba07b182081a63419e64642706d1ce51353eb8f86e9ad525b58caa84178c45193d8ec64b7084c92a739218cba2e

    Download Submit