Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    14/07/2024, 02:01

General

  • Target

    RunDict.exe

  • Size

    361KB

  • MD5

    ad2960fde1e77cb9f59ba8ebde31b73a

  • SHA1

    93bffbd719f2017beece3dcabe2e5a5b093d7844

  • SHA256

    791597b08e6d3f2358ce6ceaab6abc94c030da7ee9b22baf594c58f8d1f6b040

  • SHA512

    00369da06d7e22104821cce62e1398a1625acb8f0d21b28d9b507ba092c8069314a810558c67d9762f0708fae77673e253153c92569acef7a1c30f00a6e7a7ac

  • SSDEEP

    6144:ueoo4DrmbppQbNWDf79h5L0lvfW1NGu/HhQ1UCDICJlhM8:2Dr2ppQMcvfW3DHhQ1J5hM8

Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\RunDict.exe
    "C:\Users\Admin\AppData\Local\Temp\RunDict.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2432
    • C:\Users\Admin\AppData\Local\Temp\YodaoDict.exe
      "C:\Users\Admin\AppData\Local\Temp\YodaoDict.exe" start
      2⤵
      • Drops file in Program Files directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2156
      • C:\Users\Admin\AppData\Local\Temp\YoudaoEH.exe
        "C:\Users\Admin\AppData\Local\Temp\YoudaoEH.exe"
        3⤵
        • Suspicious use of SetWindowsHookEx
        PID:2936

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Youdao\DeskDict\ddupdate\dictupdate.xml

    Filesize

    5KB

    MD5

    1aaac195b685939e22902871f0337d26

    SHA1

    07ac75f91dce9f6743644d5f6036170216b9f26e

    SHA256

    a5adf51560694560eebe7348b86505f0685adabbf9bb4ebd92bb03280f993e2e

    SHA512

    31bdcd4b3664a3f177e700333881801e6050a53bce4d97dfd0391bae814e0cbd7869a85b004062bd6c3605c4c00aa676cd54bba705e7620c4cb705ce34e78f29

  • C:\Users\Admin\AppData\Local\Yodao\DeskDict\cache\index.cab

    Filesize

    95KB

    MD5

    783aecd15c6add959e5357c6178514ff

    SHA1

    46c48ad8c936cf79fabd3d37cc7850f64d6cea38

    SHA256

    f6fc2e316358f54fec4eb6b52c445792efd2604d68934ef0895499f233325d07

    SHA512

    3cd650dc3a1765911d7c1f6d28965565d6389fac229109938b6a1e103f31ca9e57599b7d41c93037ed95a29c551c57c6764a8b020ebc503969536c4f35402e3c

  • C:\Users\Admin\AppData\Local\Yodao\DeskDict\cache\index.cab.md5

    Filesize

    34B

    MD5

    d74249e681b2f0ccf7c61d0c5430218a

    SHA1

    0c4e809998fb149408cb6581967c4d71b8967edd

    SHA256

    60f36aa79f436fd611e16c7cd8ca928e709712fda22fafccfc79fd8d66569569

    SHA512

    b34bb8ec066bf443a6ae937f2c7b8170ad9efe3665f823b5c3aab1c470847a23a5cfb1fd07624230d885cf5c2b256bd9b098d8a887cabe51fd6531df50f34858