Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    25/07/2024, 18:53

General

  • Target

    zhongaclient by zhong 0.0.7 p75/index.html

  • Size

    47KB

  • MD5

    beca50a7c48fa77be6fc2a8f93668554

  • SHA1

    cc74fcae54f68407836f9ecb6ce6e486272c1b31

  • SHA256

    c1fb67c55519b794f4a279903daa509f434b8d98534d72652b7d6835fede0d1e

  • SHA512

    105eb9c74d231cdabdfa1943605db20d5af2b9d3b5a4c2e75262a98ebfa822d4e4c2418447b314dffb76eaf5f698844f943f78ae653d1fc8b4b13e53c05114e6

  • SSDEEP

    768:JZniR6FbjoviJxiC+uMRO68ZNHr+WYxmrU7eFdULC9lkBC0:JZi4FbjRinuMVKNaErU7eFdUL2lkBC0

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\zhongaclient by zhong 0.0.7 p75\index.html"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3052 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2840

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2a2f3dfd9e4c9bded3be9a0e7ada4482

    SHA1

    92bef47ac1611a4623456d16e1832f6ee7484c11

    SHA256

    e236f4bcb1aec3df0346c8236438b803b8738ea151cb64c2e0dacefa49663844

    SHA512

    52427aeb16e1bf7609304fd81f3af5ea542e5ef202647eee30fa14bdb104ec1f81f9e84faddebb175030591d46b062e45fe2d6607d9f7928bcbbfc1a4cdf938e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e08cebfc5416542c9ab28df6dd0b2612

    SHA1

    ad79fb5ebbe9c2a0dfd8d405a1b25506550735b8

    SHA256

    0d06ec194f00b4348da0822d0dc3b5fd29e6b14974813ffc66263457cfd28bcd

    SHA512

    5f2ecf4e2d9da1cabbf1d949efaca63c580823af106df390d078adac514eac0cdac9558e27fc8cc4fd89762a1f9c75e26a70d54c12ed5a7e77a1f55409327119

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fba72e1532c3fbb080a230b150b3af99

    SHA1

    ca78db71329137e8cf83114b77a9d48db90d495f

    SHA256

    e1be2dd2b2871f987dc234e1fbaedf46d3eb73855b9e68612d0be5c006531b33

    SHA512

    ee5dae84849a51041389ef11ea47dcba91329b42bfd04b2f6d9aa4992bb103c7d5ccd2deefefdd3cd77d73c455ff62c43dcf3580fd2621885a3b4e4b3ea805eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c1fb2ff0db491bef9e950c5460c248e2

    SHA1

    b117b3a71990a41c29812fb2a21b2decfe22ec85

    SHA256

    26a3f8213ee6a89bb2532f706effbe6cf8477f6b495b4f2bf3cd2c11fb7bf738

    SHA512

    7269a614bcc679ffa83de5126f885ef6681913746f8825819ba8a560bc73894700d140957ca292b0b82c14275cc1bc50a9172c568ab7f0e5bc3b0f21b081e570

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    265e39ff55c0b7825d3a18e403f94430

    SHA1

    5eddfbea203f805a9b33a88d6504a8bdb0e2c5e9

    SHA256

    e987fbbedd0f8744f9c628f2b6fdecacd40a94fa63a13dbf018e8e722b904016

    SHA512

    eaa2f203c27d3df004879636ca2a237b9d3afa93abe5d17aad93de578078041a7949a67edfdaa38cc578f73d7de37cb748ae6236bf45153466ea72059a4ec87b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2f3235dc0d603c9009bad5efb9c8fcdd

    SHA1

    de9688156dcf355b35114251fcb4a2ff96d86395

    SHA256

    0745be1b7a4c90b17c47d68ac9be675e0f7d384b7b07af6ac797f79b8b141230

    SHA512

    4aa295b891051435022e3d5e6825e3c5622fa350271c86b2c61d199c46a6045306e59c5fa40fcbdae843f63a0e1a7c0644b193690a0ee690aea647ebb7c2e5eb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    5c7bbf07f0d9ee3023a4ca66617c4469

    SHA1

    779ee1e6d54d8deda43e6ae991f0d82339da6dba

    SHA256

    73e21dff3bacb2b39cbfe3cae1987d5e361b0ff2c78f917234789b7ac755a895

    SHA512

    92bd58668504c7ee100f01b536c5fb9ea79f920bd92421966157861a4a7d16513ec2bece90070db52328617879f6237463391c49784e89e49aa0bb8c153d19a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9199ba3364ac3bfb3aa5e2c4490b07c2

    SHA1

    a185dca4d15850ec49c966e482d9a59e04079f86

    SHA256

    0b1b448a6d284939108381a797f2edce5074a38083cf8aab405edab5e16cb389

    SHA512

    b3e54e37aaf27386a2c23b2cf489e41967c229a35326b7f314f30fde534310ff7e3327d37bc140c64013dc2058a90ef492582ecd59e6cdb9519c516fc1085005

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    22db75f11e4bdb923f1a3dbdff947470

    SHA1

    c4e8c09b939b6dbecec45ba69a28bb74e902a3e7

    SHA256

    85a60f0134b3cee81cb1847a8ed9b6bc901b1a661722af9d49cf6d21c265bcdf

    SHA512

    1105809c2f934326cac79ba035485ecbff0a34e0a61169cbf1c011b8c9cf725ddc532bd2bf847b494fa261eaef2bbdc727a57369ec3fcce56649a5f937235349

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c8c7977db837e3deb2a56da6704f91ce

    SHA1

    cd48d08831a33bfe53d69be95727054f95d655a5

    SHA256

    5ab15920fd70d5e41322e8b925140fd5104bd70fd06e6d9233ec832bbdfe023d

    SHA512

    ab82c8fef77904af4611e35cfcb8b22747bbba561a233d05ac31c6476bd969845215213630a1d4ad8476134945a7e7d13af4c5ae020cd8cae836566589aba181

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cce26626e0438bc76d9d6194099a5307

    SHA1

    42fda50c883c14420167913b1fd8f59e612b4726

    SHA256

    ee5f8aa9de0c2053b481b41080b32983cdc2a3f2b076807ca5d58e6cf4453c1b

    SHA512

    e413c7b29444ab4bf90f1e548b3041fb7872b9048fee03eb1f464195a982c7189e9a241544aedf1427a8d2cd2f2794e1d6ed53a3ae4fe9d8cd5587de6cfa31c6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    96bd661cf067b9554b55c514956cc2a7

    SHA1

    c377e496e6d4be13fa8d0f38e15f9d3d7026dc39

    SHA256

    948e783ab2ffcf999fb80d3af105d8b4793ec25c6a6401b9f84187f0e5804171

    SHA512

    5c6aa7319e8b0815801a682215b6a3f23f31963a452e5f61a9abbca69dfb52ed71357d36be6b1106fd2d46a477dd35b01448faeaaa5cd6a5e825f4e2f088240a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    476d5cf50001f62f5173483a874f948d

    SHA1

    a6b413c0d7b2147beb39c3f4bb216a93f5db9b9d

    SHA256

    44c845c78542de20041acb75d26923a367a8858fc06d684471c6e69bf2f068bb

    SHA512

    4dc7cec6a781b7868d2c1684034cbb96b7aa9adbcb1b1113f4b26f1ddfd169a3e6b499ca8ca3ba4e046eb32564e6a95f45744f22a088e56fef7821f7170aac89

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c64531a3975f13b37a07d1f1a1c14b91

    SHA1

    604f6d5c888e6f9309001a3aaf7049a86861694d

    SHA256

    b21e84e302040b52eb42df35e68386df066359d2c522455879fee7d290baee67

    SHA512

    dd360d231e1b25360a1eff26070946ce91e3edfcd017dfb540eeedc05563277fa380b4af4ae2f358362538955ad9bfb683afd63b0736a63fdff887e4301662f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1516902e378ef59cbe249107de8001d1

    SHA1

    326fbc8ee753e03b45cbb69695a818f5011becb4

    SHA256

    b59e0a3bb8181b01c2010299e9eae87fd4c963549ff75af14a3420b5d15fe4f0

    SHA512

    50bd04afb113ee1ca42d61dbb6accbfa5e361a42ebe84a93747ae7c464af9295a812b969ff7c1170eb6d1592fc990aeabb1e96e38f815110b0c9d72c6cfd368a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    72a77bc7b84a4dc7fe0ce56c9c565835

    SHA1

    00f2cfabcdca1508032d4c996fcb34fbcd0a6d7e

    SHA256

    d17c02e0c9863e4a74883d70d618e1aee0c4963947ab60eac40ccf0ca14bb825

    SHA512

    0d0490236d71254d39857aaaea6d49b221716311a89c6856c80c39b8ad6810a48b09804841c17c6913237ebf6cedb81a91b05987a90f6b861a14ee618ff694d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b1cca2d5d46ab95b848d92fde4a181be

    SHA1

    e9de0862f8278967a39aa1276e8dc9828b2686fb

    SHA256

    7ee0811f9668dea49d083b06717a10a948710e5cb341273609fa919837f41bfa

    SHA512

    ce298c4298c7a3a4aff4e2b1b54a014bf74a129619052cfa657ca948b654de12d36f4183e8fa13c31240288affb63ce82af7c7622f77e2e727a7b2bad06640e1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    92d96d1f7a0639e88d29be00778a5026

    SHA1

    d4559efbe7e8d0c38de79983836498135529d758

    SHA256

    b83dc43dacc1ee9c32c158915fc8ae5be106b836257baf691cf97622e55fbb69

    SHA512

    bb6ca5d06a2e09c66692c275ae4821ac2e2c7faff806d4aa8f919df312e0e17ab91f1994aa0371b1ea9f234b9835cc3d482e77f75ab01ea49a60c35dd70570af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    70fb10e570f1f73af81ef8ba38e871b6

    SHA1

    686646f0df6057814cd60e2cbefbb87ea9c0e258

    SHA256

    4838b15bf7cd18f2d344cec1c5b8133684d3d4208773aae971aa242be55a9384

    SHA512

    4e9ec80daed302b68eebdd63e737e208e159c7c77fab9fccc7bf9845da7ed4afc53dc46559f61e3acf248759ba284433b15a5a3b194cca006e04ec485c7d5cc8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b427c17a47f886274e422e6b7b7900d2

    SHA1

    8226b47eb52dba628761ba746f448d9620e6eff1

    SHA256

    f5fcf5c9b6b0e7c759adff51c8cd92eb6459f50a08b0b3754c9f2befb6601e17

    SHA512

    8b2cf0c6c4d574c0e869b3e410f6c7a901d0c6faf988860102c5b9c417c93fde965982633d388b297b47de0ae349e8f601caccd13c61807722fa10baf4882146

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fa1caa15d0c282a88fd5c7bdaa84b46e

    SHA1

    da72731c5b18b8e851988bdf98d4989835eba419

    SHA256

    255399c0e9a1433b950c2ffba81dd60a033f95a1d00f8c3cf6dc34c80a49f984

    SHA512

    b4607c047649d418d6f6dc38184ae3eace52e0065a069b15625d7232171a68819404068939505747a9086d3239041f19f9eec2d6be81c7cc44c7683de6115cc8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    50a48cccea29e7fddc1a372569596cde

    SHA1

    6ea4c5d4ab7304b3abf5075e64e54e4fa55287e7

    SHA256

    8f461318530c839f150cf88958437cfff94aeff46d61deb0ff501e7723c4e06b

    SHA512

    d24e1be7c1a1c553772c56d21cf14e1121f60624a8d536605ea6d8af75e74c69e1df320174338d4ebd62c8d8132f3b17fb156d74032c55c7c6943697f8ed8e42

  • C:\Users\Admin\AppData\Local\Temp\Cab5D20.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar5D32.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b