Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
1LiyuNet/�...��.rtf
windows7-x64
4LiyuNet/�...��.rtf
windows10-2004-x64
1LiyuNet/�...��.url
windows7-x64
1LiyuNet/�...��.url
windows10-2004-x64
1LiyuNet/�...on.jar
windows7-x64
1LiyuNet/�...on.jar
windows10-2004-x64
1LiyuNet/�....2.jar
windows7-x64
1LiyuNet/�....2.jar
windows10-2004-x64
1LiyuNet/�....1.jar
windows7-x64
1LiyuNet/�....1.jar
windows10-2004-x64
1LiyuNet/�....6.jar
windows7-x64
1LiyuNet/�....6.jar
windows10-2004-x64
1LiyuNet/�...en.jar
windows7-x64
1LiyuNet/�...en.jar
windows10-2004-x64
1LiyuNet/�....2.jar
windows7-x64
1LiyuNet/�....2.jar
windows10-2004-x64
1LiyuNet/�...14.jar
windows7-x64
1LiyuNet/�...14.jar
windows10-2004-x64
1LiyuNet/�...il.jar
windows7-x64
1LiyuNet/�...il.jar
windows10-2004-x64
1LiyuNet/�...in.jar
windows7-x64
1LiyuNet/�...in.jar
windows10-2004-x64
1LiyuNet/�....3.jar
windows7-x64
1LiyuNet/�....3.jar
windows10-2004-x64
1LiyuNet/�....3.jar
windows7-x64
1LiyuNet/�....3.jar
windows10-2004-x64
1LiyuNet/�...or.asp
windows7-x64
3LiyuNet/�...or.asp
windows10-2004-x64
3LiyuNet/�...ist.js
windows7-x64
3LiyuNet/�...ist.js
windows10-2004-x64
3LiyuNet/�...ct.asp
windows7-x64
3LiyuNet/�...ct.asp
windows10-2004-x64
3Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 17:10
Static task
static1
Behavioral task
behavioral1
Sample
LiyuNet/数据库/鲤鱼论坛数据库说明文档.rtf
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
LiyuNet/数据库/鲤鱼论坛数据库说明文档.rtf
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
LiyuNet/新云软件.url
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
LiyuNet/新云软件.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
LiyuNet/论坛应用/WEB-INF/lib/activation.jar
Resource
win7-20240705-en
Behavioral task
behavioral6
Sample
LiyuNet/论坛应用/WEB-INF/lib/activation.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
LiyuNet/论坛应用/WEB-INF/lib/c3p0-0.9.1.2.jar
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
LiyuNet/论坛应用/WEB-INF/lib/c3p0-0.9.1.2.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
LiyuNet/论坛应用/WEB-INF/lib/commons-logging-1.1.jar
Resource
win7-20240704-en
Behavioral task
behavioral10
Sample
LiyuNet/论坛应用/WEB-INF/lib/commons-logging-1.1.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
LiyuNet/论坛应用/WEB-INF/lib/dom4j-1.6.jar
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
LiyuNet/论坛应用/WEB-INF/lib/dom4j-1.6.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
LiyuNet/论坛应用/WEB-INF/lib/jaxen.jar
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
LiyuNet/论坛应用/WEB-INF/lib/jaxen.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
LiyuNet/论坛应用/WEB-INF/lib/jtds-1.2.jar
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
LiyuNet/论坛应用/WEB-INF/lib/jtds-1.2.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
LiyuNet/论坛应用/WEB-INF/lib/log4j-1.2.14.jar
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
LiyuNet/论坛应用/WEB-INF/lib/log4j-1.2.14.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
LiyuNet/论坛应用/WEB-INF/lib/mail.jar
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
LiyuNet/论坛应用/WEB-INF/lib/mail.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
LiyuNet/论坛应用/WEB-INF/lib/mysql-connector-java-3.0.17-ga-bin.jar
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
LiyuNet/论坛应用/WEB-INF/lib/mysql-connector-java-3.0.17-ga-bin.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
LiyuNet/论坛应用/WEB-INF/lib/oscache-2.3.jar
Resource
win7-20240729-en
Behavioral task
behavioral24
Sample
LiyuNet/论坛应用/WEB-INF/lib/oscache-2.3.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
LiyuNet/论坛应用/WEB-INF/lib/proxool-0.8.3.jar
Resource
win7-20240705-en
Behavioral task
behavioral26
Sample
LiyuNet/论坛应用/WEB-INF/lib/proxool-0.8.3.jar
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
LiyuNet/论坛应用/bbs/INC/error.asp
Resource
win7-20240708-en
Behavioral task
behavioral28
Sample
LiyuNet/论坛应用/bbs/INC/error.asp
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
LiyuNet/论坛应用/bbs/INC/forumList.js
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
LiyuNet/论坛应用/bbs/INC/forumList.js
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
LiyuNet/论坛应用/bbs/admin_html_act.asp
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
LiyuNet/论坛应用/bbs/admin_html_act.asp
Resource
win10v2004-20240802-en
General
-
Target
LiyuNet/数据库/鲤鱼论坛数据库说明文档.rtf
-
Size
324KB
-
MD5
1d08deaef754d0a57d841690b45e8c03
-
SHA1
d2cee06c20478a32d32d5f9935073043d89b20df
-
SHA256
1a11c807b37c319b7550f36ddc7b24386e0329bbaf93de39eafab3badd9d4219
-
SHA512
63ea39db20de92a5adc29385cc5d90fdb2f5a8af6a1cf05f89e33cf6b81606ed2e8d3557056e53ff06fd8bc1bc325b8a98b71607b3bf8f84a1d298f3bd68f065
-
SSDEEP
1536:jKWjdWyPsBHr59D8sq8efasWJ/1A2rcB6yVht2xq+aQFv2lNfv4bWRGXRgUbiEie:2mPOKa/Y+xaZV1gmTixZ
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2436 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2436 WINWORD.EXE 2436 WINWORD.EXE -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1436 2436 WINWORD.EXE 30 PID 2436 wrote to memory of 1436 2436 WINWORD.EXE 30 PID 2436 wrote to memory of 1436 2436 WINWORD.EXE 30 PID 2436 wrote to memory of 1436 2436 WINWORD.EXE 30
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\LiyuNet\数据库\鲤鱼论坛数据库说明文档.rtf"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19KB
MD5c03ea4845831be9d6bdb82d769631e54
SHA194762675e2c6d16a0f71aecff81fbeae664489a8
SHA25632bbb9adc0e5078c3eb7f0adae7eef874ef72b3942913f558357864e16db24d3
SHA512b201d08f31c96f41c13e4b1e18de30c0d81cf7643b0ada63db50f9287258881d8f3aca316a95fb9d141447a275602201cf5cffb137546cc1b7e6d479801b82a8