Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
38bd9a3095e...18.exe
windows7-x64
88bd9a3095e...18.exe
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...is.dll
windows7-x64
3$PLUGINSDI...is.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ox.dll
windows7-x64
3$PLUGINSDI...ox.dll
windows10-2004-x64
3$SMSTARTUP...��.exe
windows7-x64
3$SMSTARTUP...��.exe
windows10-2004-x64
37zr.exe
windows7-x64
37zr.exe
windows10-2004-x64
3Encode.exe
windows7-x64
1Encode.exe
windows10-2004-x64
3FZip.dll
windows7-x64
3FZip.dll
windows10-2004-x64
3HTTP.dll
windows7-x64
3HTTP.dll
windows10-2004-x64
3LHInstall.dll
windows7-x64
3LHInstall.dll
windows10-2004-x64
3LangHua.exe
windows7-x64
8LangHua.exe
windows10-2004-x64
8LhLogSvr.dll
windows7-x64
3LhLogSvr.dll
windows10-2004-x64
3LhTips.exe
windows7-x64
3LhTips.exe
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/08/2024, 20:28
Static task
static1
Behavioral task
behavioral1
Sample
8bd9a3095ebb74383c3103bfc41765b0_JaffaCakes118.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral2
Sample
8bd9a3095ebb74383c3103bfc41765b0_JaffaCakes118.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/KillProcDLL.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LhNsis.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LhNsis.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ebanner.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ebanner.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/messagebox.dll
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/messagebox.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
$SMSTARTUP/7k7kϷ.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral16
Sample
$SMSTARTUP/7k7kϷ.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
7zr.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral18
Sample
7zr.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Encode.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
Encode.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
FZip.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
FZip.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
HTTP.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral24
Sample
HTTP.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
LHInstall.dll
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral26
Sample
LHInstall.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
LangHua.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral28
Sample
LangHua.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
LhLogSvr.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
LhLogSvr.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
LhTips.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral32
Sample
LhTips.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
-
Target
LangHua.exe
-
Size
2.1MB
-
MD5
4d1770fca9559746469e30933b4d83fd
-
SHA1
f0b0a86cb17f06aaa808e073e5e4c25a55057e1b
-
SHA256
d50be917d4aa3352b4adbed554517f1a473bda771c6e70cdc0431ebb08fa3ca5
-
SHA512
f5ec293042bbd838f283f89772375c33236cb0777490722fd1eb394d60677523c80eeb9f7ba742c919806d42cbb2922824130e821b65bb203e13e95257d8bf02
-
SSDEEP
49152:/E/tUmAN3BPMm19duFeUFmodToFbzeGVuv7dnMmM15UuLWy/zc:/E/toBPdEToFveGVKdni15UuLvA
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 3 IoCs
pid Process 1404 Netsh.exe 1556 Netsh.exe 1792 Netsh.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 LangHua.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh Netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language LangHua.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language QKDown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Netsh.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main LangHua.exe Key created \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch LangHua.exe Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" LangHua.exe -
Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: 33 2852 LangHua.exe Token: SeIncBasePriorityPrivilege 2852 LangHua.exe Token: 33 2852 LangHua.exe Token: SeIncBasePriorityPrivilege 2852 LangHua.exe Token: 33 2852 LangHua.exe Token: SeIncBasePriorityPrivilege 2852 LangHua.exe Token: 33 2852 LangHua.exe Token: SeIncBasePriorityPrivilege 2852 LangHua.exe Token: 33 2852 LangHua.exe Token: SeIncBasePriorityPrivilege 2852 LangHua.exe Token: 33 2852 LangHua.exe Token: SeIncBasePriorityPrivilege 2852 LangHua.exe Token: 33 2852 LangHua.exe Token: SeIncBasePriorityPrivilege 2852 LangHua.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe 2852 LangHua.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2852 wrote to memory of 2100 2852 LangHua.exe 30 PID 2852 wrote to memory of 2100 2852 LangHua.exe 30 PID 2852 wrote to memory of 2100 2852 LangHua.exe 30 PID 2852 wrote to memory of 2100 2852 LangHua.exe 30 PID 2100 wrote to memory of 1404 2100 QKDown.exe 31 PID 2100 wrote to memory of 1404 2100 QKDown.exe 31 PID 2100 wrote to memory of 1404 2100 QKDown.exe 31 PID 2100 wrote to memory of 1404 2100 QKDown.exe 31 PID 2100 wrote to memory of 1556 2100 QKDown.exe 32 PID 2100 wrote to memory of 1556 2100 QKDown.exe 32 PID 2100 wrote to memory of 1556 2100 QKDown.exe 32 PID 2100 wrote to memory of 1556 2100 QKDown.exe 32 PID 2100 wrote to memory of 1792 2100 QKDown.exe 33 PID 2100 wrote to memory of 1792 2100 QKDown.exe 33 PID 2100 wrote to memory of 1792 2100 QKDown.exe 33 PID 2100 wrote to memory of 1792 2100 QKDown.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\LangHua.exe"C:\Users\Admin\AppData\Local\Temp\LangHua.exe"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\QKDown.exe"C:\Users\Admin\AppData\Local\Temp\QKDown.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\Netsh.exeNetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\QKDown.exe" PPVOD ENABLE3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1404
-
-
C:\Windows\SysWOW64\Netsh.exeNetsh firewall add portopening TCP 14419 KwMusic3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1556
-
-
C:\Windows\SysWOW64\Netsh.exeNetsh firewall add portopening UDP 14419 KwMusic3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:1792
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
853B
MD5364e327586e2420be0a4035083429f9c
SHA16db3656e512f071a08a97f0fb0ea2b531cceb8b4
SHA25675b5854638b58a1b1f909499b6362b5c5a8610eeca83a39659864d2db8525a32
SHA512ff675f0c683d598944fe3c459b497ea7e76970cfa65f852c63e49e974d6bfe55ea867da5de558f7a2dcf37881154a7e9d03a0087b21b224f69ed87e60b2e5d1d
-
Filesize
1KB
MD5ceea80c0a46c69442f444180f63a4224
SHA1f05994e199abe27e52fa49505f921afb2951d14c
SHA2568b4e09cdbcd73736c1ded15d8809f09a0eacd9695a65ea5d483981cc3c05ddd1
SHA512893334dfbde58260dc430841d2fcb8435fc41bbf5ab646ef47bcec71210a0cda38b65ca81a02e2500aa46412cdf9f6dde2fdc801cd354f2beb828b667462902f
-
Filesize
1KB
MD5960a2fc13e9cb22f6b0ad707876e5036
SHA12ca05a5e4de517fbdef9b96c7022c2da498d5926
SHA25644db9f54f40b3c3837799333f48ee07c3d18a84db42b217bd3ef663a21f578e6
SHA512de7e53ece5c4c78c7744e7ad852de1e79080736771d1ea6872342d29ae1fafa90d060ad445d09b556ccbc970a24a40107826f9a983a5bdaf1adebce8c854e9dd