Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
20/08/2024, 06:31 UTC
General
-
Target
914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e.exe
-
Size
9.8MB
-
MD5
764647736f890ef13f918079dc9d72cf
-
SHA1
1709f276759093323650d98d724124f9906adb05
-
SHA256
914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e
-
SHA512
f766939786f1ee13a7e8fd04eaec0c4371f1ca100610c3bf224578cb25070aed7b93cd187bf6e4c89113de996bd97ee054714fa7f43bb2ff3cc281fb20293f97
-
SSDEEP
196608:t9++KYyCBPgEdqiz0UKq3GaXcaK4PotqSOpsgymzgqae6WMr:kY9PgOlzLKq2GcP44ON2e6n
Score
10/10
Malware Config
Signatures
-
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
-
Disables RegEdit via registry modification 2 IoCs
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Loads dropped DLL 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Control Panel 2 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e.exe"C:\Users\Admin\AppData\Local\Temp\914c9655900b5fe48a51e6814c32a72dad0eb315b9422d22412c0349d918009e.exe"1⤵
- Disables RegEdit via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\reg.exereg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f2⤵
- Disables RegEdit via registry modification
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\regini.exeregini www.ini2⤵
-
-
C:\Windows\SysWOW64\regini.exeregini www.ini2⤵
-
Network
-
DNSpic4.zhimg.comRemote address:8.8.8.8:53Requestpic4.zhimg.comIN AResponsepic4.zhimg.comIN CNAMEpic4.zhimg.com.cdn.dnsv1.compic4.zhimg.com.cdn.dnsv1.comIN CNAME36d64ce2.ovslegodl.sched.ovscdns.com36d64ce2.ovslegodl.sched.ovscdns.comIN A43.132.64.18836d64ce2.ovslegodl.sched.ovscdns.comIN A43.132.64.190 -
GEThttps://pic4.zhimg.com/v2-d4d034644ef2cab3c65d64edc8d2d3e4_1440w.jpg?source=172ae18bRemote address:43.132.64.188:443RequestGET /v2-d4d034644ef2cab3c65d64edc8d2d3e4_1440w.jpg?source=172ae18b HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
Accept: */*
Host: pic4.zhimg.com
Cache-Control: no-cache
ResponseHTTP/1.1 200 OK
Server: Byte-nginx
Content-Type: image/jpeg
Date: Mon, 19 Aug 2024 16:36:18 GMT
Imagex-Fmt: jpeg2jpeg
Nw-Session-Id: 20240820003617DBDA3BC8983D850AF8D55tkl501ff
Nw-Session-Trace: 2024-08-20T00:36:18.003407708+08:00 38
Server-Timing: inner; dur=46
X-Bdcdn-Cache-Status: TCP_MISS
X-Imagex-Extra: {"algo.succ":"resize","enc":{"h":900,"nq":75,"q":75,"w":1200}}
X-Length: 41703
X-Powered-By: ImageX
X-Response-Date: Tue, 20 Aug 2024 00:36:18 GMT
X-Tt-Logid: 20240820003617DBDA3BC8983D850AF8D5
X-Tt-Trace-Host: 01e55500e6d919b90a104dd3d033d1e719368dd4e4f9bf2d70b0af34fa6cd3cabe84c0e2e34691bb0118ffe7c6983ac87ef379b749569e9c72752e765bf9bdc8bebc2891a1113f5aa1aa3be41940ae12f9f5cee27e33012dd517a722245c8ceacace023f59c5db4a828b51681215dd8db37a6f244307f9d81b5209da341e762125
X-Tt-Trace-Id: 202408200036172b6b2436016f1841F858
X-Tt-Trace-Tag: id=5
x-request-ip: 42.81.252.114
x-request-id: 0962e3e0943192e9d5a9463668ed5050
x-response-cinfo: 42.81.252.114
x-response-cache: miss
X-Cache-Lookup: Cache Hit
Last-Modified: Mon, 19 Aug 2024 16:36:18 GMT
Cache-Control: max-age=31536000
Content-Length: 41703
Accept-Ranges: bytes
X-NWS-LOG-UUID: 4430652920247626504
Connection: keep-alive
X-Cache-Lookup: Cache Miss
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 2592000
x-cdn-provider: tencent
-
DNSocsp.dcocsp.cnRemote address:8.8.8.8:53Requestocsp.dcocsp.cnIN AResponseocsp.dcocsp.cnIN CNAMEocsp.dcocsp.cn.w.kunlunar.comocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.234ocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.232ocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.231ocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.233ocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.238ocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.237ocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.236ocsp.dcocsp.cn.w.kunlunar.comIN A163.181.57.235
-
GEThttp://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3DRemote address:163.181.57.234:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.dcocsp.cn
ResponseHTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Date: Tue, 20 Aug 2024 06:17:33 GMT
Via: cache15.l2de2[0,0,200-0,H], cache1.l2de2[0,0], ens-cache8.gb5[0,0,200-0,H], ens-cache3.gb5[2,0]
Age: 849
Ali-Swift-Global-Savetime: 1724134653
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Tue, 20 Aug 2024 06:17:34 GMT
X-Swift-CacheTime: 3599
Timing-Allow-Origin: *
EagleId: a3b5398717241355020081058e
-
GEThttp://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAo9CdsGIXUOiUSzi9a8cJM%3DRemote address:163.181.57.234:80RequestGET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAo9CdsGIXUOiUSzi9a8cJM%3D HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/6.1
Host: ocsp.dcocsp.cn
ResponseHTTP/1.1 200 OK
Server: Tengine
Content-Type: application/ocsp-response
Content-Length: 471
Connection: keep-alive
Date: Tue, 20 Aug 2024 06:02:45 GMT
Via: cache6.l2de2[0,0,200-0,H], cache14.l2de2[1,0], ens-cache6.gb5[0,0,200-0,H], ens-cache3.gb5[1,0]
Age: 1736
Ali-Swift-Global-Savetime: 1724133766
X-Cache: HIT TCP_MEM_HIT dirn:-2:-2
X-Swift-SaveTime: Tue, 20 Aug 2024 06:25:37 GMT
X-Swift-CacheTime: 2229
Timing-Allow-Origin: *
EagleId: a3b5398717241355020741139e
-
DNScrl.microsoft.comRemote address:8.8.8.8:53Requestcrl.microsoft.comIN AResponsecrl.microsoft.comIN CNAMEcrl.www.ms.akadns.netcrl.www.ms.akadns.netIN CNAMEa1363.dscg.akamai.neta1363.dscg.akamai.netIN A2.18.190.80a1363.dscg.akamai.netIN A2.18.190.71
-
GEThttp://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crlRemote address:2.18.190.80:80RequestGET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 01 May 2024 09:28:59 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com
ResponseHTTP/1.1 200 OK
Content-Length: 1036
Content-Type: application/octet-stream
Content-MD5: 5xIscz+eN7ugykyYXOEdbQ==
Last-Modified: Thu, 11 Jul 2024 01:45:51 GMT
ETag: 0x8DCA14B323B2CC0
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: ff7d3404-301e-006c-4d37-d3bc7d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Tue, 20 Aug 2024 06:32:12 GMT
Connection: keep-alive
-
43.132.64.188:443https://pic4.zhimg.com/v2-d4d034644ef2cab3c65d64edc8d2d3e4_1440w.jpg?source=172ae18btls, http
HTTP Request
GET https://pic4.zhimg.com/v2-d4d034644ef2cab3c65d64edc8d2d3e4_1440w.jpg?source=172ae18bHTTP Response
200 -
163.181.57.234:80http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAo9CdsGIXUOiUSzi9a8cJM%3Dhttp
HTTP Request
GET http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoEcNCWvIoSyJCm34Ju7Es%3DHTTP Response
200HTTP Request
GET http://ocsp.dcocsp.cn/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSmVYFXwi%2FRq9wx3PKhB8lC%2FFYUyAQUkZ9eMRWuEJ%2BtYMH3wcyqSDQvDCYCEAo9CdsGIXUOiUSzi9a8cJM%3DHTTP Response
200 -
2.18.190.80:80http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crlhttp
HTTP Request
GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crlHTTP Response
200
-
8.8.8.8:53pic4.zhimg.comdns
DNS Request
pic4.zhimg.com
DNS Response
43.132.64.18843.132.64.190
-
8.8.8.8:53ocsp.dcocsp.cndns
DNS Request
ocsp.dcocsp.cn
DNS Response
163.181.57.234163.181.57.232163.181.57.231163.181.57.233163.181.57.238163.181.57.237163.181.57.236163.181.57.235
-
8.8.8.8:53crl.microsoft.comdns
DNS Request
crl.microsoft.com
DNS Response
2.18.190.802.18.190.71
MITRE ATT&CK Enterprise v15
Persistence
Event Triggered Execution
1Image File Execution Options Injection
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
97KB
MD5c35425ad1f0c32225d307310deccc335
SHA1b2e347b244e40ffa113dffaffd1895777e3ac30a
SHA25648773d597155dc39dd172c26867972da89dd61fcee0d138433eda26a2d8633b7
SHA51247b6a7447fcc4f9f21018f608fcbdb5650f16cbd869cae5d4ed5d9b88ca1e944de1cac10e9a252aa7b210f1a31456c0ed91728b8a7e24def99d7e3f9683e2bae
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
10.0MB
-
Filesize
240KB
-
Filesize
4.8MB
-
Filesize
10.0MB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB
-
Filesize
240KB