Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/09/2024, 20:49

General

  • Target

    skyQQMsgNS.exe

  • Size

    1.2MB

  • MD5

    3ede974cea8eaba816377b0197963882

  • SHA1

    e5319baa5361ef6039171e085f09b360959ec449

  • SHA256

    e564dc1633b2a4f587e2e4fdbabb3709d02dc9fb5b6ddcbfc17187f8436d5d0a

  • SHA512

    2165de327c496abb981ba8222ec4a85697e9f7c0b0ee46c2d2dd62319e417541949fc29a570e53761f6e3fb8bca8416006b93c0d7fb548e826a6e21a6e3fd53f

  • SSDEEP

    24576:EtMkVOW6K2go1hi6iAK4PbDehk4HKyZ5rnpEr9oeBk/CZMaX:usvTKcL45/zpEV/ZMaX

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Modifies registry class 61 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\skyQQMsgNS.exe
    "C:\Users\Admin\AppData\Local\Temp\skyQQMsgNS.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\winexcl.dll

    Filesize

    16KB

    MD5

    1149724a866db2b61e54001a19e501ca

    SHA1

    6cac493435281eacaf91014de367fe64d3674d93

    SHA256

    bfab89efafd8c209fdb97d24e2bcebec4c8a285cccf4ebf2b26bd25697f3e632

    SHA512

    fd482db3167a8b2d4963e7e8a30ca551e1a9569671848ae5c285b7f59dd21d0b06347eb7898be9441e4d3a7c71063d98cec6be7c4b6e4da49b563bd9727f045e

  • \Windows\SysWOW64\winbodun.dll

    Filesize

    104KB

    MD5

    ba7a79d3e9b932c85baae493a7bca016

    SHA1

    53d47b33a5c8e4da388bfcf6614d24cc7f8b93fd

    SHA256

    0dbd12e6a6cfd426ae862d785c3c2785b3fbcbac07e14820e382ad5166d34ef8

    SHA512

    0cbc2bb6b1de8a090e12d034ae5ec1ca00ce3567241a4443ec1e4c7239ed86cc487a89ed2c1558fb67df1863735252326de9c18eee4593894c6434c61ce5ae7b