Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    94s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/09/2024, 20:49

General

  • Target

    skyQQMsgNS.exe

  • Size

    1.2MB

  • MD5

    3ede974cea8eaba816377b0197963882

  • SHA1

    e5319baa5361ef6039171e085f09b360959ec449

  • SHA256

    e564dc1633b2a4f587e2e4fdbabb3709d02dc9fb5b6ddcbfc17187f8436d5d0a

  • SHA512

    2165de327c496abb981ba8222ec4a85697e9f7c0b0ee46c2d2dd62319e417541949fc29a570e53761f6e3fb8bca8416006b93c0d7fb548e826a6e21a6e3fd53f

  • SSDEEP

    24576:EtMkVOW6K2go1hi6iAK4PbDehk4HKyZ5rnpEr9oeBk/CZMaX:usvTKcL45/zpEV/ZMaX

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Installs/modifies Browser Helper Object 2 TTPs 1 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

  • Drops file in System32 directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 61 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\skyQQMsgNS.exe
    "C:\Users\Admin\AppData\Local\Temp\skyQQMsgNS.exe"
    1⤵
    • Loads dropped DLL
    • Installs/modifies Browser Helper Object
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4992

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\winbodun.dll

    Filesize

    104KB

    MD5

    ba7a79d3e9b932c85baae493a7bca016

    SHA1

    53d47b33a5c8e4da388bfcf6614d24cc7f8b93fd

    SHA256

    0dbd12e6a6cfd426ae862d785c3c2785b3fbcbac07e14820e382ad5166d34ef8

    SHA512

    0cbc2bb6b1de8a090e12d034ae5ec1ca00ce3567241a4443ec1e4c7239ed86cc487a89ed2c1558fb67df1863735252326de9c18eee4593894c6434c61ce5ae7b

  • C:\Windows\SysWOW64\winexcl.dll

    Filesize

    16KB

    MD5

    8ecd0db14b8104fa0ac2591ca3d6adae

    SHA1

    73509da1d50aba3e0e9836b915da60e411d714b1

    SHA256

    3b2e8945ed7984bf24c76bb8dcdae50c75011384860d12c6be344b04ddfc0b8f

    SHA512

    8a1cdab80319a91c68959035b63c93b9f36a4144810b2c42b8f31c6f23684c5d65f3bf0e79958e3ec7b3b29e45b8d8905395583364c1174ec2c10362b7e3aefe