Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
4Static
static
3百分百�...��.url
windows7-x64
1百分百�...��.url
windows10-2004-x64
1百分百�...32.dll
windows7-x64
3百分百�...32.dll
windows10-2004-x64
3百分百�...T2.dll
windows7-x64
3百分百�...T2.dll
windows10-2004-x64
3百分百�...TL.dll
windows7-x64
3百分百�...TL.dll
windows10-2004-x64
3百分百�...32.dll
windows7-x64
3百分百�...32.dll
windows10-2004-x64
3百分百�...5.file
windows7-x64
1百分百�...5.file
windows10-2004-x64
1百分百�...AR.exe
windows7-x64
3百分百�...AR.exe
windows10-2004-x64
3百分百�...��.exe
windows7-x64
3百分百�...��.exe
windows10-2004-x64
3百分百�...te.exe
windows7-x64
3百分百�...te.exe
windows10-2004-x64
3百分百�...��.exe
windows7-x64
3百分百�...��.exe
windows10-2004-x64
3百分百�...��.doc
windows7-x64
4百分百�...��.doc
windows10-2004-x64
1百分百�...DK.dll
windows7-x64
3百分百�...DK.dll
windows10-2004-x64
3百分百�...ns.dll
windows7-x64
3百分百�...ns.dll
windows10-2004-x64
3百分百�....1.exe
windows7-x64
3百分百�....1.exe
windows10-2004-x64
3百分百�...DK.dll
windows7-x64
3百分百�...DK.dll
windows10-2004-x64
3百分百�...��.url
windows7-x64
1百分百�...��.url
windows10-2004-x64
1Analysis
-
max time kernel
102s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
28/09/2024, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
百分百阿里旺旺群发器(淘宝版)/155绿色软件站.url
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
百分百阿里旺旺群发器(淘宝版)/155绿色软件站.url
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
百分百阿里旺旺群发器(淘宝版)/Comdlg32.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
百分百阿里旺旺群发器(淘宝版)/Comdlg32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
百分百阿里旺旺群发器(淘宝版)/MSCOMCT2.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
百分百阿里旺旺群发器(淘宝版)/MSCOMCT2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
百分百阿里旺旺群发器(淘宝版)/MSCOMCTL.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
百分百阿里旺旺群发器(淘宝版)/MSCOMCTL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
百分百阿里旺旺群发器(淘宝版)/RICHTX32.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
百分百阿里旺旺群发器(淘宝版)/RICHTX32.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
百分百阿里旺旺群发器(淘宝版)/file/705.5475.file
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
百分百阿里旺旺群发器(淘宝版)/file/705.5475.file
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
百分百阿里旺旺群发器(淘宝版)/plug/UnRAR.exe
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
百分百阿里旺旺群发器(淘宝版)/plug/UnRAR.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
百分百阿里旺旺群发器(淘宝版)/plug/虚拟桌面.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
百分百阿里旺旺群发器(淘宝版)/plug/虚拟桌面.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
百分百阿里旺旺群发器(淘宝版)/update.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
百分百阿里旺旺群发器(淘宝版)/update.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
百分百阿里旺旺群发器(淘宝版)/手动输入验证码.exe
Resource
win7-20240704-en
Behavioral task
behavioral20
Sample
百分百阿里旺旺群发器(淘宝版)/手动输入验证码.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
百分百阿里旺旺群发器(淘宝版)/旺旺群发使用前必读文档.doc
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
百分百阿里旺旺群发器(淘宝版)/旺旺群发使用前必读文档.doc
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/DLL/CustomWinlicenseSDK.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/DLL/CustomWinlicenseSDK.dll
Resource
win10v2004-20240910-en
Behavioral task
behavioral25
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/EXE/ECCfunctions.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/EXE/ECCfunctions.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/EXE/WLGen_百分百阿里旺旺群发器(淘宝版) 9.1.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/EXE/WLGen_百分百阿里旺旺群发器(淘宝版) 9.1.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral29
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/EXE/WinLicenseSDK.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
百分百阿里旺旺群发器(淘宝版)/注册机/EXE/WinLicenseSDK.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
百分百阿里旺旺群发器(淘宝版)/百分百(旺旺群)群发软件.url
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
百分百阿里旺旺群发器(淘宝版)/百分百(旺旺群)群发软件.url
Resource
win10v2004-20240802-en
General
-
Target
百分百阿里旺旺群发器(淘宝版)/旺旺群发使用前必读文档.doc
-
Size
44KB
-
MD5
6ebc7658e79f63c9e7a435fdbeec2e20
-
SHA1
9395830b78ee90c780d085eaed248ddfbfcbc32a
-
SHA256
220d8a877e4281a3a48670d0e618a63657665d99380b22bdd8b8e0d619cf5fdd
-
SHA512
bc4064962046feafa6a487d98c20b9f7206d778bd329d6ce5e8fc9f4b38f2e0338693b1e929bb8da7c7775dc44afb577a0d516aaf301040ee0465c29b05e1832
-
SSDEEP
768:gKpFUC/dEuupT6ST3peao1CQ+JFnvGZ789:JpFh/nul6Sbxoc5jl
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3560 WINWORD.EXE 3560 WINWORD.EXE -
Suspicious use of SetWindowsHookEx 18 IoCs
pid Process 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE 3560 WINWORD.EXE
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\百分百阿里旺旺群发器(淘宝版)\旺旺群发使用前必读文档.doc" /o ""1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3560
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
245KB
MD5f883b260a8d67082ea895c14bf56dd56
SHA17954565c1f243d46ad3b1e2f1baf3281451fc14b
SHA256ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353
SHA512d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Filesize1KB
MD5ee3c0c9501d9015f28e6ae19957f9dc0
SHA11d13b239dfe1f1f534a7a917701b80d899cf727e
SHA256cbb8ef0a214700f6db6fe59776fa7866c0b0c2bc91a8a4faf6a1a2aaa7729324
SHA51276e62fb02dc6da32b38c2dbd7ad4012f564622657f00395fd701b7cc26493e3140aebf202390592de5df56cb50ed1a41e418f39da5b3a61e88f940d2e607bdc6