Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
28/09/2024, 04:27
General
-
Target
百分百阿里旺旺群发器(淘宝版)/注册机/EXE/WLGen_百分百阿里旺旺群发器(淘宝版) 9.1.exe
-
Size
3.3MB
-
MD5
3e5c8720ef3107fa57787d31748af11d
-
SHA1
da38c5fc89803af719a6ecbf69f1893b195d48f9
-
SHA256
840dd095998b1883b709df98f5104dc99a47fd1c315deded335174c7a1dc51ed
-
SHA512
c5e9f2ef428c483ce7362915eb0eb1ec126310123e665851cb993eab26e417eb156c2565986f838193223f5242fa1fe61aaeb00ef5bffbdace5233d8c7ed2942
-
SSDEEP
49152:pxAtxx+9BWm/ys/bOnkeoQnuXW+VZfu1PpKJE:pxAtn+3ys/bMaQnumQfu1PpK
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\百分百阿里旺旺群发器(淘宝版)\注册机\EXE\WLGen_百分百阿里旺旺群发器(淘宝版) 9.1.exe"C:\Users\Admin\AppData\Local\Temp\百分百阿里旺旺群发器(淘宝版)\注册机\EXE\WLGen_百分百阿里旺旺群发器(淘宝版) 9.1.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.3MB