Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 03:23
Static task
static1
Behavioral task
behavioral1
Sample
klvideoconverter100.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
klvideoconverter100.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20240802-en
General
-
Target
klvideoconverter100.exe
-
Size
15.6MB
-
MD5
699e8703f89320ba3577acc3c9b94cc1
-
SHA1
c25ee304214f2602d7a493c062357e84bbb1d21b
-
SHA256
e38f3081e1752ea792920d74839f3b5b97387ad78616fe8c354fc78cb46901b1
-
SHA512
cee15d4e490be17ef67ad7d6cbaa2243ffc9d7152a7abec9c5124941dc5d16294a277e0dbaea10d128a5bcebe3cbdfab9d6dcb0da6cea28f926c26921f6e29d9
-
SSDEEP
393216:cdbB112aIPXBBygsqruRh6elGNBg2QUNAWj:E312h/vyHb5OuUNRj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2156 is-KSSOV.tmp -
Loads dropped DLL 3 IoCs
pid Process 2936 klvideoconverter100.exe 2156 is-KSSOV.tmp 2156 is-KSSOV.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language klvideoconverter100.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is-KSSOV.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2156 is-KSSOV.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2936 wrote to memory of 2156 2936 klvideoconverter100.exe 30 PID 2936 wrote to memory of 2156 2936 klvideoconverter100.exe 30 PID 2936 wrote to memory of 2156 2936 klvideoconverter100.exe 30 PID 2936 wrote to memory of 2156 2936 klvideoconverter100.exe 30 PID 2936 wrote to memory of 2156 2936 klvideoconverter100.exe 30 PID 2936 wrote to memory of 2156 2936 klvideoconverter100.exe 30 PID 2936 wrote to memory of 2156 2936 klvideoconverter100.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\klvideoconverter100.exe"C:\Users\Admin\AppData\Local\Temp\klvideoconverter100.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\is-ILKAT.tmp\is-KSSOV.tmp"C:\Users\Admin\AppData\Local\Temp\is-ILKAT.tmp\is-KSSOV.tmp" /SL4 $400DC "C:\Users\Admin\AppData\Local\Temp\klvideoconverter100.exe" 16097290 527362⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
PID:2156
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
659KB
MD533f7ff58846f9d1c124e3b9f2f464c75
SHA1edc52a13bf6f05edea30fac93afd46d6107d3d56
SHA256d7a755b41a765b5e682ba9130b5d94857745de87787b0e87d012bc19a06f67ab
SHA512b866964326a7063f2e0683d3a61ebfc13bb0b37c3d22afe4b627a2a16a860232ed34ddb7a6c61abdaffd39e39d4d4de0bbe3b7aabe0ccc615fbcaf474b1c4977