Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01/10/2024, 01:17
Static task
static1
Behavioral task
behavioral1
Sample
sogou_pinyin_guanwang.exe
Resource
win7-20240903-en
General
-
Target
sogou_pinyin_guanwang.exe
-
Size
181.2MB
-
MD5
42b9b4f540a534b0b7db83e9aba9d90d
-
SHA1
57b56ba1dd6f9cf41c181c631f8cf829bab80607
-
SHA256
c1103842cdc46be114dff25ae7e3b59e2a014133945d68eaffe02e84b2078b02
-
SHA512
8983df90e6952725b54495516dd328760f9c9e37162589a55c16db2986063d9e0644f47157e9786a473f9da9bb37a5ac74fcbd818493443d17536e1abbc424eb
-
SSDEEP
3145728:A/kfnZZRUWXNShZNxlb3oeUFRGp/K3GgUCoQKAQ6h398AWXNOQ14BDndvdXi37Dk:jnTLXwXNf4eUSJK39U8KAQ6hN8AW9H1m
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1328 cxizpasuqff.exe 2648 cxizpasuqff.exe -
Loads dropped DLL 12 IoCs
pid Process 1160 sogou_pinyin_guanwang.exe 1160 sogou_pinyin_guanwang.exe 1160 sogou_pinyin_guanwang.exe 1160 sogou_pinyin_guanwang.exe 828 sogou_pinyin_guanwang.exe 828 sogou_pinyin_guanwang.exe 828 sogou_pinyin_guanwang.exe 828 sogou_pinyin_guanwang.exe 2812 sogou_pinyin_guanwang.exe 2812 sogou_pinyin_guanwang.exe 2812 sogou_pinyin_guanwang.exe 2812 sogou_pinyin_guanwang.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sogou_pinyin_guanwang.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sogou_pinyin_guanwang.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cxizpasuqff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cxizpasuqff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sogou_pinyin_guanwang.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 13 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5124 cmd.exe 29296 PING.EXE 20828 PING.EXE 1724 PING.EXE 15744 cmd.exe 16292 PING.EXE 9424 cmd.exe 16156 cmd.exe 26844 cmd.exe 6212 PING.EXE 31452 cmd.exe 16232 PING.EXE 16168 cmd.exe -
Runs ping.exe 1 TTPs 6 IoCs
pid Process 20828 PING.EXE 1724 PING.EXE 16292 PING.EXE 16232 PING.EXE 6212 PING.EXE 29296 PING.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1160 wrote to memory of 1328 1160 sogou_pinyin_guanwang.exe 31 PID 1160 wrote to memory of 1328 1160 sogou_pinyin_guanwang.exe 31 PID 1160 wrote to memory of 1328 1160 sogou_pinyin_guanwang.exe 31 PID 1160 wrote to memory of 1328 1160 sogou_pinyin_guanwang.exe 31 PID 1160 wrote to memory of 828 1160 sogou_pinyin_guanwang.exe 32 PID 1160 wrote to memory of 828 1160 sogou_pinyin_guanwang.exe 32 PID 1160 wrote to memory of 828 1160 sogou_pinyin_guanwang.exe 32 PID 1160 wrote to memory of 828 1160 sogou_pinyin_guanwang.exe 32 PID 828 wrote to memory of 2648 828 sogou_pinyin_guanwang.exe 33 PID 828 wrote to memory of 2648 828 sogou_pinyin_guanwang.exe 33 PID 828 wrote to memory of 2648 828 sogou_pinyin_guanwang.exe 33 PID 828 wrote to memory of 2648 828 sogou_pinyin_guanwang.exe 33 PID 828 wrote to memory of 2812 828 sogou_pinyin_guanwang.exe 34 PID 828 wrote to memory of 2812 828 sogou_pinyin_guanwang.exe 34 PID 828 wrote to memory of 2812 828 sogou_pinyin_guanwang.exe 34 PID 828 wrote to memory of 2812 828 sogou_pinyin_guanwang.exe 34 PID 2812 wrote to memory of 6380 2812 sogou_pinyin_guanwang.exe 35 PID 2812 wrote to memory of 6380 2812 sogou_pinyin_guanwang.exe 35 PID 2812 wrote to memory of 6380 2812 sogou_pinyin_guanwang.exe 35 PID 2812 wrote to memory of 6380 2812 sogou_pinyin_guanwang.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul3⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:16156 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.14⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1724
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul4⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:5124 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.15⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:20828
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"4⤵PID:6380
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul5⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:16168 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.16⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:29296
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"4⤵PID:9520
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"5⤵PID:20328
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul6⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:31452 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.17⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:16292
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"5⤵PID:20380
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"6⤵PID:15392
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"6⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"7⤵PID:16480
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul8⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:15744 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.19⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:16232
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"7⤵PID:9132
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"8⤵PID:15928
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"8⤵PID:15988
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"9⤵PID:16116
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"9⤵PID:15504
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"10⤵PID:9564
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"10⤵PID:19960
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"11⤵PID:26756
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"11⤵PID:9000
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"12⤵PID:3796
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"12⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"13⤵PID:29120
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul14⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:9424 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.115⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:6212
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"13⤵PID:17060
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"14⤵PID:18044
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"14⤵PID:18136
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"15⤵PID:15200
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"15⤵PID:24852
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"16⤵PID:3840
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"16⤵PID:10072
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"17⤵PID:20204
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"17⤵PID:13152
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"18⤵PID:25948
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"18⤵PID:8200
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"19⤵PID:7572
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\CXIZPA~1.EXE > nul20⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:26844
-
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"19⤵PID:15156
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"20⤵PID:14048
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"20⤵PID:5776
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"21⤵PID:13180
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"21⤵PID:12356
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"22⤵PID:18920
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"22⤵PID:9952
-
C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"C:\Users\Admin\AppData\Local\Temp\cxizpasuqff.exe"23⤵PID:15380
-
-
C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"C:\Users\Admin\AppData\Local\Temp\sogou_pinyin_guanwang.exe"23⤵PID:29184
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -auto1⤵PID:12984
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -acsi2⤵PID:16196
-
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -auto1⤵PID:17852
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -auto1⤵PID:31672
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -acsi2⤵PID:12428
-
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -auto1⤵PID:17620
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -acsi2⤵PID:16760
-
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -auto1⤵PID:6552
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -acsi2⤵PID:28100
-
-
C:\Windows\SysWOW64\Phija.exeC:\Windows\SysWOW64\Phija.exe -auto1⤵PID:7704
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.7MB
MD5fcb567580061e72a4fc2f0546c1a16e3
SHA1e1067931d0a684aad46b65545c9908e93e970747
SHA256c6dd859819a7e14728cdc3c14fb1e00d94f905b26655fc56c99a0f428cc737ec
SHA512637020414a2d9f8940cee8665f70bc3e6ebdbdb3676d3a70483c9a32dee917ef5f6db75150f11543f5949fa27fa42420d5e97c6a09338778840caa5c82fad188
-
Filesize
27.5MB
MD55d36204cd16f8081f1711b3910dc6907
SHA18eddb28bd6fca46be221e30008153f8f27aa9c09
SHA256b100cb0d2b60c6caf1ff8e607967f4508c0c7b001f2a45b09fc916a3235dd968
SHA512302b61b1dd23ce94b8773609c2258ca8503d0f22154c1c7780219981c39bcaa679c68a0d3e32ad4018a27ff2d0000f24151128b3ea716cb88614d9b2a3982f38