Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    01/10/2024, 16:59

General

  • Target

    CF月神透视网吧家庭通用版0907sp3.exe

  • Size

    460KB

  • MD5

    f4f86a85b970da4c5fbcb14739d99700

  • SHA1

    12d47e1186e3bd7b87b3788be68da0fa186c9284

  • SHA256

    cd09663df7f81722f875d77900181f9a715f1bd9e23eb8cd47c5b317f46b2f0a

  • SHA512

    83e7ff2d8aa30437a2dff08a1c9110c34e6d5dbdb4656191e16a94c559d991baac72832e3b3581b6baf3b908269a7988e13c358965a158df375610eef037e646

  • SSDEEP

    6144:lSKLhX/T6gaXhnjonRyEVJULYCpX7HvTM1dCKruL0VjKHZSlr//ZEnpddug:lSWRvaRjonRBJDmXDLMukYHMrZEdd

Score
5/10

Malware Config

Signatures

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CF月神透视网吧家庭通用版0907sp3.exe
    "C:\Users\Admin\AppData\Local\Temp\CF月神透视网吧家庭通用版0907sp3.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Windows\SysWOW64\explorer.exe
      "C:\Windows\System32\explorer.exe" http://www.725wg.com/
      2⤵
      • System Location Discovery: System Language Discovery
      PID:2632
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2596
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://www.725wg.com/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:3064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ce8f3625dd5c3da5f06bec997b1f9c81

    SHA1

    ab1248ffc5d924f519cfb4d473e5224e4f38b5c6

    SHA256

    9d6f56fdc3356a75e5df1429a2981c7bb14b6f2494071b9372cf7269bb61d3a1

    SHA512

    1ffc132570116bfd2a29e4b48f9b9fb66f9e8cc833f6134f53d8e957b14783e27435129825225368d558a2168e94be0747caf4527287b7481c9b684487c82853

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ba1af0f0d0bae18eb9474ec3c8c178c1

    SHA1

    a2873d32b1dc67fe895e7d5cb71717cf6ec2edac

    SHA256

    c871c0d6f3c0785780d3e5b17f025895a5029f948011de6abde4db173c4a9abb

    SHA512

    f463f66ee51a486be24b7ee67d89a52b0ed89fa7c728bcd71db3db32c8dd9fc7272d7041fe0ddf46e989a414d348a02486f4580ea756a745b2e4fdf931571738

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    9a989b85c12993212489961edf350125

    SHA1

    6d99a57971591d24dfb8785121a20fb118efe8d1

    SHA256

    1d0de87bb68d9a9aa5dcb3d58082b045b9237db85c4032b30c3bbcdd760e4a0a

    SHA512

    c76d72a1be2bc36dab9710a368b74e2f065acbe1c35a0e8aa73fdb291e21afb5c2c0c1254bf35a484c6b720d0155086fff8280f8f005c27f0fb901479e0e34e7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c6388b12dd443469d0b675271504b730

    SHA1

    767b23ad583971380af00e6384c1d6024ed027c3

    SHA256

    ac7a08737ecfc476c338f7a90742b2003ec01cbf4454ab2c11a684ec7ddf73ca

    SHA512

    80f02ed127d36fb1ec780491a4811c0c6c0510d04caaf8753ed8204b216c48401997b0ce9ea2596379b4c16afed1d9a3031ad036bedc33d2c0f3ed264753fe44

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fc94a0036692374d468b9870acfaaafd

    SHA1

    8a4f8ac531b96edef41b45bf2a0b8e09094f84f7

    SHA256

    e58dfc42950c32a6b35ae6ab8b3887161efbc3749e4ccf9ddda68894dd355338

    SHA512

    ce4eaccb3eabd6a56348b806ed784a1dd53f83dbc408581e7f097a8c90914f0545f59eea7dc3980adbbb9835c8c1f0be32338b83aca8d6bb50e0c7fdc124745d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    8ee7f7f4132c372ab228761fffc72166

    SHA1

    bc1d2644c82e3bffa86948e09fef5a7484cc1834

    SHA256

    c62803d185b4f21dd601cf5f53a7013e90e6a18360f49230ecc648d9e4d2d8da

    SHA512

    9569c7ddfb11a86694166f0e20787ecd8d259b960600ab09a3a8023fdd5168f355dfd3e234d591742599f84a48f5d3b33858d228f3ed2d3eb16313047e11db7f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    ab72fec85529ccc986156abe0738cc2a

    SHA1

    7f72bdec7815675d9203272e1d8a37c175e18543

    SHA256

    a8e4e53bf28a459404002d41c8c56b6fb9327b64e7c2893efa853eb4c9504568

    SHA512

    db1d4debcb29eb6a84f4195a5c094bc66128563d1976f08146abc7a6ebbc4f5665b2de8470a29c76ac4d311f4c01f7a9aa8b85febb6bc1fc0bc6345c2a2bfc19

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    817f30fb301144874b49d6aa8fd71d0e

    SHA1

    6813321e7b82edf5e259e605a029ba80d72240e9

    SHA256

    77d21fcc2d14b235708023148d418f957e6a43ab626b8f21e89df927b8ec5425

    SHA512

    eb5ec3a66131b21fe28c32e3edafebe3697b876af1958f6e199e65376f7db27c7ccd149e6c799ddbb3f29269a434c6011c37685b3f1342f4af2632c6d8c7d5aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c2896fdfa6671994ae29bdd6a688d403

    SHA1

    700081ea28883b6287100f1d9bc40e088b148717

    SHA256

    43b765c3176dde3af59b4fab857afdcb90664e9c48ffae3629a468656da40e96

    SHA512

    f3a1daeb93ed71090e8db5a1ff22ae3510a9038ad9437029843ad172bed21997c34f004747a585f027689228c531c9b01addd0ce1944bbfc59c6451e88a04172

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0f8cf68e54b1d7d0ec033a3f079558d4

    SHA1

    c05bb86085df10ac296946aae56516a11c70d95c

    SHA256

    05a595118914518c1b04b87df0b348657c7f0e78dcd6968ec7f79404bec131ba

    SHA512

    bca79f23279e403dc2769ba5e46ff8d60e3d282dd488fc04e183ef1f7525f2cb22f3661b48cd8d85c31c0217ba807ad23c24ca4eee935692ff4c5501aba2d6ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    68d67528186fa79d12b79b53fb159937

    SHA1

    96fe026ccb5efda8e513e0b884eb6b961229d010

    SHA256

    9f39d541d10896dacdd2787a92a5769794c9134555ee64c1be7724ffcc35d0f2

    SHA512

    a1ee5d0b436a7cd631b5e789bb610f9a48779b002c24274f231006edae315c46ed368c750c20468abde1104b4c2cf6352ce87da10c1bc676258dc8eecd609ed6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    fd49ccc09074c979c1a6e8c5358dfb88

    SHA1

    d2abe7c30a752e1f18d5a3dbb40f92e069bb4257

    SHA256

    4aee300d6ce3a2e2cb734074f9e2929e1cc966a4691b2ddd214c8e2de8e9b11c

    SHA512

    0d7af04b13876359cfbfafe5819e75cadaf124249a0c573be1fa1eeea2964c7062ab3698b107683b6096ad0b8e16c9edce89c248369da7c972551f369aba5578

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c3dc89bb870ca385f0e8dfb25e16d4aa

    SHA1

    85a2893817f4a07df02e367618c4f5e1debe6f1f

    SHA256

    79d9f9395812fd465a8d57a57555f9df760e11ab9c2edb19047b46437ad557c7

    SHA512

    d7112aa927a2acaadf317cfde40e624dc76d753acd0f5ae63ad0d136bbddb756a8046c62a3db8229d1249d5006b41a1241500bf7b05e3641752bdfab8d93d3a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    97e2b48ebd128fe583d09f72f0fa261b

    SHA1

    ec4a851ebe79a778949aa7efa60ceee2089ffbb5

    SHA256

    6f20050125f1c755b6c446c1265704f86b1832934f1b7f25df690937b3aba23d

    SHA512

    4b998137d1d44345f804b328a1fb6ba3e4a0cfc772e7e1d1a89e4af8f11b7d349e930bfcb9cf6cc23b8af181821beb5ba44b0f4f42e67f3da228dfd707289fa2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1a3f0c9f3b0ce3de8f08ac63e779cc61

    SHA1

    7444b59dd064f7932cfe97787a11e1f757001503

    SHA256

    3d6c095f23e1a8d19d586324c9f9d2b3d8b0ee2dfdf016b5f2af6a7e523f9e0d

    SHA512

    3a7bbfb63f34021e167e3098fbe57ed8084d53a41f2f2228253dc5cb5b1df98d2e81269d3800e13bc115fb8747938b84254027b3a667d337e4cbb33ee9012869

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    45be0e9e464139ea11ed92fd42696f57

    SHA1

    da1431fa997ec948ff6287c9fd59d84276112eaf

    SHA256

    5c63539b7b22c8978d08dc7feb85b54158dd95cfce1815f8e669bc4e1649f9d4

    SHA512

    995310adde1816677d9ff4d2c673dfb2520d380ad2fbd22a679cd768299cf15097b90d7d497f4baf9789f729cacc2b0bfb6a27477c07c5fa30171d60bbcc0bcd

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4fb6a6eaf490c122e9f663750f9eb334

    SHA1

    9ba6d29e439e203df544661c475cd44aac3798a8

    SHA256

    c20f861771762d6ae8b81af4347f59223ce38f1ed8732f4f2e0800f687fd1660

    SHA512

    02e6464333680113e87705ffc50bfaad908d33e13d4335c8d6c1875f15355b2585ab8f5511965eb754cdd94d165251fbee7474de3e2ffc8a17f5338215321c05

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7eaf656a8621ba8ad02274a8bcdfc350

    SHA1

    6156db889019b6d9257aa323cea1ea862e2e9d43

    SHA256

    2a8016840413a1ca8db800eaa7a7c314985d911a9b4caf0e73129e79744f88a5

    SHA512

    41c6f3221aa255c551c4b104085d5710a4964615a839d9cb46fac271a0b88cd2e1b208e11fef00d6bea71ad56260c80231cc4ffe4c10e80459afad9aa4d8cd1a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1d58c66177e47553c709ce434e376cd6

    SHA1

    53fc6de9bb88928f3f69306cb9d65cffd89c5060

    SHA256

    bfdefa48b6a62bf3460c45ef1b50b43b0bebc4759fedd642f659051f2e8253dd

    SHA512

    29ab4b046688a0ad7bb18ad1e2be89f28c31f032eb3d3cc7e1a7a66727e26754353d47d810d97ff67ee11257a8a7716d06e42157cbe6fa9c6047073ed19fe350

  • C:\Users\Admin\AppData\Local\Temp\Cab2D99.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar2DEA.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • memory/2316-28-0x0000000000400000-0x000000000054D000-memory.dmp

    Filesize

    1.3MB

  • memory/2316-0-0x0000000000400000-0x000000000054D000-memory.dmp

    Filesize

    1.3MB

  • memory/2316-13-0x0000000000400000-0x000000000054D000-memory.dmp

    Filesize

    1.3MB

  • memory/2316-12-0x0000000000400000-0x000000000054D000-memory.dmp

    Filesize

    1.3MB