Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    02/10/2024, 08:14

General

  • Target

    Real Spy Monitor v2.89 特别版 电脑监测安全软件/Real.Spy.Monitor/下载说明.htm

  • Size

    2KB

  • MD5

    9785eb39d2a933dafc7c713baefda91b

  • SHA1

    fd66e14363e866222e467c4397e8ccb1d0954a7b

  • SHA256

    b7a5dde4b441c67156e2085ebcb90ac91e72f376cc4fd7874c69974de39730c0

  • SHA512

    7e8d6f5e77dae8bb4cced6fcb9d3d6d79b3165ce8fe1c0b6d8c6a5184d28d6bbd31959780f0e212f6f1a0f373fc23958f6b5481cc5075a4802b51538efe79dd7

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" "C:\Users\Admin\AppData\Local\Temp\ Real Spy Monitor v2.89 特别版 电脑监测安全软件\Real.Spy.Monitor\下载说明.htm"
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2060 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2336

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    baa63e25e9460dc08183d615df1287c8

    SHA1

    0c332dfef7f5b01e84a5aa3feb0cc63210e78125

    SHA256

    f3b26755e1100aa2c23144bbed2b1301ffca2db6175cbbc70cf3a9547b714c2b

    SHA512

    5438172113ce3c3f5e3032e014fe6e9b75d3fa04ef43f59257b3241feac49c3413be149d185675d701ea9e679059e9995b4b9cda51ccf146715bf38a4a78e0a6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    1bf377c90c977d9f0bd77efbad36dcfc

    SHA1

    3780cd06a7fad76f5b60b952d43b107b9d9b7ed4

    SHA256

    2287184087632808338a42aabdf35a805108db17fc88ebdaf67ae5b99521592e

    SHA512

    3a6234283e8655192ca1d38cc36dd82d41becb5d661cfe8fb2b86b2e4f6291bd20fd33efaaf8aca53474208eef77c32c7d12892c735adbe85bdee9593f204453

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    4424de72e9b29bfe21d629144389dd02

    SHA1

    2bfef3bb74f413e5e226b68e411461ca13961e98

    SHA256

    b418a86490c64082f25f448f6b8c44ae655f9730a463129a1a065d3832d5a21a

    SHA512

    240cca036f8a67a4747793c4de0b6435008af1eae9088f63cc35f43803f178c95ad9039b5b9434601e0b969cb64e006e33371e11066d99ec8cff6c91aeab5fb5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e468bdd381bca97d654d7f3aae9e55bb

    SHA1

    2e17987ddc406bd3d4f9a23d35b2bd88e74cd513

    SHA256

    b12abe4eb69e6855fa397607a320c1d61e241bf48dbab3dee11a9002fc479c93

    SHA512

    512a7c4e9cc7d1308767072220ce5dbc295e841a5f1af779f3e3159b58b672cb598451c77d7f776dffcc693a755d95cd4ab63344d057c827dae550ffee4b8e39

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a784895fbac14f8065fd467094ab64c8

    SHA1

    4e81b88d073e250ff90969e9ce7d3c020a91a161

    SHA256

    4f2e847c9e9929be6f9b0b89abb027313f0973cbbbd834dddc80d5ecdd6d6276

    SHA512

    6599910aa9f651d50f070fd3b6289ee05bc434df64eb38c4eaada0a3de6a83fa996a463492476e8449dca722309949cd0498eae9aa226bac1753a9937cad0796

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a20d4c9e741f210c3fc0f86e1d4b9615

    SHA1

    b17b4056579abcc36958693fb2d305c1718fa699

    SHA256

    4e481eef5fd5adda4583f9b625186a59095979cf7b4527071ff61137660777ec

    SHA512

    8ee648a40f4aac123ee7f445934d586ccd4f26e773128b5152ea42ca3bc0f7197197ffea623cbdb17e9f00493f015cc608e49842fef97b118c9af80a66e0015c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2447d9312e68d974ef6b1db45e8c740f

    SHA1

    3b2e2926116fe647073d910a156902a40dd5ee3c

    SHA256

    f98914b209c1fcc84483ca120d3f173407aa814f8eedd68cfb49f8477855c845

    SHA512

    fe4a5184fa486a37d59c66da4aa550f39e32753fbdebda15f23c458be485e3a6a244c9dfff96ea19d2e5fac49ffa589741a857080a2d7a1868c9c1182bbee175

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a149916bb38f77d8935d1987c95aaac7

    SHA1

    2a34b34519d5c7b6d370b3d4fb4ce78721997905

    SHA256

    8c387366c5481bf0425b3a3fd681561b76fd4d4ec140f96c89e01ebdef427fe8

    SHA512

    955b946df3893aac23e85ade992d7906b17bc71a2ec4a0e31e22bacfed23667446f18f78dc58d324c2b52ec3d3045271fe57d0fa9525621938510388165d77af

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a0c0b19aa7d1a9f86f58739b8820dd0c

    SHA1

    bc98134f059ab566ad36ec0607224fe877ccb670

    SHA256

    a8a941686073e5dea9bd40bfd11312b71c5b98a637298577e56da2921053b7c7

    SHA512

    7f9a903b0cc34a90ef296ea82e3263c77460e9eb0c61223f53d2f53b0566fb2a2d05b04b47bcb135ef15582211251b93311ea9beffbdc293da88c4f21c2b3281

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    cd290d575644f1e977f4eaf8de5d1d78

    SHA1

    02283fabe149de9c07a98f83f662d081285c6ea2

    SHA256

    9a458b6a12066cb526721a7bd5eead4c5b844d66180f30c3ebd935eebbffb089

    SHA512

    9a073911e75cabfe2769e1208eb2391e2d35d7b640a847be4c65497c4f98036ce92726bf3af1a1d969b2a09ba6414da4431d91e88bab64335d44412bb1dc0c66

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    dede5a074b6bce7555cdbefa42d6d867

    SHA1

    14f4e40d2ff774aa6f36d8965f2ebd4f2d4c9bf3

    SHA256

    6916fbb9b38cbad5dddc944765ccdeedc31d9bbb8253c70c7da88f8b0589fe2e

    SHA512

    d5524ec1eda0eb4b8a5b399103b7a9396989cd45c0b242387ff4f70a000ff495901d4687d43caf21d29fe4373bd6e000561c5ef50038161d6e9698e9189be594

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    18cf4a6fc2e12ac5151db7c371709721

    SHA1

    9c711d340598024506f9ad478355b178f35649b5

    SHA256

    a545bb18acc8d052d3c10112208b5f4f62bf64e2e2a7ac2a1b060525d1f8cf3d

    SHA512

    2b88a65b82bc5f0478d81bdaf8225b965a1e7fd8a96170c267959414e4ddb373f02426554693813c931c3416bdce42f1752f581afbf39e0489c1939dc6c21721

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d9f2e0ab9f4ea87bffc3076a34387efa

    SHA1

    7a4a3099899ec5abf051e6a0f57fdfd48a0390a3

    SHA256

    0296178bc5c612b081fc484642139702d6c804dcd511f9069b4430059f1d6683

    SHA512

    3fd041c934163e35226db7f08543088775d442dc9ab97845bb1e2ffd0f189c352b3e07205730ad897cd94bb320921dd5ca23e1cb58b9de7931c69ab0a69a493c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c28d879374778868724847754a4ecfb1

    SHA1

    5a05d8763db52a3dfe2a72faf002d908d6a33e94

    SHA256

    ed226f61d30b9e705b1f869722f85d05010e7c572b78cb29ef9afd5c3ae30fdf

    SHA512

    413d3b5e3db3db64199376f867093f069b20c96884ad576a8413814a28ac6b687159a22e9b20653185f66cc6ad087ff424f70d7ac2fa578c2e981998bb966023

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b43ca157560da80a8695b36eca2fff44

    SHA1

    5dc579783b975e0b5d483a4a350d19020e92e93f

    SHA256

    ac27b01c443b3ea1662c7d786220564fbd02076c7b593f406216877632029bbd

    SHA512

    bbe867401a5658dd8adb81131ff89b623d002b61fcb89ec0fb7eb231c4ea7c10dbe5570803efcca3977f5cb4d5310471f7520633f83035e39e698897e86a3108

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    94c35e377dc2e30c6f756f34d154d4ec

    SHA1

    771db007032176374d39a6331c7d40fe0b16f292

    SHA256

    f77a3d94316d14b665795b4b159553b2fe40d2a896e0d0f044aebfbc0f439f68

    SHA512

    5ebe0a2cd5474a81d83f09e05d6f265e91c68d4d25052dd1dc731235589e489f8b7826d4dc989a4b473c1166adbffe6cebe7386cf44bdc9f408677b7d35d5a4c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    906cc314b80bc83a7916a705da553c43

    SHA1

    902f2a6cbf60e2728cc2a0351f949ac40ada32c9

    SHA256

    2ebeed5acbfc050e3f801cb68e80db6f01f26439ceb141dfa43385afafe551b2

    SHA512

    c5663e42ee42ade2f6f7d0574714482772fb90d5541117528711592804a43297cf3c5a0468fc0e3bf17df98f96536a5cd5647bbbfa79d71bde72d89beec6471e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    390e9bbaa7a8813e7421380e09dfc3e1

    SHA1

    9930c9a28843160cd3a5582f54f4c70af6c78fba

    SHA256

    ebc941ff85bc92a366cbf2cc302b2e2f60285d221277a59aedfe05f55259d1b2

    SHA512

    9399f13b24e2343914f08612721316efdbef49f8641461ae4ffaaa72dfcd569869988517a1b45363fd0ea15748a849bd0ca871ed6b2f2aa4cb8b8476b6b97fc8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    252fd4b28ff6ffdcad805cbca1ae2834

    SHA1

    d46df454d55a27e90e2eba8671be068d4ecb20ac

    SHA256

    513382e18f94450e06424d3797ab0aea4e5bd690aab463ade7c6156f65df4d03

    SHA512

    3d23c9bb2c5bf1ae3472328c0d146d374d162fd77f288364d2e6420341448f57cfbd75015fa88dac76440754d4f5547182191841dfa8c53db4572cb58dc53517

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    416b986fa43ec673095d482c186b4de5

    SHA1

    89593816cea9e06f6cdc92eb47f01e622c314933

    SHA256

    ebddefa917330fe1442f26d3514e1b5a24293e8faf1bb21bcbd04d40ed2503ff

    SHA512

    9be42d87f8d804ed3fc1c8da084fc40c2fb19910eee8a0585ecf12b9aaa08259373b85b6a94b0fb63844626726a624c00e83d14897345a317d05b6058180d6d5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    6c985557dcd9e618942e881a00fa4df2

    SHA1

    a2d94415ad41acaf9f6029e58450aeefeee1c67e

    SHA256

    8100a78cac1652f053577e34294f9b00973a3f0afb70ec5222a7711def63a87b

    SHA512

    52c0977af3777bab16dcdc7a7a1d8ec0ea5325772e68c40f7f82b434ae671f983ee7ca5d90677b9a188b00b2798c92964375614035ac15968498840f16a20cf9

  • C:\Users\Admin\AppData\Local\Temp\CabE18B.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarE25A.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b