Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
13/10/2024, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe
Resource
win10v2004-20241007-en
General
-
Target
0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe
-
Size
693KB
-
MD5
a833fed032353669948d51551223ec40
-
SHA1
7f652aa1566ea69b2b3e39d67b4e0eff8ee1eca0
-
SHA256
0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832
-
SHA512
0d615a58d596e9004e898e9289bbd3954673c24b8e0f2d567a4fae2d0a012947aa980ad579acc53bae8ce5c370e940ea26560b91e1952523cd732723b109fb33
-
SSDEEP
12288:YKuwXR6O38ZGljsyeUtGsxWBm9Qb6ftvlNegqYwvcDO+hqRyhkWY2W9VgjIRX:YKrhdreoiQT/vYkDO+4Ryhm2W/gmX
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0005000000004ed7-1496.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 3480 lvxinyan.exe -
Loads dropped DLL 64 IoCs
pid Process 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lvxinyan = "C:\\Program Files (x86)\\baidongyi\\lvxinyan.exe /s1" 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qiaolanao = "C:\\Program Files (x86)\\\\qiaolanao.exe /s3" 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe -
resource yara_rule behavioral1/memory/2572-1495-0x0000000002A60000-0x0000000002A72000-memory.dmp upx behavioral1/files/0x0005000000004ed7-1496.dat upx behavioral1/memory/2572-1499-0x0000000002A60000-0x0000000002A72000-memory.dmp upx -
Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\baidongyi\installer.log 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe File opened for modification C:\Program Files (x86)\baidongyi\lvxinyan.ini 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe File created C:\Program Files (x86)\baidongyi\lvxinyanuninst.exe 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe File created C:\Program Files (x86)\baidongyi\lvxinyan.htm 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe File opened for modification C:\Program Files (x86)\baidongyi\lvxinyan.ini lvxinyan.exe File created C:\Program Files (x86)\baidongyi\lvxinyan.exe 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lvxinyan.exe -
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" lvxinyan.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.hao123.com/?tn=98718223_hao_pg" 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main lvxinyan.exe Key created \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch lvxinyan.exe -
Modifies Internet Explorer start page 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\start page = "http://www.hao123.com/?tn=98718223_hao_pg" 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe -
Suspicious use of FindShellTrayWindow 21 IoCs
pid Process 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe -
Suspicious use of SendNotifyMessage 21 IoCs
pid Process 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3480 lvxinyan.exe 3480 lvxinyan.exe 3480 lvxinyan.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2572 wrote to memory of 3480 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 32 PID 2572 wrote to memory of 3480 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 32 PID 2572 wrote to memory of 3480 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 32 PID 2572 wrote to memory of 3480 2572 0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe"C:\Users\Admin\AppData\Local\Temp\0a2f609e558514fd2e530c648eaed2001096fd35d3691f5f7b287fe88125c832N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Program Files (x86)\baidongyi\lvxinyan.exe"C:\Program Files (x86)\baidongyi\lvxinyan.exe" /s1w2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD52ec4c785c1fbb3b87fea8362957041bf
SHA18879d682463f89bc865230362d91a11e7cdb42fe
SHA2564e2b4b9a7677875bcf9242e4d96653491e5071e4bdd1bad0e5d4953b891aa748
SHA5129a992e23c14e1ce18e0dcb2a68b336cf4bf901e7ba8e225220686769633178a10e9287a7063dd748b04d8cef11c7060b86d790b7d4cc2b7e70ff0b61f5b4f371
-
Filesize
104B
MD5cb12101aa8cc119798f42d300bc73b72
SHA1a45452fcfb99a5d4f4d79d2a95de0838cdf722b8
SHA256d44a46465f04469a30b60012a2cdd1df854cc6b1ca2a7edee87e97114a510f5f
SHA512ed0115b53d38db3a009c169178c11630f543ba2fa1d55515c60d70738150edac34672e2235f730024df74dffe64b0b4424397c1cd4e7591b6b03026cd08ddf2b
-
Filesize
96KB
MD5156add805fa8888c0f744566a73b60fe
SHA120d3a02a1b396b66d81a23e010e9cd3dc579ac92
SHA2564ce7efe0a9983fc43081d9f9769d5f47f527196d87fe708552d7f2cb1d2ebdb3
SHA5121f64129e61d9611021a8fcbfb61ba39fbc97a06bcf27334b92ca9a3748dbb96178453f51834728be6fbcf4d4c90e802885a2ab30df4bfe15c67f41ba465f8e93
-
Filesize
20KB
MD550fdadda3e993688401f6f1108fabdb4
SHA104a9ae55d0fb726be49809582cea41d75bf22a9a
SHA2566d6ddc0d2b7d59eb91be44939457858ced5eb23cf4aa93ef33bb600eb28de6f6
SHA512e9628870feea8c3aaefe22a2af41cf34b1c1778c4a0e81d069f50553ce1a23f68a0ba74b296420b2be92425d4995a43e51c018c2e8197ec2ec39305e87c56be8
-
Filesize
21KB
MD5ab467b8dfaa660a0f0e5b26e28af5735
SHA1596abd2c31eaff3479edf2069db1c155b59ce74d
SHA256db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73
SHA5127d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301
-
Filesize
10KB
MD532465a07028b927b22c38e642c2cb836
SHA1309cac412b2ecf6a36f6e989c828afcdd8c7a6e4
SHA256eda545d4dcb37098a90fce9692d5094bb56897f04eff6d40e3dedd122a4d1292
SHA5129d886a722bbbb5d8d77e97d256057fe685f1932042257a8382e13548fe835d01c64de65e2b5ad2c2ff99692b14c924e6ddb84797f6224f1772e8699b421e6aff