Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2024, 07:55

General

  • Target

    ms06040rpc/ms06040rpc(修改版)/ms06040rpc/8免费木马免杀脚本检测培训.htm

  • Size

    36KB

  • MD5

    0e198328ed663871fcf373a3cdbb3102

  • SHA1

    44c47a862eecd315c3e480a6c111dfe52c9edaf0

  • SHA256

    d5a226f453f21b8f2e20322d00b2d2af1d9c7cd91f850c4e0e18adf72348653f

  • SHA512

    9ce66337470f53203ff552b1858598b5bcb0d37f3e4cc0877aa858cb7c5e36942a2b72e0b560b0c08cae148686d455925d0951149696d64007cea365a5ff2420

  • SSDEEP

    768:n8N3RPFwgNvraFmzkf+THOpgRVHAxSJbyx06yx0HYz+x0HY8yx0Hkw7hJJqq2sz8:nQ3RXlraFmYDmsNKhJ0q2szGwkPpocM2

Score
3/10

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies Internet Explorer settings 1 TTPs 41 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ms06040rpc\ms06040rpc(修改版)\ms06040rpc\8免费木马免杀脚本检测培训.htm
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3064 CREDAT:275457 /prefetch:2
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:2916

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c4c4a6741ffe91d1bf8fd15095b40614

    SHA1

    fe9927dc5ffa87930d5b72da28250d33de92a903

    SHA256

    d78801cc6b2dd64be25773cc77089a61c2e00980617eb3a82766a524bce11ac0

    SHA512

    bac450c175710324a8fc96c7834cc79fea6936ccad65ecbce6cac03863fa100f3d55f237d7f0522a23f509ced77b4e7f5070c1b16df3ec848324f046c53335dc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    89ad963b176cb3771cdd2a9c0fb26d54

    SHA1

    d1b91874ff057c67426a031c1e1e8ac276bdfa74

    SHA256

    0091700df66b58a805967fd26da422f01564bc2a47ef312ff3a6b7e002194e22

    SHA512

    52fb9310bf109c8f504f143c1f0b648629a9c99a70b11333dec4d0e24df147118e9837c1b36b84b1f24883bfe6f0177f02498ef124e0fc6c425233b0cc6472fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0277e3908895c4c94749f5d86aecef1e

    SHA1

    7b63c56736c2a0c63ad71bf6d03356246b170bf1

    SHA256

    d6e6aa150f471c1bd0e41b018804e31e6670fb0f77fa72bf817c1f1be92ca3f5

    SHA512

    47d9e0419c1987bec954e9a3b4bc0d2f8a41c2b8e0cd4a654f8353eafe524613bdbc59e060effb050202ed6bd4e5bea7711f815d4ca55fc482186774bbc468ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    e1edf7298205d1fefe6306409a4e3fa3

    SHA1

    61580123bea0b34fc1951351ac4562d43b63c615

    SHA256

    d1eb25891ea3ad76a86b5c0dc22ee95f5351f0f33ad3eebcdc966d9c73b8fdb0

    SHA512

    35f15c7064a8e788225b2ca14b10d7d90da314bfd99dfa72af25c4c8cba22953f9268042d07b27010dc040f30320e9de758a26c447d34142acd51ecb25d1f979

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    72223735b9dada4f6422c02dcde22adc

    SHA1

    c8b74aac663c52d945381dbdffc013bfca241da9

    SHA256

    31ca9ea210271a6eef6115f90ea3fc1541d3dde30b2d4d483876301c5966e8bd

    SHA512

    213933f2fb7ced7b87faf3fa78e639a0c5005253b0560013cbedef108220997f9e72f07a163a413595897d6a8063f7e3d1f757cb955d70498a002c4d19d41a8e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7deacdabf54225e8e35a5a26fa4160bd

    SHA1

    d659f6cf03aef2f858749fdeff7441a7508eca4f

    SHA256

    37fd03493105730356a3ec9940a9616dcee1fa9942a94290eb26e2f70cbac13c

    SHA512

    af44b0a7960b8bc4cbc6aa24057e4c641cfaa9daf24b70608d066af319c03760f4196e6d2706f6032bb89cf78b442ef8097b464ad86b8c78ba39f8e538be0671

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    c5886ecb27eaeb3e5bc8c2db150432e6

    SHA1

    513fc8f17268a3c3ac8fe4493e965ee7d1bddccc

    SHA256

    94afbf22bf116440aef5f77b884d38fc2d29fb6af841e8563a08efe42a800f81

    SHA512

    87db0e9282b8ccf5c2516146cc75f6c30f3f6a96727c9405963b0295587c4924d5a9860cb4c7c40415b9049494d7bb7f16af33a2eff865e95ceaa0e870455d32

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    2ca5f08e237a43d65a330f581678b5b1

    SHA1

    2a756ac24159c602332c1a4d4854214a700a83da

    SHA256

    391006dd48592e814216b7b72673be273dd0a5034d21ebe05acdfb500a3ab73d

    SHA512

    8db1ef7d11f03d861828d6019e6e3206a448dd9cf450d01f8c062c9e2598eb2aa79c646c2699516a49cd62b32229efada9819f7c2178ec653826eff4493c34f8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    da12f5d192dd4dc829ba454b5365552b

    SHA1

    7a710dcff301f051a64ff150c2ebad30a87375f9

    SHA256

    f6feaa965ecc9770f11e6f25e66023e2c19b5883f99e2fb7bb0fe5f78c5636c3

    SHA512

    f4498a4fc603141a5dd1b1fb0449ae6f8912666ef18568153213d25a65f79216240ffe6c7e2af70ab1eb0496caf3fd9e9fced3eb6185b99d4859faa988addde3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    b7bda30cdb1e489e2735aa47c3f2a7b1

    SHA1

    bd0806467cc5320b27b68be505b941f4da25ca7f

    SHA256

    aba62cf57f84c71b012ab7b4dc9cda8410b180272d038f1df8707f4efb251b38

    SHA512

    e51de977d9dc913ce42e6e4dd5fa1d24b6a7ad912c65259302ca7f27a0cffc63a2a918bd56dece26b8c397381300b83baa94392d51993d89ab3acaaeb8c87905

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    d7def04ff42847bdc3d3b45f3bfad132

    SHA1

    076c5b9debe62c7d77778fab49b6130e5442445b

    SHA256

    942080c5764cef59fccdeb37f3131b6f983d22c59d0547df8f8ae454665ebe7c

    SHA512

    c5c7c941bfd0ec1b2ec258fa15c82fe34b12956b7a78ce9829cd2d9149b702a74ab0b45e7766bbb26d52c89fbb09b935b22e5b5416b853c54ec2240dc4db8ecf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    a4f0919c69dd58ca556b66cb42535ffe

    SHA1

    157ec2b7340d5a462f280641dcc97a2ce1d66907

    SHA256

    b93ab9170423dca8a989935469871f5a8f6c39240b12a22238c6c42dcc50ed65

    SHA512

    d4206207624feb8442cd848bed7724c77a4cd268aa5a5d0de90bef37c3ca7497e37cc0b96995093cb9726c7d68dcb292da64cf7cff38a022cca954dbd32b8725

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    7e83e044a282a96a03cb558c9169b89f

    SHA1

    b01082ff7dd5ce4bb5a736823435ca0a1789cce5

    SHA256

    472fa752f9491a8d9e2140990492e30717b9d2bd347a2d1cf0fd74a20c90e81d

    SHA512

    61267ac7972e19c960cda5b4ce2a86b4bcb3bab6460c03e5d0d8306a2002c907be31b5f7ab879d7149e779159efb7caffdb0c2f0631c22462282b3bd499f5b6a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    43f20f66ec13107d7f43d6bc732ed6e0

    SHA1

    cde492465b024c6b4f5f530e6b94109cc8812ca8

    SHA256

    3c11efce8352e5dc40fa4b6bb087d49a7d050cb959f4d6569440d610d07949e9

    SHA512

    2d2b72ec87836b3bb67278a166634c28587f7b4bf9719c33e26df8d9f35d64a32acf6f179283da6608136a34f4680daaa489ba14306d84f13a616570afa88db8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    39148ea8e3b947df6ea8394f21eb6ce1

    SHA1

    4264fd102a3ae5a3c626b9e2d3e5208ca16731e1

    SHA256

    5238eedc7384c3812fba2eb3a5392b407f2cbf77e19839af84e2d64383324ba9

    SHA512

    47e47fbe46448dffcbc393b49357e83fcb79ee5897f4a1d87cd001ef21c1d2609a22240e9609d196d21864296ee2e10c1c40cce51e1dd08a804a18f791085f4a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    0b1222c297b3b6cab2877c30e026802e

    SHA1

    4136db33dbcb9d99f53d22fe6cfd9eb69551635b

    SHA256

    999b59ec07fc3bc12bff03b5bfb90c4412ffe08055f9958b021bfd5cee0af465

    SHA512

    70f7eb850024ba146679dd4c4b7809c03592f1179f83801aedc580bff4154a248b8ed4abd2ddc8b8b3e865e40f6cd1667b42ee54da45eb18fa5b41cb528a92c3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    92e10ec5a7f9fabc0ca7093c23895798

    SHA1

    514c72f54372dd33a872c4dd2fc2281bd3272693

    SHA256

    0481e3e071cacb81c4e12446386424ef35777b072f0cbaefc4a13930cc562629

    SHA512

    0633a31820734db85580f65b6aaecb29a0184c930da70f40bec389e7c2c0100b4d6b516f38dfe09d48c0960476e19169d2a388cbfe1c8acb5013b02758a2f290

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    637f18fb831b664ff538631bff32fff2

    SHA1

    0110f583c84ddd7095b9c672bda30bec21a52a28

    SHA256

    5a3e29ebae1e833c0ebc1e426d3a2e67f5a5aaca7bb2ec29f41af2ca1a05600a

    SHA512

    86e63fdbe84bfcf3e426088404c65100cf11b0ff10b0db42822ae8d20c1b03acf022d079a8729d0a69498cd5daf26ba1d2fa73e73c24f40b85bfa3db95e18f96

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    85d3c237668e61a7214e5dd23236e070

    SHA1

    970fc0522fa62c55c234548842b47d82f3128b19

    SHA256

    d637547b028543038d616734c76c331176a896feda4564ca8fd0948eae9e09ee

    SHA512

    9f6574e46d936cbad3d4172b2faf80a0adf45306b7d508ed7182010536aebef4419035fba0f875429aeb3d3625215f85832efcf9657933b51bb47c16baff9f50

  • C:\Users\Admin\AppData\Local\Temp\Cab6BFF.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\Tar6CDD.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b