Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

1

Static

static

64jdustas73sgsf.exe

windows7_x64

1

64jdustas73sgsf.exe

windows10_x64

1

Analysis

  • max time kernel
    149s
  • max time network
    135s
  • platform
    windows7_x64
  • resource
    win7v200430
  • submitted
    09/07/2020, 14:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    64jdustas73sgsf.exe

  • Size

    239KB

  • MD5

    e39b6ba95134fed2ce020e34fce39c38

  • SHA1

    00667af154f422b28af1bf28a62d6ed186186b04

  • SHA256

    ec33d59365a0a4cbc9eca3feeb9007c5590e5ead81c6a8f0c9967a8e93ba5fe2

  • SHA512

    f5f6c722acc08ad9bd1b9bba4bf8e60da309e386b8334da1e7adaf074687643011a347bc4047bd90a90954328a8d0039ad38f2df88dc54b47284eface3bf9fa2

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Checks whether UAC is enabled 8 IoCs
  • Modifies Internet Explorer settings 1 TTPs 102 IoCs
    adwarespyware
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\64jdustas73sgsf.exe
    "C:\Users\Admin\AppData\Local\Temp\64jdustas73sgsf.exe"
    1⤵
      PID:1500
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
      1⤵
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of FindShellTrayWindow
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of WriteProcessMemory
      PID:1356
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:275457 /prefetch:2
        2⤵
        • Suspicious use of SetWindowsHookEx
        • Checks whether UAC is enabled
        PID:1856
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1356 CREDAT:537615 /prefetch:2
        2⤵
          PID:1404
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1032
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1032 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          • Modifies Internet Explorer settings
          PID:1864
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1508
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1508 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:1828
      • C:\Program Files\Internet Explorer\iexplore.exe
        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
        1⤵
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of FindShellTrayWindow
        • Checks whether UAC is enabled
        • Modifies Internet Explorer settings
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
          2⤵
          • Suspicious use of SetWindowsHookEx
          • Checks whether UAC is enabled
          PID:916

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1500-0-0x0000000000280000-0x0000000000297000-memory.dmp

        Filesize

        92KB

        Download

      • memory/1856-2-0x0000000006900000-0x0000000006923000-memory.dmp

        Filesize

        140KB

        Download