Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

bc6ea3e906...1a.exe

windows7-x64

8

bc6ea3e906...1a.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    43s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 07:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe

  • Size

    412KB

  • MD5

    09128909376c75f71f2b0a8a009d834f

  • SHA1

    f664a49af4dd77a43b569c03b97442cbb71033f6

  • SHA256

    bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a

  • SHA512

    1ea8f01a18b3111f2c2e3302fadd423058c8f79e4071bfbc873047ee7f4a0c2dcdaa9d9228e35a78484f8b1f4bab8b70eb76400e21b9685017c669701a9825e7

  • SSDEEP

    6144:g8f6p0X4qumAxSRLnoPhL20gKc1ilJPZNkCLNr3Kr/u2x58uncuCKWYyYCcFV4ry:qp06UI9gKcaLLSdCKqYCemfxDIz

Score
8/10

Malware Config

Signatures

  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe
    "C:\Users\Admin\AppData\Local\Temp\bc6ea3e906c1be74e22eb3a0d5f078861adf25160f8748f07ee5807e8c8fb51a.exe"
    1⤵
    • Drops file in Drivers directory
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1760
    • \??\c:\program files\Realplayer\Framework\skipto.exe
      "c:\program files\Realplayer\Framework\skipto.exe" "33201"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      PID:1200

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\Realplayer\Framework\skipto.exe
    Filesize

    412KB

    MD5

    0ce9a8279c3a458a151b645f65e81b77

    SHA1

    057c707b7c7d7828e775cd8b3e88d509c2182547

    SHA256

    841305c84d2001f303f553e9f63db7d40332d3304c79639fc861df7fc18ab2be

    SHA512

    aad3575a44fd259d77a434b51059a0253a19e8b0ce854e737bc1f93782f3aba7e8dbe03ac4ab9ff7c46f0b1e67a5e04cf33a704d556e0250a4f1ad00fbeb8f3d

    Download Submit

  • \Program Files\Realplayer\Framework\skipto.exe
    Filesize

    412KB

    MD5

    0ce9a8279c3a458a151b645f65e81b77

    SHA1

    057c707b7c7d7828e775cd8b3e88d509c2182547

    SHA256

    841305c84d2001f303f553e9f63db7d40332d3304c79639fc861df7fc18ab2be

    SHA512

    aad3575a44fd259d77a434b51059a0253a19e8b0ce854e737bc1f93782f3aba7e8dbe03ac4ab9ff7c46f0b1e67a5e04cf33a704d556e0250a4f1ad00fbeb8f3d

    Download Submit

  • \Program Files\Realplayer\Framework\skipto.exe
    Filesize

    412KB

    MD5

    0ce9a8279c3a458a151b645f65e81b77

    SHA1

    057c707b7c7d7828e775cd8b3e88d509c2182547

    SHA256

    841305c84d2001f303f553e9f63db7d40332d3304c79639fc861df7fc18ab2be

    SHA512

    aad3575a44fd259d77a434b51059a0253a19e8b0ce854e737bc1f93782f3aba7e8dbe03ac4ab9ff7c46f0b1e67a5e04cf33a704d556e0250a4f1ad00fbeb8f3d

    Download Submit

  • memory/1760-54-0x0000000075931000-0x0000000075933000-memory.dmp

    Filesize

    8KB

    Download