Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
10/10/2022, 23:48
Behavioral task
behavioral1
Sample
b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe
Resource
win10v2004-20220812-en
General
-
Target
b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe
-
Size
190KB
-
MD5
648d9663d42900c91dba57288855a410
-
SHA1
9bb7c1e8f9216957aaae3a261149c2cdc3581439
-
SHA256
b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67
-
SHA512
4a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c
-
SSDEEP
3072:Lz1knqa179zh9mm/Ef01f4HWK26Hj596pjBmpGm7HYPEH7eQgC/UfdoZHjSaVQs+:L5kHrzh92f0OH26D596xfnC/hZD9a9
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 6 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0012000000016741-133.dat acprotect behavioral2/files/0x0012000000016741-132.dat acprotect behavioral2/files/0x0002000000021a93-141.dat acprotect behavioral2/files/0x0002000000021a93-140.dat acprotect behavioral2/files/0x0002000000021a94-147.dat acprotect behavioral2/files/0x0002000000021a94-146.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 4744 dnlolo.exe 548 dnlolo.exe -
resource yara_rule behavioral2/files/0x000c00000002156f-135.dat upx behavioral2/files/0x000c00000002156f-137.dat upx behavioral2/memory/4412-136-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/548-145-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/files/0x000c00000002156f-142.dat upx behavioral2/memory/4284-150-0x0000000000400000-0x000000000040F000-memory.dmp upx behavioral2/memory/548-152-0x0000000000400000-0x000000000040F000-memory.dmp upx -
Loads dropped DLL 6 IoCs
pid Process 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 4744 dnlolo.exe 4744 dnlolo.exe 548 dnlolo.exe 548 dnlolo.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 548 set thread context of 4284 548 dnlolo.exe 84 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\dnlolo.exe b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe File opened for modification C:\Windows\dnlolo.exe b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2580 4284 WerFault.exe 84 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 4744 dnlolo.exe 548 dnlolo.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4744 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 81 PID 4412 wrote to memory of 4744 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 81 PID 4412 wrote to memory of 4744 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 81 PID 4412 wrote to memory of 4384 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 83 PID 4412 wrote to memory of 4384 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 83 PID 4412 wrote to memory of 4384 4412 b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe 83 PID 548 wrote to memory of 4284 548 dnlolo.exe 84 PID 548 wrote to memory of 4284 548 dnlolo.exe 84 PID 548 wrote to memory of 4284 548 dnlolo.exe 84 PID 548 wrote to memory of 4284 548 dnlolo.exe 84 PID 548 wrote to memory of 4284 548 dnlolo.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe"C:\Users\Admin\AppData\Local\Temp\b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\dnlolo.exe"C:\Windows\dnlolo.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4744
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\B3B97A~1.EXE > nul2⤵PID:4384
-
-
C:\Windows\dnlolo.exeC:\Windows\dnlolo.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵PID:4284
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 123⤵
- Program crash
PID:2580
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4284 -ip 42841⤵PID:812
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
190KB
MD5648d9663d42900c91dba57288855a410
SHA19bb7c1e8f9216957aaae3a261149c2cdc3581439
SHA256b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67
SHA5124a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c
-
Filesize
190KB
MD5648d9663d42900c91dba57288855a410
SHA19bb7c1e8f9216957aaae3a261149c2cdc3581439
SHA256b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67
SHA5124a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c
-
Filesize
190KB
MD5648d9663d42900c91dba57288855a410
SHA19bb7c1e8f9216957aaae3a261149c2cdc3581439
SHA256b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67
SHA5124a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c