Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    182s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/10/2022, 23:48

General

  • Target

    b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe

  • Size

    190KB

  • MD5

    648d9663d42900c91dba57288855a410

  • SHA1

    9bb7c1e8f9216957aaae3a261149c2cdc3581439

  • SHA256

    b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67

  • SHA512

    4a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c

  • SSDEEP

    3072:Lz1knqa179zh9mm/Ef01f4HWK26Hj596pjBmpGm7HYPEH7eQgC/UfdoZHjSaVQs+:L5kHrzh92f0OH26D596xfnC/hZD9a9

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 6 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 2 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe
    "C:\Users\Admin\AppData\Local\Temp\b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4412
    • C:\Windows\dnlolo.exe
      "C:\Windows\dnlolo.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4744
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /C del C:\Users\Admin\AppData\Local\Temp\B3B97A~1.EXE > nul
      2⤵
        PID:4384
    • C:\Windows\dnlolo.exe
      C:\Windows\dnlolo.exe
      1⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:548
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        2⤵
          PID:4284
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4284 -s 12
            3⤵
            • Program crash
            PID:2580
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4284 -ip 4284
        1⤵
          PID:812

        Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\xyiF6E8.tmp

          Filesize

          172KB

          MD5

          685f1cbd4af30a1d0c25f252d399a666

          SHA1

          6a1b978f5e6150b88c8634146f1406ed97d2f134

          SHA256

          0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

          SHA512

          6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

        • C:\Users\Admin\AppData\Local\Temp\xyiF6E8.tmp

          Filesize

          172KB

          MD5

          685f1cbd4af30a1d0c25f252d399a666

          SHA1

          6a1b978f5e6150b88c8634146f1406ed97d2f134

          SHA256

          0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

          SHA512

          6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

        • C:\Users\Admin\AppData\Local\Temp\yyiF7F1.tmp

          Filesize

          172KB

          MD5

          685f1cbd4af30a1d0c25f252d399a666

          SHA1

          6a1b978f5e6150b88c8634146f1406ed97d2f134

          SHA256

          0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

          SHA512

          6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

        • C:\Users\Admin\AppData\Local\Temp\yyiF7F1.tmp

          Filesize

          172KB

          MD5

          685f1cbd4af30a1d0c25f252d399a666

          SHA1

          6a1b978f5e6150b88c8634146f1406ed97d2f134

          SHA256

          0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

          SHA512

          6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

        • C:\Windows\Temp\ryiF8AD.tmp

          Filesize

          172KB

          MD5

          685f1cbd4af30a1d0c25f252d399a666

          SHA1

          6a1b978f5e6150b88c8634146f1406ed97d2f134

          SHA256

          0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

          SHA512

          6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

        • C:\Windows\Temp\ryiF8AD.tmp

          Filesize

          172KB

          MD5

          685f1cbd4af30a1d0c25f252d399a666

          SHA1

          6a1b978f5e6150b88c8634146f1406ed97d2f134

          SHA256

          0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

          SHA512

          6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

        • C:\Windows\dnlolo.exe

          Filesize

          190KB

          MD5

          648d9663d42900c91dba57288855a410

          SHA1

          9bb7c1e8f9216957aaae3a261149c2cdc3581439

          SHA256

          b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67

          SHA512

          4a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c

        • C:\Windows\dnlolo.exe

          Filesize

          190KB

          MD5

          648d9663d42900c91dba57288855a410

          SHA1

          9bb7c1e8f9216957aaae3a261149c2cdc3581439

          SHA256

          b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67

          SHA512

          4a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c

        • C:\Windows\dnlolo.exe

          Filesize

          190KB

          MD5

          648d9663d42900c91dba57288855a410

          SHA1

          9bb7c1e8f9216957aaae3a261149c2cdc3581439

          SHA256

          b3b97af3d7bd3398a0fa6bb757abfbb4a32261d428c8ced10139458ee6814b67

          SHA512

          4a6a6019ddb0a539cbb20b44e21ee135051675909c804d18b01391b0604f323f0a72633e28d87347cf1c022d250bc3e8220c349c5b217e62e391d7b4a9fd9c5c

        • memory/548-145-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/548-151-0x0000000000D80000-0x0000000000DF3000-memory.dmp

          Filesize

          460KB

        • memory/548-152-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/4284-150-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/4412-136-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/4412-138-0x0000000002170000-0x00000000021E3000-memory.dmp

          Filesize

          460KB

        • memory/4412-143-0x0000000002170000-0x00000000021E3000-memory.dmp

          Filesize

          460KB

        • memory/4744-144-0x0000000000770000-0x00000000007E3000-memory.dmp

          Filesize

          460KB

        • memory/4744-148-0x0000000000770000-0x00000000007E3000-memory.dmp

          Filesize

          460KB