Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
10/10/2022, 23:56
General
-
Target
3cadee91361fe4e96b078508fcca9ce806fd830a0256edb9c166b3b575e00fe9.exe
-
Size
316KB
-
MD5
4b1a332f822e5a76560a820f8cc926d0
-
SHA1
5d9f4d8bb86f89276484057493473969e5a7464a
-
SHA256
3cadee91361fe4e96b078508fcca9ce806fd830a0256edb9c166b3b575e00fe9
-
SHA512
7f99397e47392cbfc4a48dc577fd7ea82d538ea35bfc84b16d6211a94ee83c1c9359ede59a2d03bd061bfc34b94662e8a90d0e570561142e2683cee0994997f5
-
SSDEEP
6144:dPeyxTwquPwv0OrVXl7HWrE+icB8aa36OCwb7eEk8vEE+MUyA3:dPbZwBPMHXVHGbKaW60b7eX8vEIA3
Malware Config
Signatures
-
ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Loads dropped DLL 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3cadee91361fe4e96b078508fcca9ce806fd830a0256edb9c166b3b575e00fe9.exe"C:\Users\Admin\AppData\Local\Temp\3cadee91361fe4e96b078508fcca9ce806fd830a0256edb9c166b3b575e00fe9.exe"1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\71c069d7.exeC:\71c069d7.exe2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\Svchost.exeC:\Windows\SysWOW64\Svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
225KB
MD510be9a26093a6a446de4fc9b759c410b
SHA15a2ad24a3502bc32533f02044fb44f0def15513c
SHA256ac86fbb6bd701b7767d28a60769786ca6dd413785b2a5d8bed890b4d78b255b0
SHA5123ffe6b2b2ba943238880a59ba3a3562799568d0636f1b91dd0e934579e7bd66a086b45d8d6ccc8969b85c42fa382bd05fe89d1524d18bdb6cb3e03f7271dd9f2
-
Filesize
225KB
MD510be9a26093a6a446de4fc9b759c410b
SHA15a2ad24a3502bc32533f02044fb44f0def15513c
SHA256ac86fbb6bd701b7767d28a60769786ca6dd413785b2a5d8bed890b4d78b255b0
SHA5123ffe6b2b2ba943238880a59ba3a3562799568d0636f1b91dd0e934579e7bd66a086b45d8d6ccc8969b85c42fa382bd05fe89d1524d18bdb6cb3e03f7271dd9f2
-
Filesize
724B
MD5a1595124b1020ef05fc8fd86558ff5d2
SHA11b8d0c0d1aca5fa774ade01531787af663f35b02
SHA256b540484c652a029f248fd0c648fc5896b688e0af868b2a77b8a56832a9f0d92e
SHA51262e885eddd89963e81ebf26ea64092572911bc718d27c788a097d93df99fd6333682b2622d1145e4a9adbf5ad590d77537a799f8b457a868d3a69d2428c964a7
-
Filesize
225KB
MD5747ecef3bc851ae360714164035f25cf
SHA10baee203020f8c2a3f340a61e97b1182420004bb
SHA25612bed65fcebacae59487515d0d9389b45a77528bf4a9192f4e21647409dbdd25
SHA51283373165ba0aa27cb35181bec2846fa91145b7910450ad2faa19d7e252205bfd1748e71af8f881bee47a871902653f042b7259343b594279e6b7e2ed63ee6f41
-
Filesize
225KB
MD5747ecef3bc851ae360714164035f25cf
SHA10baee203020f8c2a3f340a61e97b1182420004bb
SHA25612bed65fcebacae59487515d0d9389b45a77528bf4a9192f4e21647409dbdd25
SHA51283373165ba0aa27cb35181bec2846fa91145b7910450ad2faa19d7e252205bfd1748e71af8f881bee47a871902653f042b7259343b594279e6b7e2ed63ee6f41
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
316KB
-
Filesize
292KB
-
Filesize
292KB
-
Filesize
64.0MB
-
Filesize
292KB
-
Filesize
292KB
-
Filesize
292KB
-
Filesize
292KB
-
Filesize
292KB