Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
155s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 11:54
Static task
static1
Behavioral task
behavioral1
Sample
1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe
Resource
win10v2004-20220812-en
General
-
Target
1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe
-
Size
363KB
-
MD5
687d8619885451a01a9f8f7935c18b90
-
SHA1
2bbed8950a0366e58023fca3551ef980ecfd9171
-
SHA256
1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3
-
SHA512
429bd65c84deecf235f26dc902321ed474739859fe2e7d2d54a62ec1e1b6082e601448035753d9ab9b5205775beae6d7216cbacc0d11f7e3c6d366ffaadeef27
-
SSDEEP
6144:leTeMrQeDeeeeeeeeeeeeeeehk8ILKc4S8N7js4MCBLH79rWvEODjS8vS4p7WeB8:pMtEhljsFCbivhvapq3/NzY
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000b000000022e50-132.dat acprotect behavioral2/files/0x000b000000022e50-133.dat acprotect -
Loads dropped DLL 9 IoCs
pid Process 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4184 1645bbfbf6252bbf0d40b10c04622ce20779edd550439d748cdc14134d5a02a3.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
14KB
MD5254f13dfd61c5b7d2119eb2550491e1d
SHA15083f6804ee3475f3698ab9e68611b0128e22fd6
SHA256fd0e8be2135f3d326b65520383a3468c3983fa32c9c93594d986b16709d80f28
SHA512fcef8ac5bd0ee6e316dbbc128a223ba18c8bf85a8d253e0c0877af6a4f686a20b08d34e5a426e2be5045962b391b8073769253a4d9b18616febc8133ccf654f7
-
Filesize
11KB
MD500a0194c20ee912257df53bfe258ee4a
SHA1d7b4e319bc5119024690dc8230b9cc919b1b86b2
SHA256dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3
SHA5123b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9
-
Filesize
172KB
MD5685f1cbd4af30a1d0c25f252d399a666
SHA16a1b978f5e6150b88c8634146f1406ed97d2f134
SHA2560e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4
SHA5126555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9