Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    52s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2022, 11:46

General

  • Target

    0063542d80ffca2bc2fcadd4c326f346b54118cf9bdb0cf28f332c50c8d8639b.exe

  • Size

    769KB

  • MD5

    1081c6e3ac1dcfd8a86223ff5c2d70a0

  • SHA1

    697ba8d7e2bb2239ba2f3ac5706a91caeff3cee9

  • SHA256

    0063542d80ffca2bc2fcadd4c326f346b54118cf9bdb0cf28f332c50c8d8639b

  • SHA512

    032fe05effdfe8bc75c55a8a8dbda75a4ed51b54a6c742f7988bd047909b7d1dbf7d288bb2816483cee35a1d6cffff6ca153992fa9ac2e0f40815d37c9af3db1

  • SSDEEP

    12288:C6iYNDsam14R0ncYv7TM3MkQge+Y5nsfBWMciXgRHarRnCyW66oLp:CZwV9R0cMHt+Y+fPcZXy5

Score
9/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0063542d80ffca2bc2fcadd4c326f346b54118cf9bdb0cf28f332c50c8d8639b.exe
    "C:\Users\Admin\AppData\Local\Temp\0063542d80ffca2bc2fcadd4c326f346b54118cf9bdb0cf28f332c50c8d8639b.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:960

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\aykF806.tmp

    Filesize

    172KB

    MD5

    fe763c2d71419352141c77c310e600d2

    SHA1

    6bb51ebcbde9fe5556a74319b49bea37d5542d5e

    SHA256

    7fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b

    SHA512

    147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c

  • memory/960-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

    Filesize

    8KB

  • memory/960-56-0x0000000000400000-0x0000000000498000-memory.dmp

    Filesize

    608KB

  • memory/960-57-0x0000000000340000-0x00000000003B3000-memory.dmp

    Filesize

    460KB

  • memory/960-58-0x0000000000400000-0x0000000000498000-memory.dmp

    Filesize

    608KB

  • memory/960-59-0x0000000000340000-0x00000000003B3000-memory.dmp

    Filesize

    460KB