Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    18s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 23:12

General

  • Target

    5611a9384cc97076bdb676fe26c66609325ddbf74975394081ef9c6972ef060a.exe

  • Size

    9.1MB

  • MD5

    8fcce12e1b970a6f236d4aa809482c16

  • SHA1

    6d9b238ebe036cc6f08cf727eacc1974918f4192

  • SHA256

    5611a9384cc97076bdb676fe26c66609325ddbf74975394081ef9c6972ef060a

  • SHA512

    d27819cba732532998c435d5f4666f7ff1eda4b47f4f1fabab87e7c13d34f3b57cdf8d658aa17518df4cd55122473435b887f6b393ad0427d885cf67b60797d3

  • SSDEEP

    196608:dX9/OoIayrF4j4E4eOi/JxcfpD6LAJ/icslkJWX3j:toLayh4UVoxwx0y4n

Score
9/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Checks for common network interception software 1 TTPs

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 22 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • NSIS installer 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5611a9384cc97076bdb676fe26c66609325ddbf74975394081ef9c6972ef060a.exe
    "C:\Users\Admin\AppData\Local\Temp\5611a9384cc97076bdb676fe26c66609325ddbf74975394081ef9c6972ef060a.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe
      "C:\Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 564
        3⤵
        • Loads dropped DLL
        • Program crash
        PID:556

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • C:\Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\InstallerUtils.dll

    Filesize

    830KB

    MD5

    c75548677c15f7db55159c7c9645927a

    SHA1

    b09207e175c0d6e56a649ebf2f6ab8769df8b794

    SHA256

    9ce3979fef3d705cb69c7fd25fe250625f24ae5f6236b4f08e6e68c91a3a3f0e

    SHA512

    09cc9afa8602c14295e6b3bf691313f8859f2e4e7c85bf63d087673784874aab35fae993ca099be58eea5ea5d3ceb6ad406b731040952fb41052a1bafd5d6774

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\InstallerUtils.dll

    Filesize

    830KB

    MD5

    c75548677c15f7db55159c7c9645927a

    SHA1

    b09207e175c0d6e56a649ebf2f6ab8769df8b794

    SHA256

    9ce3979fef3d705cb69c7fd25fe250625f24ae5f6236b4f08e6e68c91a3a3f0e

    SHA512

    09cc9afa8602c14295e6b3bf691313f8859f2e4e7c85bf63d087673784874aab35fae993ca099be58eea5ea5d3ceb6ad406b731040952fb41052a1bafd5d6774

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\InstallerUtils.dll

    Filesize

    830KB

    MD5

    c75548677c15f7db55159c7c9645927a

    SHA1

    b09207e175c0d6e56a649ebf2f6ab8769df8b794

    SHA256

    9ce3979fef3d705cb69c7fd25fe250625f24ae5f6236b4f08e6e68c91a3a3f0e

    SHA512

    09cc9afa8602c14295e6b3bf691313f8859f2e4e7c85bf63d087673784874aab35fae993ca099be58eea5ea5d3ceb6ad406b731040952fb41052a1bafd5d6774

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\InstallerUtils.dll

    Filesize

    830KB

    MD5

    c75548677c15f7db55159c7c9645927a

    SHA1

    b09207e175c0d6e56a649ebf2f6ab8769df8b794

    SHA256

    9ce3979fef3d705cb69c7fd25fe250625f24ae5f6236b4f08e6e68c91a3a3f0e

    SHA512

    09cc9afa8602c14295e6b3bf691313f8859f2e4e7c85bf63d087673784874aab35fae993ca099be58eea5ea5d3ceb6ad406b731040952fb41052a1bafd5d6774

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\InstallerUtils.dll

    Filesize

    830KB

    MD5

    c75548677c15f7db55159c7c9645927a

    SHA1

    b09207e175c0d6e56a649ebf2f6ab8769df8b794

    SHA256

    9ce3979fef3d705cb69c7fd25fe250625f24ae5f6236b4f08e6e68c91a3a3f0e

    SHA512

    09cc9afa8602c14295e6b3bf691313f8859f2e4e7c85bf63d087673784874aab35fae993ca099be58eea5ea5d3ceb6ad406b731040952fb41052a1bafd5d6774

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\InstallerUtils.dll

    Filesize

    830KB

    MD5

    c75548677c15f7db55159c7c9645927a

    SHA1

    b09207e175c0d6e56a649ebf2f6ab8769df8b794

    SHA256

    9ce3979fef3d705cb69c7fd25fe250625f24ae5f6236b4f08e6e68c91a3a3f0e

    SHA512

    09cc9afa8602c14295e6b3bf691313f8859f2e4e7c85bf63d087673784874aab35fae993ca099be58eea5ea5d3ceb6ad406b731040952fb41052a1bafd5d6774

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\InstallerUtils2.dll

    Filesize

    108KB

    MD5

    9400d44946b264e3e5793a8952a16b1a

    SHA1

    d4b6001391026a3fd3d75c427803737c7a609dcc

    SHA256

    be636ee73a51084ddab13aa26b7246b1a6c1d787d5ff4e01246b7731c9aa8f4f

    SHA512

    ed523eefb951fdb69a3c89af8070a266831b4effe1003a8e6b9f7c4bc0430437154dd77e7d96a0749f51d10f6cd2be6e3bc991a64c3ee4208a142f4ee1d34505

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\StdUtils.dll

    Filesize

    14KB

    MD5

    21010df9bc37daffcc0b5ae190381d85

    SHA1

    a8ba022aafc1233894db29e40e569dfc8b280eb9

    SHA256

    0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

    SHA512

    95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\UserInfo.dll

    Filesize

    4KB

    MD5

    7579ade7ae1747a31960a228ce02e666

    SHA1

    8ec8571a296737e819dcf86353a43fcf8ec63351

    SHA256

    564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

    SHA512

    a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\md5dll.dll

    Filesize

    6KB

    MD5

    0745ff646f5af1f1cdd784c06f40fce9

    SHA1

    bf7eba06020d7154ce4e35f696bec6e6c966287f

    SHA256

    fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

    SHA512

    8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\md5dll.dll

    Filesize

    6KB

    MD5

    0745ff646f5af1f1cdd784c06f40fce9

    SHA1

    bf7eba06020d7154ce4e35f696bec6e6c966287f

    SHA256

    fbed2f1160469f42ce97c33ad558201b2b43e3020257f9b2259e3ce295317a70

    SHA512

    8d31627c719e788b5d0f5f34d4cb175989eaa35aa3335c98f2ba7902c8ae01b23de3ccb9c6eb95945f0b08ef74d456f9f22ca7539df303e1df3f6a7e67b358da

  • \Users\Admin\AppData\Local\Temp\nse9254.tmp\nsisos.dll

    Filesize

    5KB

    MD5

    69806691d649ef1c8703fd9e29231d44

    SHA1

    e2193fcf5b4863605eec2a5eb17bf84c7ac00166

    SHA256

    ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6

    SHA512

    5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\Evkbsiulwjcv.exe

    Filesize

    9.0MB

    MD5

    3af44d203712fa38c9a2b52c50f7b0cf

    SHA1

    1bd4cd890f56f99e9d7007fbfca6e19939d764b2

    SHA256

    47be4b4bba591be0c14801584962b297d0c43b52553a8a8d4f822b68094d2f7f

    SHA512

    150c4ee867d2c54e3e99d7d59d771d680ead3f16d5a9120479bd8afcbc5441699e26ab5ffa680b8ed32acfead21d8ba73ff5f2ebe0b4ef6b47f18185534ae3e8

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\StdUtils.dll

    Filesize

    14KB

    MD5

    21010df9bc37daffcc0b5ae190381d85

    SHA1

    a8ba022aafc1233894db29e40e569dfc8b280eb9

    SHA256

    0ebd62de633fa108cf18139be6778fa560680f9f8a755e41c6ab544ab8db5c16

    SHA512

    95d3dbba6eac144260d5fcc7fcd5fb3afcb59ae62bd2eafc5a1d2190e9b44f8e125290d62fef82ad8799d0072997c57b2fa8a643aba554d0a82bbd3f8eb1403e

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\System.dll

    Filesize

    11KB

    MD5

    00a0194c20ee912257df53bfe258ee4a

    SHA1

    d7b4e319bc5119024690dc8230b9cc919b1b86b2

    SHA256

    dc4da2ccadb11099076926b02764b2b44ad8f97cd32337421a4cc21a3f5448f3

    SHA512

    3b38a2c17996c3b77ebf7b858a6c37415615e756792132878d8eddbd13cb06710b7da0e8b58104768f8e475fc93e8b44b3b1ab6f70ddf52edee111aaf5ef5667

  • \Users\Admin\AppData\Local\Temp\nst7265.tmp\WrapperUtils.dll

    Filesize

    57KB

    MD5

    d0feaad980fe7da624b958ca67ff0fed

    SHA1

    ea61ec3cf247b807966ec32c6277e72f28127976

    SHA256

    33c152a934963437410b560f17fcf0a24a7f2059d829155bbc7738a2e30c0451

    SHA512

    faeb5ead3673827c1185fef0cb732c955c8ad4ae11c3680b1b22aaae3c3b6200f5f66e909ce9232320ebabeb5a186afe7f8d2d01e6918be3ae576dbf48fb11b5

  • memory/1844-78-0x00000000003E0000-0x00000000003E9000-memory.dmp

    Filesize

    36KB

  • memory/1844-82-0x00000000003E0000-0x00000000003E9000-memory.dmp

    Filesize

    36KB

  • memory/2040-54-0x0000000076691000-0x0000000076693000-memory.dmp

    Filesize

    8KB