Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

877edd60f9...0e.exe

windows7-x64

9

877edd60f9...0e.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    159s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/11/2022, 19:13

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    877edd60f96153144b017308ac03fdbf498ec89e286d0308db9e95b2c5cfd00e.exe

  • Size

    20.6MB

  • MD5

    6c23bbe1cc5b0a193e18d7d99454c8f5

  • SHA1

    5b1dd830a1e594e67b76af22d2f40fe52ae2f9dc

  • SHA256

    877edd60f96153144b017308ac03fdbf498ec89e286d0308db9e95b2c5cfd00e

  • SHA512

    b7883c8e970a513b3276f3a3cf6a7a6bcf78b4ecc8bcc7922ffb2a8b45ee11dba8cf92862bc5aacab71934ea771d1802ab3bb0b5ae5bf11fc4ea360197cfe64a

  • SSDEEP

    393216:HOcljBW9vW717JKyjtbUov/djFvJlcZyrvya25MSvjo5/boeBtvWCTj7R7Q4n:HxfWw/tAS/dZRlFrvIMSvuVTvv7R7P

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\877edd60f96153144b017308ac03fdbf498ec89e286d0308db9e95b2c5cfd00e.exe
    "C:\Users\Admin\AppData\Local\Temp\877edd60f96153144b017308ac03fdbf498ec89e286d0308db9e95b2c5cfd00e.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:2844
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1596
      2⤵
      • Program crash
      PID:4408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 1596
      2⤵
      • Program crash
      PID:4392
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2844 -ip 2844
    1⤵
      PID:4536
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 2844 -ip 2844
      1⤵
        PID:1636

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\190675\MyNsisSkin.dll
        Filesize

        324KB

        MD5

        c42575c6e2e273c04eb7bc3e4119e337

        SHA1

        658e3d042e28196a321ee6446b9e6845d5478abc

        SHA256

        9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736

        SHA512

        b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\190675\MyNsisSkin.dll
        Filesize

        324KB

        MD5

        c42575c6e2e273c04eb7bc3e4119e337

        SHA1

        658e3d042e28196a321ee6446b9e6845d5478abc

        SHA256

        9f8c4e9ae3d8b764f860b19024ce077a26758d79eeed309a475fa152b7a1f736

        SHA512

        b1743d6804685da6c8ea2cea2d91c2f98e2e2ff9eaeccc7d873f1f90eb58f43c50d17b9acb309e71eb94c3b38f5dcc6736d2f0fc2c1a089eae4cca8d4743c308

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\ButtonEvent.dll
        Filesize

        4KB

        MD5

        fad9d09fc0267e8513b8628e767b2604

        SHA1

        bea76a7621c07b30ed90bedef4d608a5b9e15300

        SHA256

        5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

        SHA512

        b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\ButtonEvent.dll
        Filesize

        4KB

        MD5

        fad9d09fc0267e8513b8628e767b2604

        SHA1

        bea76a7621c07b30ed90bedef4d608a5b9e15300

        SHA256

        5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

        SHA512

        b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\MyNsisExtend.dll
        Filesize

        536KB

        MD5

        ae20c78878bffd789a4f900d420a47fd

        SHA1

        166bb9311a99a4bb42dcb9337e704e0248ca8f58

        SHA256

        7690f9653732bf3d8ec0b0a89eaf6763171864d23bb41971e5b9649bbea80b60

        SHA512

        c0a9b177ca962e5fcd308c49e2f71afdb7d9498ef80547b2febece9765df6bb6f0d0623518aff22bf908189f26a8e1fb9aa326e9790501465d9e985f9993595b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\MyNsisExtend.dll
        Filesize

        536KB

        MD5

        ae20c78878bffd789a4f900d420a47fd

        SHA1

        166bb9311a99a4bb42dcb9337e704e0248ca8f58

        SHA256

        7690f9653732bf3d8ec0b0a89eaf6763171864d23bb41971e5b9649bbea80b60

        SHA512

        c0a9b177ca962e5fcd308c49e2f71afdb7d9498ef80547b2febece9765df6bb6f0d0623518aff22bf908189f26a8e1fb9aa326e9790501465d9e985f9993595b

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\System.dll
        Filesize

        11KB

        MD5

        c17103ae9072a06da581dec998343fc1

        SHA1

        b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

        SHA256

        dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

        SHA512

        d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        c10e04dd4ad4277d5adc951bb331c777

        SHA1

        b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

        SHA256

        e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

        SHA512

        853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\nsDialogs.dll
        Filesize

        9KB

        MD5

        c10e04dd4ad4277d5adc951bb331c777

        SHA1

        b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

        SHA256

        e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

        SHA512

        853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\nsRandom.dll
        Filesize

        21KB

        MD5

        ab467b8dfaa660a0f0e5b26e28af5735

        SHA1

        596abd2c31eaff3479edf2069db1c155b59ce74d

        SHA256

        db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

        SHA512

        7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\nss572A.tmp\nsRandom.dll
        Filesize

        21KB

        MD5

        ab467b8dfaa660a0f0e5b26e28af5735

        SHA1

        596abd2c31eaff3479edf2069db1c155b59ce74d

        SHA256

        db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

        SHA512

        7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

        Download Submit

      • memory/2844-138-0x0000000000461000-0x00000000004A2000-memory.dmp

        Filesize

        260KB

        Download

      • memory/2844-135-0x0000000000460000-0x0000000000472000-memory.dmp

        Filesize

        72KB

        Download

      • memory/2844-139-0x0000000000460000-0x00000000004B3000-memory.dmp

        Filesize

        332KB

        Download

      • memory/2844-142-0x00000000031E0000-0x000000000326B000-memory.dmp

        Filesize

        556KB

        Download

      • memory/2844-146-0x0000000003D11000-0x0000000003D13000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2844-149-0x0000000000460000-0x0000000000472000-memory.dmp

        Filesize

        72KB

        Download