Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
256s -
max time network
339s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26/11/2022, 00:38
Static task
static1
Behavioral task
behavioral1
Sample
5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe
Resource
win7-20221111-en
General
-
Target
5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe
-
Size
980KB
-
MD5
8137a72f3f36423cdc6419298687413a
-
SHA1
cad51e28355529979185aafd707f91a916769e67
-
SHA256
5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62
-
SHA512
4e5df6d6e9ef2050d829ff74b667d4289079630efb9e1ad38baad1e3feb6a7263e183a8c046a59a1dc20dfa83b94272f1a61238b121f19e42a229b5465b133b7
-
SSDEEP
24576:ggxUQl8rXnmwXLDcXP489kqo6jd24//xSg/N4qXn/gnEbV:g9mwXPcXP4YkqmYeqX/gnEbV
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x0006000000016d42-81.dat acprotect -
Executes dropped EXE 3 IoCs
pid Process 320 dest_installer_java_English.exe 788 dest_installer_java_English.exe 1428 dest_installer_java_English.exe -
resource yara_rule behavioral1/files/0x0006000000016d42-81.dat upx behavioral1/memory/1428-84-0x0000000002F50000-0x0000000002F5C000-memory.dmp upx behavioral1/memory/1428-86-0x0000000002F50000-0x0000000002F5C000-memory.dmp upx -
Loads dropped DLL 16 IoCs
pid Process 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 320 dest_installer_java_English.exe 320 dest_installer_java_English.exe 788 dest_installer_java_English.exe 788 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe 1428 dest_installer_java_English.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dest_installer_java_English.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
NSIS installer 7 IoCs
resource yara_rule behavioral1/files/0x00090000000131aa-55.dat nsis_installer_2 behavioral1/files/0x00090000000131aa-57.dat nsis_installer_2 behavioral1/files/0x00090000000131aa-59.dat nsis_installer_2 behavioral1/files/0x00090000000131aa-61.dat nsis_installer_2 behavioral1/files/0x00090000000131aa-63.dat nsis_installer_2 behavioral1/files/0x00090000000131aa-66.dat nsis_installer_2 behavioral1/files/0x00090000000131aa-68.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 672 wrote to memory of 320 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 28 PID 672 wrote to memory of 320 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 28 PID 672 wrote to memory of 320 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 28 PID 672 wrote to memory of 320 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 28 PID 672 wrote to memory of 320 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 28 PID 672 wrote to memory of 320 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 28 PID 672 wrote to memory of 320 672 5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe 28 PID 320 wrote to memory of 788 320 dest_installer_java_English.exe 29 PID 320 wrote to memory of 788 320 dest_installer_java_English.exe 29 PID 320 wrote to memory of 788 320 dest_installer_java_English.exe 29 PID 320 wrote to memory of 788 320 dest_installer_java_English.exe 29 PID 320 wrote to memory of 788 320 dest_installer_java_English.exe 29 PID 320 wrote to memory of 788 320 dest_installer_java_English.exe 29 PID 320 wrote to memory of 788 320 dest_installer_java_English.exe 29 PID 788 wrote to memory of 1428 788 dest_installer_java_English.exe 30 PID 788 wrote to memory of 1428 788 dest_installer_java_English.exe 30 PID 788 wrote to memory of 1428 788 dest_installer_java_English.exe 30 PID 788 wrote to memory of 1428 788 dest_installer_java_English.exe 30 PID 788 wrote to memory of 1428 788 dest_installer_java_English.exe 30 PID 788 wrote to memory of 1428 788 dest_installer_java_English.exe 30 PID 788 wrote to memory of 1428 788 dest_installer_java_English.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe"C:\Users\Admin\AppData\Local\Temp\5f856e87b278381fa322d71a6a0c963fb4c0990aca57be099e928b0bf4e02e62.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\dest_installer_java_English.exeC:\Users\Admin\AppData\Local\Temp\dest_installer_java_English.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\dest_installer_java_English.exeC:\Users\Admin\AppData\Local\Temp\dest_installer_java_English.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\dest_installer_java_English.exeC:\Users\Admin\AppData\Local\Temp\dest_installer_java_English.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1428
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823KB
MD5553fb4f2eb773ad756e0361ffc2a59a3
SHA1f918d6cfbd83e27fdb3b8bb86521bd639247e8be
SHA2562d243bf9a5c7d4ac9683e56a8263a55effe4c3ff167440d3e260f2ad3112bf57
SHA5124405d8fba14c2368708dc21b82bd24c7b4b53e17cb790ce9bfcae2d384dc5dcd38a21c988f0c723b5a3cad5a429932e68977663c36aaf93b44eda3d3323e5cb1
-
Filesize
823KB
MD5553fb4f2eb773ad756e0361ffc2a59a3
SHA1f918d6cfbd83e27fdb3b8bb86521bd639247e8be
SHA2562d243bf9a5c7d4ac9683e56a8263a55effe4c3ff167440d3e260f2ad3112bf57
SHA5124405d8fba14c2368708dc21b82bd24c7b4b53e17cb790ce9bfcae2d384dc5dcd38a21c988f0c723b5a3cad5a429932e68977663c36aaf93b44eda3d3323e5cb1
-
Filesize
823KB
MD5553fb4f2eb773ad756e0361ffc2a59a3
SHA1f918d6cfbd83e27fdb3b8bb86521bd639247e8be
SHA2562d243bf9a5c7d4ac9683e56a8263a55effe4c3ff167440d3e260f2ad3112bf57
SHA5124405d8fba14c2368708dc21b82bd24c7b4b53e17cb790ce9bfcae2d384dc5dcd38a21c988f0c723b5a3cad5a429932e68977663c36aaf93b44eda3d3323e5cb1
-
Filesize
823KB
MD5553fb4f2eb773ad756e0361ffc2a59a3
SHA1f918d6cfbd83e27fdb3b8bb86521bd639247e8be
SHA2562d243bf9a5c7d4ac9683e56a8263a55effe4c3ff167440d3e260f2ad3112bf57
SHA5124405d8fba14c2368708dc21b82bd24c7b4b53e17cb790ce9bfcae2d384dc5dcd38a21c988f0c723b5a3cad5a429932e68977663c36aaf93b44eda3d3323e5cb1
-
Filesize
823KB
MD5553fb4f2eb773ad756e0361ffc2a59a3
SHA1f918d6cfbd83e27fdb3b8bb86521bd639247e8be
SHA2562d243bf9a5c7d4ac9683e56a8263a55effe4c3ff167440d3e260f2ad3112bf57
SHA5124405d8fba14c2368708dc21b82bd24c7b4b53e17cb790ce9bfcae2d384dc5dcd38a21c988f0c723b5a3cad5a429932e68977663c36aaf93b44eda3d3323e5cb1
-
Filesize
823KB
MD5553fb4f2eb773ad756e0361ffc2a59a3
SHA1f918d6cfbd83e27fdb3b8bb86521bd639247e8be
SHA2562d243bf9a5c7d4ac9683e56a8263a55effe4c3ff167440d3e260f2ad3112bf57
SHA5124405d8fba14c2368708dc21b82bd24c7b4b53e17cb790ce9bfcae2d384dc5dcd38a21c988f0c723b5a3cad5a429932e68977663c36aaf93b44eda3d3323e5cb1
-
Filesize
823KB
MD5553fb4f2eb773ad756e0361ffc2a59a3
SHA1f918d6cfbd83e27fdb3b8bb86521bd639247e8be
SHA2562d243bf9a5c7d4ac9683e56a8263a55effe4c3ff167440d3e260f2ad3112bf57
SHA5124405d8fba14c2368708dc21b82bd24c7b4b53e17cb790ce9bfcae2d384dc5dcd38a21c988f0c723b5a3cad5a429932e68977663c36aaf93b44eda3d3323e5cb1
-
Filesize
25KB
MD50f26c6d34d3841e93145dd00d0175651
SHA157b068569d0eb2336503beed87589629ab2a6f1f
SHA2560cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741
SHA51272785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5
-
Filesize
62KB
MD5a990de9edf0145ca5b01761978f49432
SHA11415f5d123dcc03f286548607bb8238826cae858
SHA256338187c9d996921e45efbbc6d558f75d2eed32fb73cfd2a14189ec039091fc65
SHA51232541e89523dfbbb891a215c1e7261d83a79db5ac3cea711c48f7525e98988955716a86a2ecd0264f04a36c8c8f031af57bd7a16496b3b2fcce055d1264d22de
-
Filesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
Filesize
80KB
MD54bf7db111acfa7c28ad36606107b3322
SHA16f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA256bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
SHA5120a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
-
Filesize
11KB
MD57292b642bd958aeb7fd7cfd19e45b068
SHA119a800620d041634abae5b5d096cb0e87ce4c188
SHA25690f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
-
Filesize
10KB
MD57e3c808299aa2c405dffa864471ddb7f
SHA1b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA25691c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
SHA512599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
-
Filesize
4KB
MD5d02a497be5f89c44827f142c4662f591
SHA138f83ccbac11de069df0e1cd79a6fdf7f006516c
SHA2566d29dfd24695535b5973d8261d93373603ceaae03ab97662fe1b3dcc47d18226
SHA51281c87f9d56a8ab7703a4effd3ba7b982b6765ecbdc0dbb1c595f549c4310a5db57dcdc38929eafe56983ea8cefc0b572c3faf82a4b62eb7c564b05550215f1c1
-
Filesize
11KB
MD50a29e1b270ccea61aba7d7cdd10e0388
SHA176bf03361bcaef475ffb864bc1903c9bcaac7b44
SHA25667328334d53e7c0c52c23ef5febeb1ab34d87ab7699868a9f547e5b0db4fdceb
SHA512d024407b0852155c225852e6dd1a5440241a16c4b54a408606318ad142381ebf51bc8db09a4d175369619aaac2224311914892d23f763f7b533a6b664b93cf7c
-
Filesize
193KB
MD5e390287499549de31da007f7f0ae4d10
SHA1a8c6caebb151d60ea56f4c96a7194c0e5f076692
SHA256b2e3b0e8d6c3fd23dc7d94fccc5151f07bf2e59271431268a58b5e99074b825b
SHA5126c393bca7ea74747917e65f2e5e4822f034ef60defa5f3232b8f9a731ac8e00cffee3d44ab817f3986739b685506e0027647de50b3534e3436ca569d0c25b474
-
Filesize
255KB
MD5fceee0026aafd237afdb4aea4ecd3557
SHA13e10da57143599eae915a688178abada78b8d82b
SHA25685db1e17c0fad08d9732405e781cda1e1613ace31c540a6e559cd8777df2c62c
SHA5129c974918c8afec8d8a58fc1239f269544b9dfe867459bb61901462f56f71a3dd574d3b2263dd14b99ff8a23c8096c408be3620785fd4476b975a43b999f559f2
-
Filesize
6KB
MD5ebc5bb904cdac1c67ada3fa733229966
SHA13c6abfa0ddef7f3289f38326077a5041389b15d2
SHA2563eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
SHA512fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
-
Filesize
62KB
MD5a990de9edf0145ca5b01761978f49432
SHA11415f5d123dcc03f286548607bb8238826cae858
SHA256338187c9d996921e45efbbc6d558f75d2eed32fb73cfd2a14189ec039091fc65
SHA51232541e89523dfbbb891a215c1e7261d83a79db5ac3cea711c48f7525e98988955716a86a2ecd0264f04a36c8c8f031af57bd7a16496b3b2fcce055d1264d22de
-
Filesize
62KB
MD5a990de9edf0145ca5b01761978f49432
SHA11415f5d123dcc03f286548607bb8238826cae858
SHA256338187c9d996921e45efbbc6d558f75d2eed32fb73cfd2a14189ec039091fc65
SHA51232541e89523dfbbb891a215c1e7261d83a79db5ac3cea711c48f7525e98988955716a86a2ecd0264f04a36c8c8f031af57bd7a16496b3b2fcce055d1264d22de