Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    159s
  • max time network
    219s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2022, 02:19 UTC

General

  • Target

    4ae1a8692d35e0ad5b55ad3be0803eae17486845719490f2fd3b2735aa9ce969.exe

  • Size

    4.5MB

  • MD5

    16aa72152eb85cebafe57bbfa47f42a4

  • SHA1

    5fa1e1cfaed432ad34958826f3092da5d92592e3

  • SHA256

    4ae1a8692d35e0ad5b55ad3be0803eae17486845719490f2fd3b2735aa9ce969

  • SHA512

    d936943535e119fab1ad3250d880bc76c0e4ee4a184713997021aad6628171a17da75e4a1aad643e53bc4d22a42e98910e32b37e0e75ab168093cd0b89142738

  • SSDEEP

    98304:eiNP0Go1i9NAaOVinE+QXvSmEQvmozmy7ry5sEC5u1xzqLKzsq:FPto1P+QfJmoG5CYD2LKzR

Score
9/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ae1a8692d35e0ad5b55ad3be0803eae17486845719490f2fd3b2735aa9ce969.exe
    "C:\Users\Admin\AppData\Local\Temp\4ae1a8692d35e0ad5b55ad3be0803eae17486845719490f2fd3b2735aa9ce969.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:1840

Network

    No results found
  • 93.184.220.29:80
    322 B
    7
  • 93.184.220.29:80
    322 B
    7
  • 40.126.32.74:443
    260 B
    5
  • 104.80.225.205:443
    322 B
    7
  • 93.184.220.29:80
    260 B
    5
  • 93.184.220.29:80
    322 B
    7
No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\vsiB7D6.tmp

    Filesize

    172KB

    MD5

    685f1cbd4af30a1d0c25f252d399a666

    SHA1

    6a1b978f5e6150b88c8634146f1406ed97d2f134

    SHA256

    0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

    SHA512

    6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

  • C:\Users\Admin\AppData\Local\Temp\vsiB7D6.tmp

    Filesize

    172KB

    MD5

    685f1cbd4af30a1d0c25f252d399a666

    SHA1

    6a1b978f5e6150b88c8634146f1406ed97d2f134

    SHA256

    0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

    SHA512

    6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

  • memory/1840-132-0x0000000000400000-0x000000000084F000-memory.dmp

    Filesize

    4.3MB

  • memory/1840-135-0x00000000025F0000-0x0000000002663000-memory.dmp

    Filesize

    460KB

  • memory/1840-136-0x0000000000400000-0x000000000084F000-memory.dmp

    Filesize

    4.3MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.