Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 09:36

General

  • Target

    2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe

  • Size

    17.8MB

  • MD5

    541c1ae225d8c394a34c3ae092300139

  • SHA1

    3abffda166a2de105257327836f9258f8729acc1

  • SHA256

    2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353

  • SHA512

    92c6349feee6d952c8284741aca7cf5045fc3d4813fd59edb9161fe335c030fd6ce7a954b9513c6f628e043588908036ea8bcbede3d91827d7e1d21401a4d53d

  • SSDEEP

    393216:4ET+xwnovgTgjCDblmaMD5K7yEPpiswoYvgzpxVEH:4ET6gTga6K7yEPsloWgzY

Score
9/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe
    "C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1528
    • C:\Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp" /SL5="$80124,18201819,56832,C:\Users\Admin\AppData\Local\Temp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:596

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

    Filesize

    702KB

    MD5

    e470dc0989b8713ea215450228e0c714

    SHA1

    f2df3fd29919421a9f55f471d9fa70aea3751f59

    SHA256

    838cb7d51005265c61f14d9f22281903a8bd8b0bac134b9ee0cb42dcbe7d0635

    SHA512

    822ee38368a105dcd61675901aca48d0c22b5e6de45da9959322367fa41638ca792d1e8beefe226a0e5eb8bb916eb2409b76aad17f030bc7d62d4844ef06ada7

  • C:\Users\Admin\AppData\Local\Temp\nnk898B.tmp

    Filesize

    172KB

    MD5

    685f1cbd4af30a1d0c25f252d399a666

    SHA1

    6a1b978f5e6150b88c8634146f1406ed97d2f134

    SHA256

    0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

    SHA512

    6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

  • \Users\Admin\AppData\Local\Temp\is-4U0FL.tmp\_isetup\_isdecmp.dll

    Filesize

    13KB

    MD5

    a813d18268affd4763dde940246dc7e5

    SHA1

    c7366e1fd925c17cc6068001bd38eaef5b42852f

    SHA256

    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

    SHA512

    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

  • \Users\Admin\AppData\Local\Temp\is-4U0FL.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-4U0FL.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-6FIFV.tmp\2975d474e0ffb2afa2dac41f04881b1f92458d8b25e56e26ded061b55ff66353.tmp

    Filesize

    702KB

    MD5

    e470dc0989b8713ea215450228e0c714

    SHA1

    f2df3fd29919421a9f55f471d9fa70aea3751f59

    SHA256

    838cb7d51005265c61f14d9f22281903a8bd8b0bac134b9ee0cb42dcbe7d0635

    SHA512

    822ee38368a105dcd61675901aca48d0c22b5e6de45da9959322367fa41638ca792d1e8beefe226a0e5eb8bb916eb2409b76aad17f030bc7d62d4844ef06ada7

  • \Users\Admin\AppData\Local\Temp\nnk898B.tmp

    Filesize

    172KB

    MD5

    685f1cbd4af30a1d0c25f252d399a666

    SHA1

    6a1b978f5e6150b88c8634146f1406ed97d2f134

    SHA256

    0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

    SHA512

    6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

  • \Users\Admin\AppData\Local\Temp\nnk898B.tmp

    Filesize

    172KB

    MD5

    685f1cbd4af30a1d0c25f252d399a666

    SHA1

    6a1b978f5e6150b88c8634146f1406ed97d2f134

    SHA256

    0e478c95a7a07570a69e6061e7c1da9001bccad9cc454f2ed4da58824a13e0f4

    SHA512

    6555ad6b4f4f26105ca8aad64501d74519a3e091f559b4b563d6ffb20a2ddfcde65e4fe94971a9bc65e86db577f2548ca00f9920d341c8ea808b04c0947d61d9

  • memory/596-70-0x0000000001ED0000-0x0000000001F43000-memory.dmp

    Filesize

    460KB

  • memory/1528-60-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1528-58-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1528-59-0x0000000000360000-0x00000000003D3000-memory.dmp

    Filesize

    460KB

  • memory/1528-56-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB

  • memory/1528-55-0x00000000753D1000-0x00000000753D3000-memory.dmp

    Filesize

    8KB

  • memory/1528-71-0x0000000000400000-0x0000000000416000-memory.dmp

    Filesize

    88KB