Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    165s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2022, 13:35

General

  • Target

    97f56151f98b8a497d8005d5a138b83bcd12603446ee45ea01fd50a982ef619e.exe

  • Size

    114KB

  • MD5

    bafdc01ef5efc18258301a236eeb786a

  • SHA1

    351bed9b5e8f00eb27dc1c7e62188973da8bb330

  • SHA256

    97f56151f98b8a497d8005d5a138b83bcd12603446ee45ea01fd50a982ef619e

  • SHA512

    382c5c47df66ecc64bd2f188d7ff53a6edce1b6aa6007938df163913e1f1431e4819837afc4f950cd42f68af291f03695e342dd38260d29deee3288c2f61347f

  • SSDEEP

    3072:mfZ9sPhD9WAShGBoGT2B610T2vR7AzdBIb93r9outD:us5Dy0qM0T257oc3r9oSD

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 2 IoCs

    Detects file using ACProtect software.

  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97f56151f98b8a497d8005d5a138b83bcd12603446ee45ea01fd50a982ef619e.exe
    "C:\Users\Admin\AppData\Local\Temp\97f56151f98b8a497d8005d5a138b83bcd12603446ee45ea01fd50a982ef619e.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1388
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\system32\mswinsck.ocx"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:1472
    • C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Users\Admin\AppData\Local\Temp\~DFA265.tmp"
      2⤵
      • Loads dropped DLL
      • Modifies registry class
      PID:1108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\~DFA265.tmp

    Filesize

    48KB

    MD5

    73e40295ab0e0c740b114b9251042b87

    SHA1

    e057bc7de709e34e9ae666fdb713708f038af819

    SHA256

    1c208796cd09557fe2d0a375f30a2feb49b45af8661798ab0046883cd68d54fd

    SHA512

    883171d6108e1d2a62437a2a37b84b9d33b22737eaead2355bdeccf028e0fbb5491e45087f7c397f58adf4837e43fd3a410c47d78426bf90669d71025e4a6b98

  • C:\Windows\SysWOW64\mswinsck.ocx

    Filesize

    105KB

    MD5

    9484c04258830aa3c2f2a70eb041414c

    SHA1

    b242a4fb0e9dcf14cb51dc36027baff9a79cb823

    SHA256

    bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

    SHA512

    9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

  • \Users\Admin\AppData\Local\Temp\~DFA265.tmp

    Filesize

    48KB

    MD5

    73e40295ab0e0c740b114b9251042b87

    SHA1

    e057bc7de709e34e9ae666fdb713708f038af819

    SHA256

    1c208796cd09557fe2d0a375f30a2feb49b45af8661798ab0046883cd68d54fd

    SHA512

    883171d6108e1d2a62437a2a37b84b9d33b22737eaead2355bdeccf028e0fbb5491e45087f7c397f58adf4837e43fd3a410c47d78426bf90669d71025e4a6b98

  • \Windows\SysWOW64\mswinsck.ocx

    Filesize

    105KB

    MD5

    9484c04258830aa3c2f2a70eb041414c

    SHA1

    b242a4fb0e9dcf14cb51dc36027baff9a79cb823

    SHA256

    bf7e47c16d7e1c0e88534f4ef95e09d0fd821ed1a06b0d95a389b35364b63ff5

    SHA512

    9d0e9f0d88594746ba41ea4a61a53498619eda596e12d8ec37d01cfe8ceb08be13e3727c83d630a6d9e6d03066f62444bb94ea5a0d2ed9d21a270e612db532a0

  • memory/1388-54-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1388-59-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/1472-58-0x00000000768A1000-0x00000000768A3000-memory.dmp

    Filesize

    8KB