Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

8

f2f20dcab4...e2.exe

windows7-x64

8

f2f20dcab4...e2.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    152s
  • max time network
    198s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    04/12/2022, 11:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe

  • Size

    442KB

  • MD5

    a29b558640e736db3d4bb8d8011ae22e

  • SHA1

    34c140b89cc9144f293d3c0529e282a94df23bf6

  • SHA256

    f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2

  • SHA512

    b69797b066255f7c679c3d63fda80fcc94c1e7e83703b5c829bd2bff83e232e873ff9c04376205abee29824fe7fe89ca24bbea902256bce7495fac9763d9b1e6

  • SSDEEP

    6144:DV5M4mPieHwaPSFZWERgFQuxYKgk/2MoVc+kOddfWI0s9POHbOQCStUshpwLnaRP:BvmPieRPSFQuOQ0WkD92j9Py15tFwL+

Score
8/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe
    "C:\Users\Admin\AppData\Local\Temp\f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\ProgramData\fJaDkAd24512\fJaDkAd24512.exe
      "C:\ProgramData\fJaDkAd24512\fJaDkAd24512.exe" "C:\Users\Admin\AppData\Local\Temp\f2f20dcab4a86bcd702000a74be664335650b5e8f64d83b44b64410cf79fd7e2.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:944

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\fJaDkAd24512\fJaDkAd24512.exe
    Filesize

    442KB

    MD5

    eacf685c6d38d4bb168dd7151990365b

    SHA1

    66e757e6124fe83e3f9f20c9dceec76a985bbdde

    SHA256

    62b41de1c3682b57bcb270564e4c23832028e07cccead22812b6facb27faef3f

    SHA512

    1313a3575ef62dfc764ca76d2838e210483b46ce3861083370df750ee254f1fbe9ac370e1f18e8a2a3a5c95f66da46945849a1c3ef6af41d30aa295248d3ad57

    Download Submit

  • C:\ProgramData\fJaDkAd24512\fJaDkAd24512.exe
    Filesize

    442KB

    MD5

    eacf685c6d38d4bb168dd7151990365b

    SHA1

    66e757e6124fe83e3f9f20c9dceec76a985bbdde

    SHA256

    62b41de1c3682b57bcb270564e4c23832028e07cccead22812b6facb27faef3f

    SHA512

    1313a3575ef62dfc764ca76d2838e210483b46ce3861083370df750ee254f1fbe9ac370e1f18e8a2a3a5c95f66da46945849a1c3ef6af41d30aa295248d3ad57

    Download Submit

  • \ProgramData\fJaDkAd24512\fJaDkAd24512.exe
    Filesize

    442KB

    MD5

    eacf685c6d38d4bb168dd7151990365b

    SHA1

    66e757e6124fe83e3f9f20c9dceec76a985bbdde

    SHA256

    62b41de1c3682b57bcb270564e4c23832028e07cccead22812b6facb27faef3f

    SHA512

    1313a3575ef62dfc764ca76d2838e210483b46ce3861083370df750ee254f1fbe9ac370e1f18e8a2a3a5c95f66da46945849a1c3ef6af41d30aa295248d3ad57

    Download Submit

  • \ProgramData\fJaDkAd24512\fJaDkAd24512.exe
    Filesize

    442KB

    MD5

    eacf685c6d38d4bb168dd7151990365b

    SHA1

    66e757e6124fe83e3f9f20c9dceec76a985bbdde

    SHA256

    62b41de1c3682b57bcb270564e4c23832028e07cccead22812b6facb27faef3f

    SHA512

    1313a3575ef62dfc764ca76d2838e210483b46ce3861083370df750ee254f1fbe9ac370e1f18e8a2a3a5c95f66da46945849a1c3ef6af41d30aa295248d3ad57

    Download Submit

  • memory/944-68-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/944-65-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2040-56-0x0000000000340000-0x00000000003DE000-memory.dmp

    Filesize

    632KB

    Download

  • memory/2040-58-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2040-64-0x0000000002640000-0x00000000026F9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2040-54-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2040-57-0x0000000000240000-0x000000000028F000-memory.dmp

    Filesize

    316KB

    Download

  • memory/2040-67-0x0000000000400000-0x00000000004B9000-memory.dmp

    Filesize

    740KB

    Download

  • memory/2040-55-0x00000000761E1000-0x00000000761E3000-memory.dmp

    Filesize

    8KB

    Download