Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

9

Static

static

1

92de587c6c...f0.exe

windows7-x64

9

92de587c6c...f0.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    227s
  • max time network
    334s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    05/12/2022, 17:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    92de587c6cc1463d58d89e0dffb5047fbe8dabdc1cd724259e5e34190579eff0.exe

  • Size

    5.1MB

  • MD5

    638a7fc296046f02bbb52f07b67ca253

  • SHA1

    ba5a322e23a2d075f27bf80143ab69cd3c8561cd

  • SHA256

    92de587c6cc1463d58d89e0dffb5047fbe8dabdc1cd724259e5e34190579eff0

  • SHA512

    23fc48e782c6f1fd2d2b9e66cef0a82c81bf242f595f086a8392207b248dc3b531e099e10ea4e60cc287404f5f39155440364346e94c7f0cbf3bd33c5ec68973

  • SSDEEP

    98304:+NiqZg/MIBjC7eJUaiotWLrvw484wIfY5/WbSXfQKJHighxoRPRWFqRQVrgTaMpy:+wBGaioELrI4FwT5qSXfpxDqRQVk/y

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Loads dropped DLL 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\92de587c6cc1463d58d89e0dffb5047fbe8dabdc1cd724259e5e34190579eff0.exe
    "C:\Users\Admin\AppData\Local\Temp\92de587c6cc1463d58d89e0dffb5047fbe8dabdc1cd724259e5e34190579eff0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:332

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\584300838\K8Skin.dll
    Filesize

    376KB

    MD5

    6f2e568ad29d065ecb9073e0e943158b

    SHA1

    1d6f747b5abe0ba06eb70a4f93a2dfe046342094

    SHA256

    2f2f55967767478491d982c07d7197db914a3cf22d57b9ded917c1e9173f8431

    SHA512

    8cacbf539926f7a7f4be1963ef92fd83facbce7d68f1a2c9cc0554a86b2307486f00b3d678f417746db054654d0c9c1675a9d0633b01817153ca5168a0c7de47

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsk2E54.tmp\ButtonEvent.dll
    Filesize

    4KB

    MD5

    fad9d09fc0267e8513b8628e767b2604

    SHA1

    bea76a7621c07b30ed90bedef4d608a5b9e15300

    SHA256

    5d913c6be9c9e13801acc5d78b11d9f3cd42c1b3b3cad8272eb6e1bfb06730c2

    SHA512

    b39c5ea8aea0640f5a32a1fc03e8c8382a621c168980b3bc5e2897932878003b2b8ef75b3ad68149c35420d652143e2ef763b6a47d84ec73621017f0273e2805

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsk2E54.tmp\K8NsisExtend.dll
    Filesize

    232KB

    MD5

    c65f6245d1103e97e87ac3108d920d4d

    SHA1

    c5519d1137d6b94de28f62bba9442b9fd956f340

    SHA256

    c1ea3139cf606f73bc922fdedfb48624aab787661adf6159f86925a2150b06ca

    SHA512

    76da042211f2bc1bba233031690018d967efa9ef567ee8b8fd7fc4931f95c9e27209c42d9a56bf0b773374557918816ba1580895a50bbcc2c1e7e15962256b3c

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsk2E54.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsk2E54.tmp\NSISdl.dll
    Filesize

    14KB

    MD5

    a5f8399a743ab7f9c88c645c35b1ebb5

    SHA1

    168f3c158913b0367bf79fa413357fbe97018191

    SHA256

    dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9

    SHA512

    824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsk2E54.tmp\System.dll
    Filesize

    11KB

    MD5

    c17103ae9072a06da581dec998343fc1

    SHA1

    b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

    SHA256

    dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

    SHA512

    d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsk2E54.tmp\nsDialogs.dll
    Filesize

    9KB

    MD5

    c10e04dd4ad4277d5adc951bb331c777

    SHA1

    b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

    SHA256

    e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

    SHA512

    853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

    Download Submit

  • \Users\Admin\AppData\Local\Temp\nsk2E54.tmp\nsRandom.dll
    Filesize

    21KB

    MD5

    ab467b8dfaa660a0f0e5b26e28af5735

    SHA1

    596abd2c31eaff3479edf2069db1c155b59ce74d

    SHA256

    db267d9920395b4badc48de04df99dfd21d579480d103cae0f48e6578197ff73

    SHA512

    7d002dc203997b8a4d8ec20c92cd82848e29d746414f4a61265c76d4afb12c05bce826fc63f4d2bd3d527f38506c391855767d864c37584df11b5db9ca008301

    Download Submit

  • memory/332-54-0x00000000757E1000-0x00000000757E3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/332-56-0x00000000003C0000-0x00000000003D2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/332-59-0x0000000000450000-0x00000000004B1000-memory.dmp

    Filesize

    388KB

    Download

  • memory/332-62-0x00000000009F0000-0x0000000000A2E000-memory.dmp

    Filesize

    248KB

    Download