Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    185s
  • max time network
    224s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 19:35

General

  • Target

    90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe

  • Size

    686KB

  • MD5

    579de683b042a2a1c7a28655d6729338

  • SHA1

    baa623a6de2180ea72c19194172a8d5ff658d556

  • SHA256

    90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63

  • SHA512

    d78ac81f938aa1ce4a608d1eee06fd60f92ea2735075b1e821831bf5dae5e783bcf831b1b01ab314fd224c0692db33886eb448d37f6bc5fcb0d762f62f861f2f

  • SSDEEP

    12288:kvQYieOGmkCcrX4VjvYKVPgp0Df/oPG7qWTHw5lyuZi0mFeYB31uvk:kvxTOOCcrXOsSIp07/Iw/T7uY0m8vk

Score
9/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 6 IoCs
  • Drops file in Program Files directory 3 IoCs
  • Modifies Internet Explorer Automatic Crash Recovery 1 TTPs 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe
    "C:\Users\Admin\AppData\Local\Temp\90c483e023767794b24d521c383de42baabb4c185f126705a3409a466fccda63.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Program Files (x86)\Dnrsoenno.exe
      "C:\Program Files (x86)\Dnrsoenno.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Modifies Internet Explorer Automatic Crash Recovery
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1228
      • C:\Program Files\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2456
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2456 CREDAT:17410 /prefetch:2
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of SetWindowsHookEx
          PID:2524

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Dnrsoenno.exe

    Filesize

    42.9MB

    MD5

    5f7aba8dd0b1d309bb88373781e08d93

    SHA1

    f7b07ffa48eea86114e5c3cb60eb82ddb27c218d

    SHA256

    3d397c135a5cc8acceaa51189e45b50d1c259169d2457758d2561e841c77eb51

    SHA512

    f39009333d812cc9db20481c18fca22e1772339cdb52aae42856d848040a8ff34410f2fd6e0014e89134b9d57c5225acccb00568d453d9dfdc5d671f7f209942

  • C:\Program Files (x86)\Dnrsoenno.exe

    Filesize

    42.9MB

    MD5

    5f7aba8dd0b1d309bb88373781e08d93

    SHA1

    f7b07ffa48eea86114e5c3cb60eb82ddb27c218d

    SHA256

    3d397c135a5cc8acceaa51189e45b50d1c259169d2457758d2561e841c77eb51

    SHA512

    f39009333d812cc9db20481c18fca22e1772339cdb52aae42856d848040a8ff34410f2fd6e0014e89134b9d57c5225acccb00568d453d9dfdc5d671f7f209942

  • C:\Users\Admin\AppData\Local\Temp\E_4\Exmlrpc.fne

    Filesize

    72KB

    MD5

    f79ee77a4f30401507e6f54a61598f58

    SHA1

    7f3ef4945f621ed2880ff5a10a126957b2011a17

    SHA256

    cf8e29720823eb114fbc3018569a7296ed3e6fcd6c4897f50c5c6e0e98d0b3f8

    SHA512

    26ccde784b06c46f60fb5a105c806c4d9dc1497fd79d39728fbcfa869d470ca2ba018b0665f3cbc05019fb0766dac2eb1084a6fdce2f9aaaae881beb09dd3739

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • C:\Users\Admin\AppData\Local\Temp\E_4\dp1.fne

    Filesize

    112KB

    MD5

    6d4b2e73f6f8ecff02f19f7e8ef9a8c7

    SHA1

    09c32ca167136a17fd69df8c525ea5ffeca6c534

    SHA256

    fe5783e64aa70fac10c2e42d460732d9770534357329d8bc78576557c165f040

    SHA512

    2fd7a95cb632e9c4ac6b34e5b6b875aae94e73cd4b1f213e78f46dadab4846227a030776461bca08f9d75a1d61a0d45427f7b0c8b71406b7debc14db04b2ce04

  • C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

    Filesize

    409KB

    MD5

    c3d354bdf277263b13dca264ec2add9d

    SHA1

    b428dfd7df0f6024e22838823cc702e2293bd314

    SHA256

    ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f

    SHA512

    24c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e

  • C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

    Filesize

    409KB

    MD5

    c3d354bdf277263b13dca264ec2add9d

    SHA1

    b428dfd7df0f6024e22838823cc702e2293bd314

    SHA256

    ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f

    SHA512

    24c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e

  • C:\Users\Admin\AppData\Local\Temp\E_4\krnln.fnr

    Filesize

    409KB

    MD5

    c3d354bdf277263b13dca264ec2add9d

    SHA1

    b428dfd7df0f6024e22838823cc702e2293bd314

    SHA256

    ede1e15bb21655495ea3b3fb6710390d53839abeed944ed7ab1af7403b50aa5f

    SHA512

    24c8e96b3c07fa4e44fbb31a4e09bea728d90d410352aa9c6b6b6165ff5c038f689b7b58b05abc6513fa4ab953b78edc0f9e8298b2d57fe1c26e80068e7ca68e

  • memory/1228-142-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1228-143-0x0000000010000000-0x0000000010129000-memory.dmp

    Filesize

    1.2MB

  • memory/1228-146-0x00000000021F0000-0x000000000220E000-memory.dmp

    Filesize

    120KB

  • memory/1228-153-0x0000000010000000-0x0000000010129000-memory.dmp

    Filesize

    1.2MB

  • memory/4288-134-0x0000000010000000-0x0000000010129000-memory.dmp

    Filesize

    1.2MB

  • memory/4288-150-0x0000000000640000-0x000000000065E000-memory.dmp

    Filesize

    120KB

  • memory/4288-152-0x0000000010000000-0x0000000010129000-memory.dmp

    Filesize

    1.2MB

  • memory/4288-151-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/4288-132-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB