Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
228s -
max time network
337s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
06/12/2022, 12:46
Static task
static1
Behavioral task
behavioral1
Sample
d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe
Resource
win10v2004-20220812-en
General
-
Target
d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe
-
Size
1.1MB
-
MD5
5262550e302e933e10c9eeedddcd5fd2
-
SHA1
50a11f78f6698422d18f3c218627680b4204c857
-
SHA256
d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6
-
SHA512
9ae9b1ece589b414c605b2ed0f6d61a5c24cebd376171341c841c81c44b01cd18069bf98b6347ffb0a188ad5e09c542c09f06ef54ff95a3f7c1fd83697748c00
-
SSDEEP
24576:zh9bn+rEWHL+QY6/9oICxHJ1fyYJizI7lv7ke77uwo0jziG:zh9LHjk9WhryYD7x4Zz4mG
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/560-57-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-59-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-60-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-61-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-62-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-64-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-66-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-70-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-68-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-72-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-74-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-76-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-78-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-80-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-82-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-84-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-86-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-88-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-90-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-94-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-92-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-98-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-100-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-96-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-102-0x0000000000600000-0x000000000063E000-memory.dmp upx behavioral1/memory/560-109-0x0000000000600000-0x000000000063E000-memory.dmp upx -
Loads dropped DLL 3 IoCs
pid Process 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Internet Explorer\Main d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
pid Process 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe 560 d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe"C:\Users\Admin\AppData\Local\Temp\d85aaf5fb6102a465ef859b7956a5b485ad92dce3a6426e74eb1a896dec026a6.exe"1⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:560
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5f34c58153766a46f29726f18ea61de84
SHA174a10a94d3713f2959271d3e759340b8b09b2903
SHA2566b0886e69b7543cd96569e259e97f501048c3c86ab8d168f1884d7f630cbfedb
SHA51264ea97a0b941d62fdb19f6a6eef4abbedf818525b920e09b0dad329344b96221a4452262dad4f48d89a5851d507df230a3c0cd49b211da0ea253b70ab968c8a0
-
Filesize
216KB
MD5cba933625bfa502fc4a1d9f34e1e4473
SHA15319194388c0e53321f99f1541b97af191999a09
SHA25625549c7781b3f1b92e73b0ea721d177207cce914a66f3229a71291f2eb160013
SHA512f5fb4b97c4f68a20e0847e6528740ce659c4501726f3b2dff1ac83e88a3b7198099da03edb0f069cd4af7ed568a2373597b235cd239895addfa5226d3a444142
-
Filesize
1.1MB
MD5638e737b2293cf7b1f14c0b4fb1f3289
SHA1f8e2223348433b992a8c42c4a7a9fb4b5c1158bc
SHA256baad4798c3ab24dec8f0ac3cde48e2fee2e2dffa60d2b2497cd295cd6319fd5b
SHA5124d714a0980238c49af10376ff26ec9e6415e7057925b32ec1c24780c3671047ac5b5670e46c1c6cf9f160519be8f37e1e57f05c30c6c4bda3b275b143aa0bf12