Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    193s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    06/12/2022, 16:10

General

  • Target

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc.exe

  • Size

    83KB

  • MD5

    42d68211aeb022610c8c622f94683651

  • SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

  • SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

  • SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • SSDEEP

    1536:8nHfhdq/LWoxOxjW2Slcnouy8oMgJKTOMlmx:aHuDtxGG8outTgJKCMgx

Score
8/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 6 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc.exe
    "C:\Users\Admin\AppData\Local\Temp\de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • Modifies Internet Explorer settings
    • Modifies system certificate store
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1460
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c reg delete HKCU\Software\yahoo\pager /v "Save Password" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:936
      • C:\Windows\SysWOW64\reg.exe
        reg delete HKCU\Software\yahoo\pager /v "Save Password" /f
        3⤵
        • Modifies registry key
        PID:1764
    • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe
      "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      PID:1876

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Acrobat.exe

    Filesize

    83KB

    MD5

    42d68211aeb022610c8c622f94683651

    SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

    SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

    SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat.exe

    Filesize

    83KB

    MD5

    42d68211aeb022610c8c622f94683651

    SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

    SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

    SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    2e8dab0111c5f3e9103cae92a9e1cdaa

    SHA1

    5d16362cf320faeacf5963532354e99e0dce3e2b

    SHA256

    858dfc9a9af2e0400a91bf3660acb1a123960c5ad53df61b7f73663035e01ba8

    SHA512

    ee28bf368690e56ada1fc8538330cc22cb57a59a1a5012e73d3e0300dc7410b82f8c2a300625560e69bc19344acc333b2138ec49ca5ddf5f24a54debce685abb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

    Filesize

    1KB

    MD5

    2c0f3dffa588855224bea03a8198fac6

    SHA1

    da54d9458cbc5a8d7078c9158b7f672c9e88a57a

    SHA256

    63340a6fc87e32b6d140418a8747d7490e33d37b888c521f3c2c2dfc47045f94

    SHA512

    9416739bb14911416d4f0ff14faaa4ee95f9a5742d6cca06e3410c304a3c31cbc5b6e400be571a016beb84fc16606459d97eee485c64016c5b1f0ed3e0ea68a3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    61KB

    MD5

    fc4666cbca561e864e7fdf883a9e6661

    SHA1

    2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

    SHA256

    10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

    SHA512

    c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9FF67FB3141440EED32363089565AE60_7E1E09396B73CD2449B81B55C8B87435

    Filesize

    278B

    MD5

    078affa84566da08fe329b81c73a2682

    SHA1

    fe9592c5b5f4a82fe10407d00fd1fce12e45d2b0

    SHA256

    e5ef54760cfe52f1e20fca7dc247601b01d9c61ba38736e1e881bccb138a8d23

    SHA512

    1aeb21c481e9ee2658bc81c8c1ff3106bfab1f25f3c64bcac029e7e2c1b3fdbd245ad3053d3e3740332b46e52b2c8289a0aa2068443ee5c6669866bd0ed52659

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    1KB

    MD5

    822afa251dfb23c10566bc3267b07676

    SHA1

    803818f023438a8d9ad17702d841a3a9f0380ff7

    SHA256

    97c5e1b03a6775231978d8990fadd81733e7c7b0cde5795b9d7813c5f99f823a

    SHA512

    7fb782125d7e498b9dfcb5f92df01e61a74636e31cc6f593d3778ef4cb47166c7c1b87400ef44baed5aed476f128cfc1fef25eae2c00c20f7f5dfe0f38445aa1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C6872375A2E1BC120603F5605C3CEC71

    Filesize

    472B

    MD5

    50964d71646920295f4a98db21a913c1

    SHA1

    8ede97a36ce131830b2a69f6225790dbd3f2ef8e

    SHA256

    aa282f0e5e4ab3690472c8c867419ea33a4fafba1594722e8ca9dcf1325fd46a

    SHA512

    02c8543fc6b930a0e43727a7614edf92143701c9c81c1452faa2104cb5310c2b0b25c8d441dcac7b9e695b6e64e019d3bede3be20bede395d895e57c4da261aa

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    b294a8e2a36717778cfee5fe9c9ce4f0

    SHA1

    10f927eef9c13ae5aba406cc7b276cf6c568560b

    SHA256

    d6393ce6574ad5494ae84ab7c5248ab0ce1dcdbdb8a252636d8ff75e86756f0b

    SHA512

    804a27543a0681200626df5bd60d451f6ea1eed5d130b41153deb6a549d9751eaa3cc26766135c4ee58d94ba0517c25fbe29a3f7c13028cc33f9ae5b25ac6393

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27

    Filesize

    408B

    MD5

    081ee2f6fc8095ca3d96dba6621a0faa

    SHA1

    f3b6829f910fc6e64e22d2ae580979d730382a06

    SHA256

    fe0243c2fd004f6530996d007d46941c3309347b2828884285212adb98920dca

    SHA512

    dcc2457d85afeef9ec3e3588b619c42f7e7414c426e25e459104b7b4ef8a9897b56c2303730789eedde521edd0e09723f584887b95a58d9a26346e899d5132ef

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    304B

    MD5

    cc93cdb652675d72af2f29b636687330

    SHA1

    3a343eefe5277e7c576231705837d45f11107fdc

    SHA256

    1ccceba5f73aa565e2bd65958ea6b94d3128ac31938c88da5355e561ef6df920

    SHA512

    0e68b087605f9bae161a17c058ced3a19bf13300fcce3cae107c075d6d193e52e55009b12f9e2c1bb50e5343c2b3a5786e4dd46d10344723e08ffbb28c40ecf5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9FF67FB3141440EED32363089565AE60_7E1E09396B73CD2449B81B55C8B87435

    Filesize

    434B

    MD5

    406c1ea707c9cc739273d8ef62741859

    SHA1

    bb14d8ba3517652fbb014f84370b3009217c41f8

    SHA256

    4f695e55fbd35212c9aef89bd2771f45bebd6b190d943532c6d9d1272e8851d7

    SHA512

    b0901f2717b1a0e8b3b57427d8d94d6e18971d01cc743e75938d20d493507d9cbed78f943469b3f49604be66c5123700ee4d1bb9c234fa03160bfd9c62ad6734

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    0a5675f4ce881f0b6fdcba8a2717f2e7

    SHA1

    132e9308ee83384f55153ef84d02af57b36fd758

    SHA256

    94fbb8e873b673bad4babace71c2225358ee24fc7967fdcab7268b02efe712d7

    SHA512

    69d6c0f19e316fa6765ae00d98825e199a08c22add9a3126397a2e18db87d0341bf2caa6cee8f41be53b1ab5764fe390df690527462e38f53290a4af29493837

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C6872375A2E1BC120603F5605C3CEC71

    Filesize

    484B

    MD5

    bc09d97f7ab2b06ae8defce3ad6fd584

    SHA1

    e7ccd1f368d8a8714ff2796f8e800c3abaa5fabb

    SHA256

    65fceb439a74ff48756fb7ca3963bee5476018a1f2e2e3f16d40cdf6cb7d258d

    SHA512

    ae43c595903a9295b87ef2877959d544baeb210c41bc66272d221da343bce87a3f719d89989dbb7bda3f6af74f05608109a21e93d9d20018972a9caa27bdab3c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96W2ZDRZ\Bmp2Jpeg[1].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\96W2ZDRZ\errors[1].css

    Filesize

    6KB

    MD5

    4d5619dbf6ddc311570d298adbf5985a

    SHA1

    03202aaaa7aa66b993ddd719e601367fad7d56cb

    SHA256

    a9bb98fbccdbd97ce82b2842989d98965dccef99169e4b93eea81bff0de0e79b

    SHA512

    f86b0a4a8d77876681f408325c9bab9c929ccb85083b1634cffbf6bf8ff7f7010447e3c5b8a5b146baa66937d890fde5ce984bcc63f1bd3ed101ee01dd8fdb29

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PULJ7CSW\online[1].htm

    Filesize

    162B

    MD5

    4f8e702cc244ec5d4de32740c0ecbd97

    SHA1

    3adb1f02d5b6054de0046e367c1d687b6cdf7aff

    SHA256

    9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

    SHA512

    21047fea5269fee75a2a187aa09316519e35068cb2f2f76cfaf371e5224445e9d5c98497bd76fb9608d2b73e9dac1a3f5bfadfdc4623c479d53ecf93d81d3c9f

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X8FNYYS1\external[1].png

    Filesize

    265B

    MD5

    cb09a55c92c63ed227cf14f2b7f23601

    SHA1

    a97780adf99f6dcc0e88dba36cd11df267098271

    SHA256

    9f03b2b292f718119a8203689d05692e054f1059112c981c1e20dec82e9f2ddb

    SHA512

    e788e9bbdd59126254b9e99aaa0278981501f1ff6a2956e8afa62ad0f4afb2d33ffed2a314d977b9fbf1e4e165933e3eda321084439b1fd36441670a6313f25e

  • \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat.exe

    Filesize

    83KB

    MD5

    42d68211aeb022610c8c622f94683651

    SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

    SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

    SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • \ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acrobat.exe

    Filesize

    83KB

    MD5

    42d68211aeb022610c8c622f94683651

    SHA1

    5b336158cfc04c95238c1502eabc8db76a90e112

    SHA256

    de31908fa894a030c75f423955620326cf8c1c00bce19427b280e51b277ab5dc

    SHA512

    2b4051a1c9732141098410e70e072d22341bd312eaed2880aa7d35197902da38d034f694e989ebfdafc96c3e638f3fb2d4dcdbbb58d05505ac6c506971b0706f

  • memory/1460-60-0x00000000049D0000-0x0000000004B45000-memory.dmp

    Filesize

    1.5MB

  • memory/1460-64-0x0000000004260000-0x00000000042B2000-memory.dmp

    Filesize

    328KB

  • memory/1460-85-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1460-55-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1460-59-0x0000000004890000-0x00000000049C5000-memory.dmp

    Filesize

    1.2MB

  • memory/1460-58-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1460-57-0x0000000075D01000-0x0000000075D03000-memory.dmp

    Filesize

    8KB

  • memory/1876-89-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB

  • memory/1876-73-0x0000000004A60000-0x0000000004B95000-memory.dmp

    Filesize

    1.2MB

  • memory/1876-75-0x0000000004CA0000-0x0000000004E15000-memory.dmp

    Filesize

    1.5MB

  • memory/1876-95-0x0000000000400000-0x0000000000452000-memory.dmp

    Filesize

    328KB