Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
384s -
max time network
1826s -
platform
windows10-1703_x64 -
resource
win10-20220901-es -
resource tags
-
submitted
15/02/2023, 04:45
General
-
Target
AutoPlay/Docs/VC_RedistInstaller.exe
-
Size
47.8MB
-
MD5
81d13c603e77045c22db7838706b4f00
-
SHA1
ff9c335363cd764164b81699fbd2bf4aaac587cf
-
SHA256
0cb11bd72d9b6c844ac3a7d046b1743790444c5fac4f8f3788ddb2cd5d2a38c4
-
SHA512
ef17fffca705c5dca387df09bd02f9f5381edbc61864d04e6098fbd7dcdf7f22703dcc31121a5ebeb0861489bbfc41c5d549e06664d50ab64f38ff6d82e349a6
-
SSDEEP
786432:pUuwDlB5zWhAaKoXa3hegoR5oFBJSISZsOkfIuxoVTclL4NFDFIgrZ8pmuMtDHN:WuwDFzWhbKBEgoqJf6FDF8mZlHN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoPlay\Docs\VC_RedistInstaller.exe"C:\Users\Admin\AppData\Local\Temp\AutoPlay\Docs\VC_RedistInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-VHHFL.tmp\VC_RedistInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-VHHFL.tmp\VC_RedistInstaller.tmp" /SL5="$300DC,49648524,177152,C:\Users\Admin\AppData\Local\Temp\AutoPlay\Docs\VC_RedistInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD57ffa1cc1b4853c537f5d42a2d35cf006
SHA17335bd34920ed968623cb491c059e68aea297447
SHA256898084b9317155c6555327dd8bd2c7b20fb791a415fff2a1c03e6b43378655b4
SHA51283f264be5a259d7dec001a6a759d4edb382141d739a2ea28d330bf62ef5d9b5ccb7c2d680d065e46e0c1ab0b8da36a4d25948e45ce1ec03f0ab62d4d39c7c88b
-
Filesize
1.2MB
MD57ffa1cc1b4853c537f5d42a2d35cf006
SHA17335bd34920ed968623cb491c059e68aea297447
SHA256898084b9317155c6555327dd8bd2c7b20fb791a415fff2a1c03e6b43378655b4
SHA51283f264be5a259d7dec001a6a759d4edb382141d739a2ea28d330bf62ef5d9b5ccb7c2d680d065e46e0c1ab0b8da36a4d25948e45ce1ec03f0ab62d4d39c7c88b
-
Filesize
385KB
MD592c2e247392e0e02261dea67e1bb1a5e
SHA1db72fed8771364bf8039b2bc83ed01dda2908554
SHA25625fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68
SHA512e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5
-
Filesize
1.6MB
-
Filesize
212KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
212KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
212KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB