Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
-
submitted
16/02/2023, 06:36
General
-
Target
7aac382736121f38e6b045703ba1f8f95352d5a9c3ec4a85dee13e885a152d78.exe
-
Size
6.7MB
-
MD5
ae242bd1226aaa270e2e167c252c4555
-
SHA1
850aed65c3efce9090b4b6552075af3bc57e0659
-
SHA256
7aac382736121f38e6b045703ba1f8f95352d5a9c3ec4a85dee13e885a152d78
-
SHA512
1c2ae75fe6017957323251d3d8004e41e1f81e3c3c5dba23aecf3902d47e922b731b2ca7232e04d228b7c402140352c75ca77e88afb9de76688cf7b40abd0fa6
-
SSDEEP
98304:is5DZoRvVmqkGpsV7Owx7FYhX4vs/6uur+GZIB6TPgV6Vf4YiYcHR4cLJpB/EO:v+RvV9kGMxF8Es/6uCdZXF0N6AJrL
Malware Config
Signatures
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 9 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
-
Suspicious behavior: LoadsDriver 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7aac382736121f38e6b045703ba1f8f95352d5a9c3ec4a85dee13e885a152d78.exe"C:\Users\Admin\AppData\Local\Temp\7aac382736121f38e6b045703ba1f8f95352d5a9c3ec4a85dee13e885a152d78.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Ludashi\Utils\LdsHelper.exe"C:\Program Files (x86)\Ludashi\Utils\LdsHelper.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82B
MD550bd162a74e4b28911ab67890d59c677
SHA1161b37ab432badb577786661eaf797c26f5c62f0
SHA2563341c6e1207ac6ed684511482f88964dbdb5e1886da5b6963bf636081ae0f009
SHA512716fa9ed18b0845512a39aca962efda65d3b73ed848d6a0aa774a98875487a533a251a0321255b31ceea61329dbedadc6b757267da3ba21daea10368d1c4ec83
-
Filesize
82B
MD550bd162a74e4b28911ab67890d59c677
SHA1161b37ab432badb577786661eaf797c26f5c62f0
SHA2563341c6e1207ac6ed684511482f88964dbdb5e1886da5b6963bf636081ae0f009
SHA512716fa9ed18b0845512a39aca962efda65d3b73ed848d6a0aa774a98875487a533a251a0321255b31ceea61329dbedadc6b757267da3ba21daea10368d1c4ec83
-
Filesize
8.4MB
MD5e9042e8c7b59b84fb6f57517798cae52
SHA130ab0ec13983a6bd9037d3ad0ba7dfa5750f650c
SHA256151d5c2cdee63352a32010bba1b2fd34d39eb4fe4b8ad45d8acfb70715c63b20
SHA512e9e2f0d43400a21e796c3769c8a91546e6ae121ebe04788d1fb6d724595e2b3493720d756e54b6e25b7db6c3fedec8836042d44715dc23f95af5e2509db1f4d1
-
Filesize
3.7MB
MD5b833bcb9bfe16563c36be0c430b848b9
SHA1a90866f92d6c8af51f58baf08a2982ada27233cb
SHA256e50ded7fa0ba74eb10bccc03f9fdb022d9fb6bbc68bc4755f7324e5f2cc36ebc
SHA5123c47f162c7503450d4c9ba1e499aa222e47211f96815db2f0d33659758cdcc27801271f33677142f8092cdbc80c7fd1910a29197846d61f073928afb40dc071b
-
Filesize
1.1MB
MD52706693dda10c6cc79eed24c56d4e5ef
SHA14f34ef1bd49273a0d260b9dab15c73eb0ccb6383
SHA2560edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3
SHA5127e7f7ae894528587ba33b6e10999549bb9a2ec2748b5662fa1b8806e5f4ce33af47507b3ef2954f2747a76b5b7c775c1cd671061f577c5016d1f8ba165bbe21c
-
Filesize
1.1MB
MD52706693dda10c6cc79eed24c56d4e5ef
SHA14f34ef1bd49273a0d260b9dab15c73eb0ccb6383
SHA2560edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3
SHA5127e7f7ae894528587ba33b6e10999549bb9a2ec2748b5662fa1b8806e5f4ce33af47507b3ef2954f2747a76b5b7c775c1cd671061f577c5016d1f8ba165bbe21c
-
Filesize
477KB
MD591d986307ab1e56f7f77710664cdb70d
SHA118fe10c7b1ec55632c03b9f06f9d881a022c970a
SHA256d85bfd004e2ca8dbdfa72a4bdcb1510df76ed56d46ef5128500883c8c7f7c8fb
SHA512480659e912ef3053a4542eb2e8eaa3a70df92569e9834d950d9d7ee07e8c9d740b59f1eaed90276454ab71211da41d2f3d945cc486539cba7be3a5c5c0a61e32
-
Filesize
477KB
MD591d986307ab1e56f7f77710664cdb70d
SHA118fe10c7b1ec55632c03b9f06f9d881a022c970a
SHA256d85bfd004e2ca8dbdfa72a4bdcb1510df76ed56d46ef5128500883c8c7f7c8fb
SHA512480659e912ef3053a4542eb2e8eaa3a70df92569e9834d950d9d7ee07e8c9d740b59f1eaed90276454ab71211da41d2f3d945cc486539cba7be3a5c5c0a61e32
-
Filesize
24.2MB
MD5009b2a92ea877e1c8b33b13cc17137d4
SHA1fe41711307e7a596e5b30f0ac00d7b75a6002d04
SHA2566af751a5f0b73c1ccb723afd0089ea7bcecf0e302afe03f10040fb9c11ce05c1
SHA5126b68d45bd7707e4bfa3bf8ed0bb9f73205c5c002c634d9e6619a1e7996859d6cf6624037b8cb0c730a7965d8dd7566121401bf4726484814879cb6372684fc0f
-
Filesize
24.2MB
MD5009b2a92ea877e1c8b33b13cc17137d4
SHA1fe41711307e7a596e5b30f0ac00d7b75a6002d04
SHA2566af751a5f0b73c1ccb723afd0089ea7bcecf0e302afe03f10040fb9c11ce05c1
SHA5126b68d45bd7707e4bfa3bf8ed0bb9f73205c5c002c634d9e6619a1e7996859d6cf6624037b8cb0c730a7965d8dd7566121401bf4726484814879cb6372684fc0f
-
Filesize
956KB
MD5d4bedaf01cc67ad161cd454cff3ddb93
SHA136571a19ae58c8ae9d1505cc0b6b673be47b1756
SHA256019380b69ab5410d923abc86487d636e28dc51fb03015ef15b7c5be7be13b4b3
SHA512d121d8d2676f6426aa94ee31af93c60ce72b451c8d48cf1e98ce844fba997da859a2140e7d2f4fd2c34ca9f1fd1ace3b8a84c8befa74d035879a036b0671ea3c
-
Filesize
1.2MB
MD50e426bd24d7a8b9058622259a6da352b
SHA1ab833eee8362f1f32537a436e1fb95b810010db4
SHA256a876bee4db2c330ca4d6e959ba878c28a2032d2da4a03a1a4b5e1dae9c8612d5
SHA512d7c90110f053158db57e1d1d6d9790dff03efda64b2186a0b0da26bde06d58a77d580cfc497ebe037cdf7da398292b7b1e35b377f52bd6f60f5699aca4f39200
-
Filesize
241KB
MD508d4addb59ec78303aeeb2b08030defb
SHA1ea058e83945ef8e20712ff1c7659d528362d1b46
SHA256c27454a2e8b56665a9282fd774b8568da3aad3a00b1ff673c5115a28acdb5f25
SHA512ef792cda42ebca4ea3c6547b0c7f4d1aa603cb71922db154b96b22deef6ba22d1a5cb23849cf168281aaf7c956fbd46976e929ae15f3295491724c363e567b6c
-
Filesize
288KB
MD55a0f33714bf8ae637fb6800473819af7
SHA1b788684a669362765f472083fc316f7d36c0eeaf
SHA256f2e0d6fa5d7590bfc694ffe222e503dc7171ce585bde4feec3f165899caf09a1
SHA51271113af332c7e78a8cf9a1a7221d4c10c8b6db6f61f739b3ed3755d50e130dbe26e6a73e2c370be5fb9c89ea3f711f5027a19e8df32920407fe8fb67a5236dae
-
Filesize
1.7MB
MD52d3d1b3fd61d0230161b1c43e367df45
SHA1a1090c691dd54b9bc2509c0e81d00cfeb6c2db32
SHA256fb3b48b2980ac6cbecd7c579a58e0358dcfe03ea2d66c839e965627c4612a619
SHA512217f7f1f41c26e0ac9910d10f0ff2d538acc0156595244f33d4bce018a8097d1911d5a668e3a6d889e5147b27a40b7cd6904e2d8e1d49dd53eb184468fdb1764
-
Filesize
871KB
MD5789ff3ad5461728f393f86ffc0351fc6
SHA1c5d994ac9dfe8440ddc9fd4c8cebe9776cf13356
SHA256ae9ea86fcc401d29e5b92e2cb6e6b6fe0cfbee7408f781b2e217a509a533cc94
SHA512c7500c88125b278de8e17a602d96d26b703aabbbd3624913afa0e56d313ec0a8abc0080794061de8e5f4688bf45c0aa136019509420437222e8452e5da8c62c1
-
Filesize
104KB
MD5e3de14a4c2e1ea9c73d6e865a0fab837
SHA1489f2b30c5e6c2af516e69ccad1f96d34411e66c
SHA25623785aa5bae50bf822f3b2306fda41743b5937d770a8d9f391fae8f50497e20b
SHA512941d8ec98afa5acd4b6a9d52c126e86c1e1f3460660171f70631124a422ec24b7f3c9ceca17eca01142b398a71cda045e136ffd420c01eba8cc4c883ef0cb0ef
-
Filesize
871KB
MD5789ff3ad5461728f393f86ffc0351fc6
SHA1c5d994ac9dfe8440ddc9fd4c8cebe9776cf13356
SHA256ae9ea86fcc401d29e5b92e2cb6e6b6fe0cfbee7408f781b2e217a509a533cc94
SHA512c7500c88125b278de8e17a602d96d26b703aabbbd3624913afa0e56d313ec0a8abc0080794061de8e5f4688bf45c0aa136019509420437222e8452e5da8c62c1
-
Filesize
164KB
MD548484aa35450ac9595af42af04dd7f4e
SHA1734653c55ba2a66e893b3884e9fe31d57851051c
SHA25604b4b37315904097e7d12d72400dd43c3f1afa39147f974299e506a152a75542
SHA512cafcb978b36c0ad7aa4255f207dcd7b69c32217c959f03c4a63dd6f67d4f9a7e1fd008787f2ba38deabeefb5e4b58c1a7e274baf327005ad35e33b0f00758a3c
-
Filesize
281KB
MD5b235e69a3ae8f02e68bb94190bd238f9
SHA17747450aa888f6a59258c574a2a5a0cef5a06d54
SHA256c4a019be64262055113cbc0be66d57eb56d750fd0cf57af623d589c94d3dc1c1
SHA5129cb74d447accfed346292370de31cef6b1c53a29b7d9a4b147dc50840941cee6ee65147ca8dc71c7cf4491e88fee1c6f0a86183c65f2bf22ab8cb38a4eef489a
-
Filesize
111KB
MD581c7432015c24ed91800f759dc2bfabc
SHA1d94828fd9dca99f840701437a1c041f647c58dfc
SHA256b3b6820713c5c8e6354eb8a48f83d18ab7253b2dbec38d2b6e49a550fb18edea
SHA512950067663e276aee30a912602c8ba7a00bc18d8e9cb3417da51be068a44e6e54eb31d6f8ec92e68ec84275926abd75517ec0c289ddb804d952fc0bce3c795ca4
-
Filesize
392KB
MD5fdc2298ccfff6d6b43c2d0f7779ef9dd
SHA18bb48b41cf55f9baf177eee720ad7cf3fe3ebce0
SHA25697e71f6b65f749b070d47d22bf0c5776d79180e19cd4bbbb5a9a33da037ef5c3
SHA5120024dd6e63e6de0d7b585ea0f03eb6bd4dd30104a70861eb2b09bbe7d577a4f25a6941f0dd2513b51a73b979a174d92afc81507085e2d784dfc7b81e7414c8a7
-
Filesize
10.3MB
MD5214063c2e8eb56472421ffcf066fcc5e
SHA10802b450986e2c954fa13018e3fda122a57b7c47
SHA256ed93f5fc7d3bc958b15f4f57a149abd16cf58c985dbac75d592cc41c3acf7345
SHA5127e5f8b00a00b4130db7bb69d863001d24b38c510d1294487878bc224c673dc280c1962e477048720caa81d6cd237a37c4b947c8490dd4822de43b1b1a96b8ff5
-
Filesize
425KB
MD5019559fa067a3d9393d6ef37eed4719c
SHA135fbd0221ac8bad7a14f8d7fa86750d89fd595bb
SHA256eff4f5d5632a3ffdc06ee91b80f429df3a85d3b4c73916a2a08fac433230bdbd
SHA51248b6fc945d356ca57e0c72249f39d1fd1adbec6276050c0cce247d725a3a1162a3c61c0badcbd0180f16abd705969f1ad7ab2f9de331b1e3521bd0c959b96eba
-
Filesize
779KB
MD5f6deffeb114254e0bcece46eb8951a5b
SHA1b1ba2d37c6fb3776e525ae0de522e6939715f36b
SHA2567d2d9b02acbee9a0afe04d6e7f9d3f4336ca9e31cfa0ad73c8bfc031fb0058e0
SHA5129e2f830e08bf8aaac84c7b757a7bbc5b763141710015ae41dc075effb375fd7915700be05d78a9661be8d3543ae02029f02d15e1c21f98988e16800d607427da
-
Filesize
554KB
MD5c6494b04750e6757252e88cf5c061530
SHA1e8e0becd8e5daa11529e5d5c3ae3051db6b0ebdd
SHA2562d7fcf14674527f524f3ec19d090b9c8367cfc7db6533b4e88c6a769836c5597
SHA512fc45d135239d3273813fb22ba59620b2bf1ce973cab9f7b8a59d47d4347fc7a5f8c3ef97a51c2e859f2f081d8e9e90b7e79ef41371835efb02ea379a2d19952a
-
Filesize
87KB
MD5c4e602bd780397e61daab7394ae39b28
SHA181abf2e28c681d99999a7c046e0629d03031f898
SHA256e10a0a93fa88bcae6618fcb71051cf3c893bc19409ad6fb9578c2bd8a8fb77f4
SHA51201e9247813038f4a66f4dc1642542984a95e2ee8d0d1580a52ad7cf5c51e5d8e2fb904a3438955d9600a9f22a51d88cea1f663df309153959beb2099c4efa1fe
-
Filesize
677KB
MD5c7053f00f6267d5a5e9cc09df392a651
SHA1b324e8f786faa6f80f3a6f0fb6523eb270e8af7f
SHA256ddb9a485fef65a3a92ef94f9169a1ad3996d92d450ac947052eef91be1f0dd79
SHA512cb78b7c913e8222210037a2cd903781fd99f23bc4433e23de50f4ddc0b8631b94bf730e23729130e0866cccf4272e49160f49d8c87fb7f9a3bed43a9128f899a
-
Filesize
1.9MB
MD5e68618982c94bc388d59de8cae81ea5a
SHA16f472bec25b114292221c87b24aa883f2eb64448
SHA2563cb47fd6f2e653382c93006dd47eb9d2aca6b47e80c05992a5355cb9843c97ee
SHA51291c56505ca14d2d621407d5dc0e33c4c10416d4061bd30a5a3d8e9f56f34d02b0a588cbb92d39590249c069e3aceb34bbf826d2539750c4f3fc7343e3d4d5c65
-
Filesize
1.8MB
MD51c659410366b145d81cdbf3c92878faf
SHA1e87c7811afc4b2fc7c08750a03027381c4cb609e
SHA2568238b12809fa9540566b373e97e3947a8543d27def5a6cdca428d8516256dffb
SHA512c82fe7e7943cb9c6d2f5e9f5904ae41096182d2ae777460721f563781305cff9296d470fb118fb4e30ea29f55e67f230de41e604dc418c8fbecd206353487ebb
-
Filesize
551KB
MD55d5ff285798b4fb701632f92a598142d
SHA1709d2346fd44ae3171afc065589f0db547b49eaf
SHA256d9dec9914a31e6396349186659c6ffb351cfb0766a8b5f9108fbaa41c92462d5
SHA512456a41902614f7c838c1cf68a96f551fad428629ac8f0738091f4b9ce73b3862f63ff95d6856f93ddff64578d05998aa0927c29fd03d94b15fe78b121692b942
-
Filesize
551KB
MD55d5ff285798b4fb701632f92a598142d
SHA1709d2346fd44ae3171afc065589f0db547b49eaf
SHA256d9dec9914a31e6396349186659c6ffb351cfb0766a8b5f9108fbaa41c92462d5
SHA512456a41902614f7c838c1cf68a96f551fad428629ac8f0738091f4b9ce73b3862f63ff95d6856f93ddff64578d05998aa0927c29fd03d94b15fe78b121692b942
-
Filesize
411KB
MD547b2c31bc568b8692b607bef27f4fa1d
SHA100e542b7fca1ee66030adaf40c8bbfaade17dd87
SHA25636200786c7e9c0b66636b0be13b8d15ceeb21ea797b59b4bd118ac21e3417207
SHA512bcd09ff477433baf937da073157f1800e0a03a95f792d7b62cb4f0d52b5d6446698192186dcbaf090d9a0627a5c1711d2b1f9d8589495e91268900bde8ea7f19
-
Filesize
1.1MB
MD56cf181e7db1b5d7776ddf5044c6188a9
SHA14da3f1865575d3eee8d420ac61015b7b9ef3c4d5
SHA2564f66bf85f00110ca3ee21d1e038b25c97c13e2f91cd514217ad59fca23ac5c02
SHA512d2ca52fa7362d7cb830807981b03efd4c78e9bfee2917b16b6b87b9f17393dbf2f938acc68f1f0aef7f55f7d6bf7113c4c06bd4aa1be1d2d196ab86ee050a294
-
Filesize
1.9MB
MD57c450e5f5ce44c5acb8f3b27f5f1dded
SHA1095c36b0db24a11389d901540e8b76c7aea518b0
SHA256480c4c286a55562468d29da6771d38020d81c0af9d3883be10fd4a2f3b50d0ec
SHA512c70a53d23d70cf93f3f9f40fbcb3cb7d49378185aa0c97683439900f5f2dae0cb7f6e279c856d56299dc993ffca786cd8e52239f2f2806096073f21bb00b63a4
-
Filesize
727KB
MD575654073797ec30585cb0d0531f741a3
SHA18d6ea13c4f767191a286fd012b20443772d4341d
SHA256db382ea923e2ec3da7f004b932faa7854ac723efd3a4d01d87f96d4bb5f145d7
SHA512ea13fb5c67344540398ee4467c66301681f1bf452bdc7a739d8eb611b98c89cf845e424283f0862e2bcf8650a7f803bf884e6e54f971b2bdd1ccd2a9e2cc103d
-
Filesize
727KB
MD575654073797ec30585cb0d0531f741a3
SHA18d6ea13c4f767191a286fd012b20443772d4341d
SHA256db382ea923e2ec3da7f004b932faa7854ac723efd3a4d01d87f96d4bb5f145d7
SHA512ea13fb5c67344540398ee4467c66301681f1bf452bdc7a739d8eb611b98c89cf845e424283f0862e2bcf8650a7f803bf884e6e54f971b2bdd1ccd2a9e2cc103d
-
Filesize
727KB
MD575654073797ec30585cb0d0531f741a3
SHA18d6ea13c4f767191a286fd012b20443772d4341d
SHA256db382ea923e2ec3da7f004b932faa7854ac723efd3a4d01d87f96d4bb5f145d7
SHA512ea13fb5c67344540398ee4467c66301681f1bf452bdc7a739d8eb611b98c89cf845e424283f0862e2bcf8650a7f803bf884e6e54f971b2bdd1ccd2a9e2cc103d
-
Filesize
839KB
MD5551e02af61cd1324f18ad0951f87eba7
SHA18a33d2332f345bb29b7409b7173f590473cc1f2a
SHA256affe4376e85fb36d30c31ee3cecb5dbd82e97d87d1fd04aff2b35789055189f3
SHA512e686f1883ebc1ea02a086e916ea315b4404c931e7b854bb31cf38d87a3ad51f840bd6ea0d0fed4489d33e6e9396f345285a76f3f235f94ad2bb3b1ef115e7268
-
Filesize
238KB
MD58786d469338c30e0ba9fedfc62bd5197
SHA15fb12028ceae9772f938e1b98b699f0e02e32718
SHA256beeaf8b72f7008e9adabacfcd85e32a50747a0dfb5c86802aeb973bd1f5c3d2f
SHA5125db1e5b78e62cda81a63e8e712e720f87a7c7a539237a55a9098c076f9fb4e0b5adb83383c23657b4ccc90c117e55e3946a399cdf3d15cb94444b203d9d6c45c
-
Filesize
1.1MB
MD52706693dda10c6cc79eed24c56d4e5ef
SHA14f34ef1bd49273a0d260b9dab15c73eb0ccb6383
SHA2560edad8a1af22d5b97c1f324791c86243a6ecce7b5a9d2f30415af99aba9129c3
SHA5127e7f7ae894528587ba33b6e10999549bb9a2ec2748b5662fa1b8806e5f4ce33af47507b3ef2954f2747a76b5b7c775c1cd671061f577c5016d1f8ba165bbe21c
-
Filesize
74.3MB
MD5dbdeda5c627771ca871dfc1bfc830843
SHA1016a0fc4b0b8a80c9ddb7d59997851139b225238
SHA2563d01828c32f3fbd23aecbd4e5213eaff3b62256ee947ba9fd8f04294e14ca47e
SHA5127713fc4166004bade360d3c764d663b07316dfec6d71b2ca336af0e959da8f51bc8e04389b2fde732fd24a4cd6e5b60c0e54fd6cad9681ca6402c6d41c78c02b
-
Filesize
64KB
-
Filesize
11.5MB
-
Filesize
11.5MB
-
Filesize
64KB
-
Filesize
64KB