Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    134s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/03/2023, 18:44

General

  • Target

    Tracker-6.1.2-windows-x64-installer.exe

  • Size

    140.1MB

  • MD5

    f2ef96c32616189372aa4912667a21b8

  • SHA1

    9f786a03f94b0feb155d409a63d6613db9a0f93b

  • SHA256

    851eaeff0283fe2cfbbc235262f994576ad17703375fab4cab54046f124b16d5

  • SHA512

    d8ce172096145b63d228d6434d507d437f4d06c54b97bf4342ad0a00a71f871efa835275ed018250162752e46702ec3356c479fcad409cd31fb02c00658b033a

  • SSDEEP

    3145728:p3oVvZIiUGEG/ZNGDiI61nNgMoqsL3awmOpTsiUExUS:p4jljTFtNPoJT9mOZsiUEv

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 14 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Tracker-6.1.2-windows-x64-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\Tracker-6.1.2-windows-x64-installer.exe"
    1⤵
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:2184

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRA8E7.tmp

    Filesize

    64KB

    MD5

    d2e59ee980c15085bbe292082abec7e6

    SHA1

    30154e439177235e768c6fc9c7e6d83e9320a80b

    SHA256

    eb10d4d4b459f4bbaf611538ed8098c7fad5a839495085f3363b3bf1050c4958

    SHA512

    6f61f337ee24a8fab29afcbcd2a5e674c5745cf5caaba99e58fc9d762fae3620864262d23118728ed6d124ab51feeaa7d9057042b6a42bc9e49feda18005a7ca

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRA975.tmp

    Filesize

    356KB

    MD5

    c3c4f3fe90e3b3b02bea0e8da3447ed2

    SHA1

    7ac0f54119d2273a2cd261f1fe6c5667e9c486df

    SHA256

    3524ec77985e390acf9d07d81b1b44305165d711bbca770f7458ea0a78751f82

    SHA512

    0e24c9394c635a3f1671a297f97b613e6936cd8f862a214125d3456324a18668ae138d5c4fde036f55e2b13b158e4cebc53f78153862a008b1ae747eab228a60

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAA21.tmp

    Filesize

    59KB

    MD5

    f62dd6ce51e19349ec1d1f2e88c4ef4d

    SHA1

    60bd29538b4fecaf527ba8b7d92b7f32d2e72ddb

    SHA256

    be88244da9faaa6636a9d2f4c4249c08066a0b48359690b9b27a2b9ed47e093d

    SHA512

    ba68a59427ec252b895e1c3d6879e0c7a010893d23b5a8687ce86d738faaec1367f73abbcf63fb8ce8b95d32afa3049cd59f22f0bc5a2ff2a3b123a54fe02012

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAA61.tmp

    Filesize

    136KB

    MD5

    119e67e0b0add3f09aabbde47a599e17

    SHA1

    991c049d2466c5242f67e664159cb025f49e5c70

    SHA256

    439416fcebcf073600af44a2fb83428896dc8f69120ee4a76ee490a6428d6c94

    SHA512

    88d85765867555f8bf22db707ae49042db1a1bb1ed8a093afe4d10446b25e6400a2811f88bc5af9edb16b2b4f0366b09177cb9116c89e6950cb96b9fb2d93572

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAAA0.tmp

    Filesize

    513KB

    MD5

    5fbc6bd806a8a6c460faceeea73bd7f7

    SHA1

    4d1586a9631a72c3e1d75fb3c385dbd278804665

    SHA256

    8033d1b3af84d47d275e022608da35baac16cf40d9607ca026a47b6cd65e6a97

    SHA512

    4c51f9f331ac15206942e13504334b4c3549888519388607c44b617a68a9095114b0e6127e82b84170445df06260cc62308bc197b90cfb95af18d7cb6d413195

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRABDA.tmp

    Filesize

    235KB

    MD5

    51c675fc1ef0a62322052d3e86567c06

    SHA1

    e295d0b668105d81f9180ef1056d0528e4b2116a

    SHA256

    aaa3d7e589e9be1911eee5974afa68c64af1bbd5e039ff6a82a15c2b54c0f9f0

    SHA512

    a352e82db5c930c73165a48337ae51acda7ebd393b8b0b57d03d2e1b5057c41c26b1f321759b7bc521166890853ecdad7b37531212243ad86e181e2252a3b78d

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAC19.tmp

    Filesize

    18KB

    MD5

    6d2c718c3059ceaa7b90919e6725a09a

    SHA1

    489967f8fe2b9021a891112754b840fe7dc71d13

    SHA256

    2ca70bc6394ee1b299a8cf1fe28e95c7d68b765e1828db1b651a7a62acae5356

    SHA512

    37547e9c6080d0dcb3ea23d9c856ce689997275b40d72bf9fd7c7c165e8cee4afe2ebe52e052c5f8bfc3e618391425219e9681191ee6f650444ebd643cb5a50d

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAD14.tmp

    Filesize

    19KB

    MD5

    a56543b9cd3aa403311b49189d25851e

    SHA1

    bd2609d35d4a967fe23ef4092b1daa6f74a858ad

    SHA256

    034756f772399552cd33605a189ee0e45d7947860e0d83ec12aa6da1a5a42054

    SHA512

    2237f493d70799675ae0e395f551b6cd46ff4789e46e2453c48fede07b7623b4b8111904d6fa139c204eea4405b5fd5812b0a91f27374219b721339149c25edf

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAF29.tmp

    Filesize

    96KB

    MD5

    9b299884420745d80c70bba6b8a7f05a

    SHA1

    195423185a7776e072a65fbabae868c15f7b2f56

    SHA256

    9426e96a97f41645fab524385a852687792f99b505554b6b9809ed99451b2399

    SHA512

    ed839dc1b6ef53f3663b6055fb2869a522600b2af8d8a800958ddb531154f4e9a3f1733f32dff5511a22fe01525191c8683519cbdcedec138b1bcf3425f2155b

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAF49.tmp

    Filesize

    115KB

    MD5

    54431791b0b31ccd0112486f542858a1

    SHA1

    e628f2dc29d039d474f97fe67e562bd8798c6ba6

    SHA256

    b382c74f532ab766c272ed11b107a3ef7c015cca2e716243379058c084981332

    SHA512

    fab7561a312afdc92dcf70fe8a80356914153bdb9ff46d64b8f4e8d872a5a619a72a9ae5a8af656f371a59672737fe5990d33990154ad3b5d006a68cbefd01f3

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAFC7.tmp

    Filesize

    53KB

    MD5

    2c8f6a964ca7761122f7da22042462f4

    SHA1

    290e48bf0f83b3f3832f69bb1ea0637ed4d8ccca

    SHA256

    9d6f2629aa5978dd6b87fe9bce77a5cf0135b8da2980a050579eb4e23a92f8fa

    SHA512

    88c49dbc5a5cce28fc61689b953e091dc5114196a9ce5977de1bc1ea916333d73a13d06abb56b7afd88f6c4f80953a2b9b720cd79e773a1246d44b37eae4cbf8

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRAFD8.tmp

    Filesize

    53KB

    MD5

    4640fd47f64bb72cb34dbafee65dbdde

    SHA1

    508c8713e06ba55588d41918c5a99308cb4b37a0

    SHA256

    f02c4352ea80e1b476eb4754455ae684efb4289d95edf925e38bd3789f6ead49

    SHA512

    de2d05ea66ab37b7120cde8f4aeb79c6365430bd94f56b07019451e1329f8f3a2674af9ed6677b8ade59fa2185c6a48eaead47091edc8284e686260c69544a4c

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRB007.tmp

    Filesize

    218KB

    MD5

    7190ecf05ec3b297d6ded3e204399e95

    SHA1

    5c085cbbbcc8686266acfb318e75a38794625e88

    SHA256

    49e2c502923de5f89958de86f1cc6f91e7ddafe46d0f81bfb51a669627650e6e

    SHA512

    4e12adcaaebdc08e06270437dd4ebf33c4aecd5b6cce7245bf12b0303c809465d75d5b319fb262a807cf9a5cb99d808e466fc30b19d88ddcf2b3f0b9c9f74881

  • C:\Users\Admin\AppData\Local\Temp\BRL00000888\BRB057.tmp

    Filesize

    125KB

    MD5

    053a60f34c75ca0a4a821b46eae86d31

    SHA1

    ebcf9f84a393969655969c248c2d572d7a05541c

    SHA256

    683f19a461948f4cca2fbece26949b34d6347dff279efece983b9f64a868422c

    SHA512

    346c989ef320079b5978678264059ad9e545081dded233d10dca73a72906fa01df30a3c96f6d319efcea64c198ef409748e511dab8a4d43e1fa7af50ed3f0256

  • memory/2184-203-0x0000000000C40000-0x0000000000F3F000-memory.dmp

    Filesize

    3.0MB

  • memory/2184-206-0x00000000710C0000-0x00000000710E3000-memory.dmp

    Filesize

    140KB

  • memory/2184-205-0x0000000066680000-0x0000000066695000-memory.dmp

    Filesize

    84KB

  • memory/2184-204-0x0000000056FF0000-0x0000000057005000-memory.dmp

    Filesize

    84KB

  • memory/2184-207-0x0000000067C80000-0x0000000067D09000-memory.dmp

    Filesize

    548KB

  • memory/2184-208-0x000000006C580000-0x000000006C599000-memory.dmp

    Filesize

    100KB

  • memory/2184-210-0x000000006CA00000-0x000000006CA0E000-memory.dmp

    Filesize

    56KB

  • memory/2184-209-0x0000000056FE0000-0x0000000056FEE000-memory.dmp

    Filesize

    56KB

  • memory/2184-211-0x0000000066C00000-0x0000000066C1B000-memory.dmp

    Filesize

    108KB

  • memory/2184-212-0x0000000067E00000-0x0000000067E20000-memory.dmp

    Filesize

    128KB

  • memory/2184-213-0x0000000063980000-0x0000000063994000-memory.dmp

    Filesize

    80KB

  • memory/2184-214-0x0000000063100000-0x0000000063114000-memory.dmp

    Filesize

    80KB

  • memory/2184-215-0x000000006A180000-0x000000006A1B9000-memory.dmp

    Filesize

    228KB

  • memory/2184-216-0x0000000066080000-0x00000000660A3000-memory.dmp

    Filesize

    140KB

  • memory/2184-217-0x0000000000C40000-0x0000000000F3F000-memory.dmp

    Filesize

    3.0MB

  • memory/2184-231-0x0000000000C40000-0x0000000000F3F000-memory.dmp

    Filesize

    3.0MB

  • memory/2184-245-0x0000000000C40000-0x0000000000F3F000-memory.dmp

    Filesize

    3.0MB

  • memory/2184-259-0x0000000000C40000-0x0000000000F3F000-memory.dmp

    Filesize

    3.0MB