Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2023, 10:58
Static task
static1
Behavioral task
behavioral1
Sample
e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe
Resource
win10v2004-20230220-en
General
-
Target
e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe
-
Size
948KB
-
MD5
42e158029ba6d9b1d3409993695ebc3e
-
SHA1
af4f2f14718b382cd4591d5299a140844ad4a676
-
SHA256
e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94
-
SHA512
42db753164b1254bea780ed449eb49c1b5836fad58c7ac5bb4140eb36d4d1a5de6fe714a46bf71acc40dfd79d6b74ab6f80d696f6574b5c649767b50ee05c900
-
SSDEEP
12288:Zgrykts3BqO0DoMOrGSYHcfLHDCCCkTanVQ4BiscoaYui0HoYoVp:+mko0pmL6c7pTanVZcoLuTo1
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 5 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0008000000021639-142.dat acprotect behavioral2/files/0x00090000000215b7-140.dat acprotect behavioral2/files/0x0008000000021639-141.dat acprotect behavioral2/files/0x00090000000215b7-144.dat acprotect behavioral2/files/0x00090000000215b7-143.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1420 MailMagicLite.exe -
Loads dropped DLL 3 IoCs
pid Process 1420 MailMagicLite.exe 1420 MailMagicLite.exe 1420 MailMagicLite.exe -
resource yara_rule behavioral2/files/0x0008000000021639-142.dat upx behavioral2/files/0x00090000000215b7-140.dat upx behavioral2/files/0x0008000000021639-141.dat upx behavioral2/files/0x00090000000215b7-144.dat upx behavioral2/files/0x00090000000215b7-143.dat upx behavioral2/memory/1420-146-0x0000000010000000-0x00000000100F1000-memory.dmp upx behavioral2/memory/1420-147-0x00000000005E0000-0x000000000060C000-memory.dmp upx -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1368 e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe 1420 MailMagicLite.exe 1420 MailMagicLite.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1368 wrote to memory of 1420 1368 e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe 84 PID 1368 wrote to memory of 1420 1368 e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe 84 PID 1368 wrote to memory of 1420 1368 e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe"C:\Users\Admin\AppData\Local\Temp\e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\MailMagicLite.exeC:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\MailMagicLite.exe C:\Users\Admin\AppData\Local\Temp\2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1420
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD598b5662486a5cba0f9f9eb173fe92c77
SHA19afaa104b2a98d2cf1af7b085f225a89cb05caf3
SHA256475fdaaa0deed17cb4baf7aebbcc232f2ce98fc4def94e10cfc5a6b554b6514b
SHA512d6e1ef5258755ec9ee012c0056a04336823661493b4f4d984ccba442821d22cd4754007399add3a96ddfcd42bd02072359e9e24546fbc0497e222a82e5e7089a
-
Filesize
364KB
MD5dfd0a2b38848b849474f07e0cdc596b1
SHA16d5d3e3183dd391055263ac6ee19c9ac1281550d
SHA256ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6
SHA51277d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6
-
Filesize
332KB
MD597ec99c6569c16dd7267226df58109db
SHA1d963aaa67d9047374aee30cd16ea1de1c0609791
SHA25626ffa19df49aa1ed57fd91267236dca471ca59414c291cb5313ce4ff62de9ab8
SHA5125ed65b89d021561a26101df0e61798bce291cc4428ddeaac16363aa889802c57dac24d3a7162867ec2f108fb2fe0694ea897a92d359ddf96bda0579bfc3e4071
-
Filesize
332KB
MD597ec99c6569c16dd7267226df58109db
SHA1d963aaa67d9047374aee30cd16ea1de1c0609791
SHA25626ffa19df49aa1ed57fd91267236dca471ca59414c291cb5313ce4ff62de9ab8
SHA5125ed65b89d021561a26101df0e61798bce291cc4428ddeaac16363aa889802c57dac24d3a7162867ec2f108fb2fe0694ea897a92d359ddf96bda0579bfc3e4071
-
Filesize
66KB
MD50c29e546dbf1d3239f773bdd8cbd863c
SHA10d498107c1bc964cc399b1513e0bd9d9bf243de4
SHA2560bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b
SHA512aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1
-
Filesize
364KB
MD5dfd0a2b38848b849474f07e0cdc596b1
SHA16d5d3e3183dd391055263ac6ee19c9ac1281550d
SHA256ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6
SHA51277d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6
-
Filesize
66KB
MD50c29e546dbf1d3239f773bdd8cbd863c
SHA10d498107c1bc964cc399b1513e0bd9d9bf243de4
SHA2560bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b
SHA512aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1
-
Filesize
66KB
MD50c29e546dbf1d3239f773bdd8cbd863c
SHA10d498107c1bc964cc399b1513e0bd9d9bf243de4
SHA2560bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b
SHA512aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1