Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

e8e16ac1f6...94.exe

windows7-x64

7

e8e16ac1f6...94.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    141s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2023, 10:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe

  • Size

    948KB

  • MD5

    42e158029ba6d9b1d3409993695ebc3e

  • SHA1

    af4f2f14718b382cd4591d5299a140844ad4a676

  • SHA256

    e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94

  • SHA512

    42db753164b1254bea780ed449eb49c1b5836fad58c7ac5bb4140eb36d4d1a5de6fe714a46bf71acc40dfd79d6b74ab6f80d696f6574b5c649767b50ee05c900

  • SSDEEP

    12288:Zgrykts3BqO0DoMOrGSYHcfLHDCCCkTanVQ4BiscoaYui0HoYoVp:+mko0pmL6c7pTanVZcoLuTo1

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 5 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe
    "C:\Users\Admin\AppData\Local\Temp\e8e16ac1f63d6f967c36f27376a1057771e16ede0c230236c5afb8f3d86c8b94.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\MailMagicLite.exe
      C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\MailMagicLite.exe C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1420

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\ChineseSimplified.ini
    Filesize

    33KB

    MD5

    98b5662486a5cba0f9f9eb173fe92c77

    SHA1

    9afaa104b2a98d2cf1af7b085f225a89cb05caf3

    SHA256

    475fdaaa0deed17cb4baf7aebbcc232f2ce98fc4def94e10cfc5a6b554b6514b

    SHA512

    d6e1ef5258755ec9ee012c0056a04336823661493b4f4d984ccba442821d22cd4754007399add3a96ddfcd42bd02072359e9e24546fbc0497e222a82e5e7089a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\LIBEAY32.dll
    Filesize

    364KB

    MD5

    dfd0a2b38848b849474f07e0cdc596b1

    SHA1

    6d5d3e3183dd391055263ac6ee19c9ac1281550d

    SHA256

    ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

    SHA512

    77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\MailMagicLite.exe
    Filesize

    332KB

    MD5

    97ec99c6569c16dd7267226df58109db

    SHA1

    d963aaa67d9047374aee30cd16ea1de1c0609791

    SHA256

    26ffa19df49aa1ed57fd91267236dca471ca59414c291cb5313ce4ff62de9ab8

    SHA512

    5ed65b89d021561a26101df0e61798bce291cc4428ddeaac16363aa889802c57dac24d3a7162867ec2f108fb2fe0694ea897a92d359ddf96bda0579bfc3e4071

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\MailMagicLite.exe
    Filesize

    332KB

    MD5

    97ec99c6569c16dd7267226df58109db

    SHA1

    d963aaa67d9047374aee30cd16ea1de1c0609791

    SHA256

    26ffa19df49aa1ed57fd91267236dca471ca59414c291cb5313ce4ff62de9ab8

    SHA512

    5ed65b89d021561a26101df0e61798bce291cc4428ddeaac16363aa889802c57dac24d3a7162867ec2f108fb2fe0694ea897a92d359ddf96bda0579bfc3e4071

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\SSLEAY32.dll
    Filesize

    66KB

    MD5

    0c29e546dbf1d3239f773bdd8cbd863c

    SHA1

    0d498107c1bc964cc399b1513e0bd9d9bf243de4

    SHA256

    0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

    SHA512

    aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\libeay32.dll
    Filesize

    364KB

    MD5

    dfd0a2b38848b849474f07e0cdc596b1

    SHA1

    6d5d3e3183dd391055263ac6ee19c9ac1281550d

    SHA256

    ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

    SHA512

    77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\ssleay32.dll
    Filesize

    66KB

    MD5

    0c29e546dbf1d3239f773bdd8cbd863c

    SHA1

    0d498107c1bc964cc399b1513e0bd9d9bf243de4

    SHA256

    0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

    SHA512

    aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\4e1b3e49-0c5d-4bdd-9fd4-812d31c56744\ssleay32.dll
    Filesize

    66KB

    MD5

    0c29e546dbf1d3239f773bdd8cbd863c

    SHA1

    0d498107c1bc964cc399b1513e0bd9d9bf243de4

    SHA256

    0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

    SHA512

    aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

    Download Submit

  • memory/1420-146-0x0000000010000000-0x00000000100F1000-memory.dmp

    Filesize

    964KB

    Download

  • memory/1420-147-0x00000000005E0000-0x000000000060C000-memory.dmp

    Filesize

    176KB

    Download