Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2023, 13:07

General

  • Target

    d3d6685942c48093280cfe225781d898b0c2af4c4393886dbaaa428d20f083a2.exe

  • Size

    948KB

  • MD5

    32c522f406310a762bd567cb1d8170d9

  • SHA1

    fde54e68f8c9d718da268c9eb5f3a09fbecd6c37

  • SHA256

    d3d6685942c48093280cfe225781d898b0c2af4c4393886dbaaa428d20f083a2

  • SHA512

    f2174c238851c13bcbb58c5c0af8d2d4e495d09112703aa785a7e064d7ed07f198d1a55a345c3fd7202070ed3ee87fe04d3f421780172c20a5952cfd50abc1e9

  • SSDEEP

    12288:Zgrykts3BqO0DoMOrGSYHcfLHDCCCkTanVQ4Bi3coaYui0HoYoVsC:+mko0pmL6c7pTanVicoLuToT

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 6 IoCs

    Detects file using ACProtect software.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 4 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3d6685942c48093280cfe225781d898b0c2af4c4393886dbaaa428d20f083a2.exe
    "C:\Users\Admin\AppData\Local\Temp\d3d6685942c48093280cfe225781d898b0c2af4c4393886dbaaa428d20f083a2.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:628
    • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\MailMagicLite.exe
      C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\MailMagicLite.exe C:\Users\Admin\AppData\Local\Temp\
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:4284

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\ChineseSimplified.ini

    Filesize

    33KB

    MD5

    98b5662486a5cba0f9f9eb173fe92c77

    SHA1

    9afaa104b2a98d2cf1af7b085f225a89cb05caf3

    SHA256

    475fdaaa0deed17cb4baf7aebbcc232f2ce98fc4def94e10cfc5a6b554b6514b

    SHA512

    d6e1ef5258755ec9ee012c0056a04336823661493b4f4d984ccba442821d22cd4754007399add3a96ddfcd42bd02072359e9e24546fbc0497e222a82e5e7089a

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\LIBEAY32.dll

    Filesize

    364KB

    MD5

    dfd0a2b38848b849474f07e0cdc596b1

    SHA1

    6d5d3e3183dd391055263ac6ee19c9ac1281550d

    SHA256

    ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

    SHA512

    77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\MailMagicLite.exe

    Filesize

    332KB

    MD5

    1f327a1b18e15cf78999a365ef0093dc

    SHA1

    c3f6c8bc85fe87ba090ce91b980cca1e2fda72d8

    SHA256

    0a63d315ea25a2928a0311be90cb2ae1d9f8b88933d5296ff2020fb72050860a

    SHA512

    10b47fed5e5e1578112c4c9cb099a12f0c23b6bb451d42038a379c2c5f52290b6b8044c7c446d82eeebef5f8533d108e3af45649b080131ffa08c7746ba3424e

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\MailMagicLite.exe

    Filesize

    332KB

    MD5

    1f327a1b18e15cf78999a365ef0093dc

    SHA1

    c3f6c8bc85fe87ba090ce91b980cca1e2fda72d8

    SHA256

    0a63d315ea25a2928a0311be90cb2ae1d9f8b88933d5296ff2020fb72050860a

    SHA512

    10b47fed5e5e1578112c4c9cb099a12f0c23b6bb451d42038a379c2c5f52290b6b8044c7c446d82eeebef5f8533d108e3af45649b080131ffa08c7746ba3424e

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\SSLEAY32.dll

    Filesize

    66KB

    MD5

    0c29e546dbf1d3239f773bdd8cbd863c

    SHA1

    0d498107c1bc964cc399b1513e0bd9d9bf243de4

    SHA256

    0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

    SHA512

    aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\libeay32.dll

    Filesize

    364KB

    MD5

    dfd0a2b38848b849474f07e0cdc596b1

    SHA1

    6d5d3e3183dd391055263ac6ee19c9ac1281550d

    SHA256

    ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

    SHA512

    77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\libeay32.dll

    Filesize

    364KB

    MD5

    dfd0a2b38848b849474f07e0cdc596b1

    SHA1

    6d5d3e3183dd391055263ac6ee19c9ac1281550d

    SHA256

    ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

    SHA512

    77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\libeay32.dll

    Filesize

    364KB

    MD5

    dfd0a2b38848b849474f07e0cdc596b1

    SHA1

    6d5d3e3183dd391055263ac6ee19c9ac1281550d

    SHA256

    ad449bbbf1dcee2dc445231ec4103dd98c29f4eba8023a3bb684170780df35d6

    SHA512

    77d0febc33cf041fc26f412ec8e45b859bdb9fda12536200462cf9f8008fdbd6f1655a02ab9e6a9b3f12bd6957eefbd5d17cf36053d5f672b4e52c56c62f05c6

  • C:\Users\Admin\AppData\Local\Temp\b03e5c7d-12cc-4cac-96d9-13cfe662724a\ssleay32.dll

    Filesize

    66KB

    MD5

    0c29e546dbf1d3239f773bdd8cbd863c

    SHA1

    0d498107c1bc964cc399b1513e0bd9d9bf243de4

    SHA256

    0bcb221776c620078998a4edfd1b8041123f239f7a6ac8c71356011f9f49f80b

    SHA512

    aa79600407ec6eca70e14e42fc5f4a64b599ed13e10eb32bce8ea24e7fce3dda504550d411b447356b1c068e17cbbc394836050dfa439d17c54269ff4041f3d1

  • memory/4284-148-0x00000000009E0000-0x0000000000AD1000-memory.dmp

    Filesize

    964KB

  • memory/4284-147-0x00000000009E0000-0x0000000000AD1000-memory.dmp

    Filesize

    964KB

  • memory/4284-145-0x0000000010000000-0x000000001002C000-memory.dmp

    Filesize

    176KB

  • memory/4284-150-0x00000000009E0000-0x0000000000AD1000-memory.dmp

    Filesize

    964KB

  • memory/4284-151-0x0000000010000000-0x000000001002C000-memory.dmp

    Filesize

    176KB