Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10137b35a162...4d.exe
windows7-x64
137b35a162...4d.exe
windows10-2004-x64
2030669b9d...1f.exe
windows7-x64
102030669b9d...1f.exe
windows10-2004-x64
10241b251516...7b.exe
windows7-x64
10241b251516...7b.exe
windows10-2004-x64
104ae73bfefe...44.exe
windows7-x64
104ae73bfefe...44.exe
windows10-2004-x64
104c312e3cce...5c.exe
windows7-x64
104c312e3cce...5c.exe
windows10-2004-x64
10540eb4eb6d...67.exe
windows7-x64
10540eb4eb6d...67.exe
windows10-2004-x64
95e1a82be9d...ee.exe
windows7-x64
105e1a82be9d...ee.exe
windows10-2004-x64
10a9b51a1c84...5e.exe
windows7-x64
10a9b51a1c84...5e.exe
windows10-2004-x64
10abbaee1408...19.exe
windows7-x64
10abbaee1408...19.exe
windows10-2004-x64
10ba794fac4a...ff.exe
windows7-x64
10ba794fac4a...ff.exe
windows10-2004-x64
10c2d55f54c2...12.doc
windows7-x64
4c2d55f54c2...12.doc
windows10-2004-x64
1e42d6acc64...6d.exe
windows7-x64
10e42d6acc64...6d.exe
windows10-2004-x64
10Analysis
-
max time kernel
77s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
137b35a1620fae21dec2f0c3a131d9a0d29cfcd9e82ce8f834eb77d4f4016d4d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
137b35a1620fae21dec2f0c3a131d9a0d29cfcd9e82ce8f834eb77d4f4016d4d.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
241b2515168df42784e10af72536a6d661d8bd483abae1931d81f11c8ebcdf7b.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
241b2515168df42784e10af72536a6d661d8bd483abae1931d81f11c8ebcdf7b.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
4ae73bfefefb1e74a928827cf4f59b3f136e739775209353af6d43bb5bde0d44.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
4ae73bfefefb1e74a928827cf4f59b3f136e739775209353af6d43bb5bde0d44.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
5e1a82be9d8f3ed23343ff5dd356625fabb8a16fb2e8e637051913a9f05342ee.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
5e1a82be9d8f3ed23343ff5dd356625fabb8a16fb2e8e637051913a9f05342ee.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
a9b51a1c8409470cf8204ec646aabdd91cf7aa424dfaeaf5e58447e65065925e.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
a9b51a1c8409470cf8204ec646aabdd91cf7aa424dfaeaf5e58447e65065925e.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
abbaee140815099a2d6b0d4edbc24c39f18bb451a32e67a18c511c7a164b7e19.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
abbaee140815099a2d6b0d4edbc24c39f18bb451a32e67a18c511c7a164b7e19.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral19
Sample
ba794fac4af75d1fb23270a772d17d36b2d84606cffb38a991e41a22a21b7cff.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
ba794fac4af75d1fb23270a772d17d36b2d84606cffb38a991e41a22a21b7cff.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
c2d55f54c26d6f73908c7138e999fadcb9a8617fea8f56cee943f93956adfa12.doc
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
c2d55f54c26d6f73908c7138e999fadcb9a8617fea8f56cee943f93956adfa12.doc
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
e42d6acc643608d3be98a986efbb2ae23865c200b4f029182943a8b6447acf6d.exe
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
e42d6acc643608d3be98a986efbb2ae23865c200b4f029182943a8b6447acf6d.exe
Resource
win10v2004-20230220-en
General
-
Target
540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe
-
Size
945KB
-
MD5
8c954b7b1b63e226c6997b1e0260ba69
-
SHA1
47676b03a41c3711842091156984754b25a4771c
-
SHA256
540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267
-
SHA512
c449ef2778e286c5add39c5bae7c9a0fd3fce23f034f68d4f49e9c0ac5373289d7d82d475253dbf984aaf4140023ba396556194de66182bcf3ab3fb71f4cbe2e
-
SSDEEP
12288:ZV+mzTiV2KQ4p2+fk104bYOgTY3+0dXHjVqouwYnb3pENT4a/gFDV3MzQHmVbb:Z858F+81XYHTm+GoouwCZENVgH88HmVX
Malware Config
Signatures
-
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral12/files/0x000400000000073b-157.dat MailPassView behavioral12/files/0x000400000000073b-163.dat MailPassView behavioral12/files/0x000400000000073b-164.dat MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral12/files/0x000400000000073b-157.dat WebBrowserPassView behavioral12/files/0x000400000000073b-163.dat WebBrowserPassView behavioral12/files/0x000400000000073b-164.dat WebBrowserPassView -
Nirsoft 3 IoCs
resource yara_rule behavioral12/files/0x000400000000073b-157.dat Nirsoft behavioral12/files/0x000400000000073b-163.dat Nirsoft behavioral12/files/0x000400000000073b-164.dat Nirsoft -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation 540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation orimi.sfx.exe Key value queried \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation orimi.exe -
Executes dropped EXE 3 IoCs
pid Process 1404 orimi.sfx.exe 3376 orimi.exe 4300 0rin.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 39 whatismyipaddress.com 43 whatismyipaddress.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000_Classes\Local Settings orimi.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4596 wrote to memory of 3564 4596 540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe 85 PID 4596 wrote to memory of 3564 4596 540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe 85 PID 4596 wrote to memory of 3564 4596 540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe 85 PID 3564 wrote to memory of 1404 3564 cmd.exe 87 PID 3564 wrote to memory of 1404 3564 cmd.exe 87 PID 3564 wrote to memory of 1404 3564 cmd.exe 87 PID 1404 wrote to memory of 3376 1404 orimi.sfx.exe 88 PID 1404 wrote to memory of 3376 1404 orimi.sfx.exe 88 PID 1404 wrote to memory of 3376 1404 orimi.sfx.exe 88 PID 3376 wrote to memory of 4300 3376 orimi.exe 89 PID 3376 wrote to memory of 4300 3376 orimi.exe 89 PID 3376 wrote to memory of 4300 3376 orimi.exe 89 PID 3376 wrote to memory of 4292 3376 orimi.exe 91 PID 3376 wrote to memory of 4292 3376 orimi.exe 91 PID 4292 wrote to memory of 2224 4292 javaw.exe 92 PID 4292 wrote to memory of 2224 4292 javaw.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe"C:\Users\Admin\AppData\Local\Temp\540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\eisde33w7t54e0bbgi.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\orimi.sfx.exeorimi.sfx.exe -piodfse34w882dfsi -dC:\Users\Admin\AppData\Local\Temp3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\RarSFX1\orimi.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\orimi.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\0rin.exe"C:\Users\Admin\AppData\Local\Temp\0rin.exe"5⤵
- Executes dropped EXE
PID:4300
-
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\orim.jar"5⤵
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.73911316443715019033628210444898505.class6⤵PID:2224
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5fe25cf267c3ff8732f81a438a195ce7e
SHA1131e654b56ea9e39abd0b0231f869d6fa4a84b58
SHA256b6b5ab4cbe9ae8fcdba3377cd5a70254caeb5f7a22ba78ee09eef6d412196bf4
SHA51249edffd82d8c50f4dbcbcb17e56901acb57ca35213791304387065811ec250b328ae133c6a27c67e8394212ab197f1dd342c968a11493a98887759595671cf1c
-
Filesize
502KB
MD532a5395bd5e6c5fd25704000077aea8b
SHA1e96ebe86c955756f0be6ffbe993269651949bfc8
SHA256e51d61462bf93a5dedd37a71332e61c003fc46cf40b328233364891ad47b6f41
SHA51256987571b6a735a43ae80f20c948a77595b07fc7286a1da9bc25c320f8cb907140ac0bf78521977e496d1af25c8d37022fd9ccab1863d7cabca2a2cb5cae95c4
-
Filesize
502KB
MD532a5395bd5e6c5fd25704000077aea8b
SHA1e96ebe86c955756f0be6ffbe993269651949bfc8
SHA256e51d61462bf93a5dedd37a71332e61c003fc46cf40b328233364891ad47b6f41
SHA51256987571b6a735a43ae80f20c948a77595b07fc7286a1da9bc25c320f8cb907140ac0bf78521977e496d1af25c8d37022fd9ccab1863d7cabca2a2cb5cae95c4
-
Filesize
502KB
MD532a5395bd5e6c5fd25704000077aea8b
SHA1e96ebe86c955756f0be6ffbe993269651949bfc8
SHA256e51d61462bf93a5dedd37a71332e61c003fc46cf40b328233364891ad47b6f41
SHA51256987571b6a735a43ae80f20c948a77595b07fc7286a1da9bc25c320f8cb907140ac0bf78521977e496d1af25c8d37022fd9ccab1863d7cabca2a2cb5cae95c4
-
Filesize
41B
MD5acba6e1cd59b8530089cd5bc0e4fa3f5
SHA172acc3eeded8af656a52fff77cf25d9546767864
SHA256c2bda0b74b66e35822281059f43bd31ca7c3f1d885fc0bdc92372da01793695b
SHA51260c24e2231a4ccb573a5f37e0736e6513f622997ba461f00978ed1be561139676b71f352d3d8d9bf16ecf4b03cc232704e3e3877936e9048a738057fd90a07f4
-
Filesize
894KB
MD5dcb154f08779bceee91d88abdf29fe98
SHA18251e71f8518d7b8913e8ab5ce283de194aa7eff
SHA2560b366060e0189a9b85ea6efb29bbb8142a168be3fabca60c67c3fd6a20a6193e
SHA512ca8d9c9165900c9282d368516aa7aad3e603d71d37c4b40b192db0317b5222c9672fe29fb5c89d01941c253ce51b0360d94b0dcb7942cb14fd72e90ae5989da2
-
Filesize
894KB
MD5dcb154f08779bceee91d88abdf29fe98
SHA18251e71f8518d7b8913e8ab5ce283de194aa7eff
SHA2560b366060e0189a9b85ea6efb29bbb8142a168be3fabca60c67c3fd6a20a6193e
SHA512ca8d9c9165900c9282d368516aa7aad3e603d71d37c4b40b192db0317b5222c9672fe29fb5c89d01941c253ce51b0360d94b0dcb7942cb14fd72e90ae5989da2
-
Filesize
802KB
MD5ba16b0741b90153284a324fac53f8a91
SHA1ef4d0855352cfe8aa5675e1cecb4d87298a84098
SHA2569c4324bf614dd4edf60abad7c7d97c6e67ee37977dc7c4d00be096ea22efac74
SHA512351b829ee345bf8ce06d714f5e1e0ce734ff2bd8816bb1c14480d34517226417019a38eed78303af2c3cd7c668b1eada26430004d643b32bfec6ac50aec7c8b2
-
Filesize
802KB
MD5ba16b0741b90153284a324fac53f8a91
SHA1ef4d0855352cfe8aa5675e1cecb4d87298a84098
SHA2569c4324bf614dd4edf60abad7c7d97c6e67ee37977dc7c4d00be096ea22efac74
SHA512351b829ee345bf8ce06d714f5e1e0ce734ff2bd8816bb1c14480d34517226417019a38eed78303af2c3cd7c668b1eada26430004d643b32bfec6ac50aec7c8b2
-
Filesize
802KB
MD5ba16b0741b90153284a324fac53f8a91
SHA1ef4d0855352cfe8aa5675e1cecb4d87298a84098
SHA2569c4324bf614dd4edf60abad7c7d97c6e67ee37977dc7c4d00be096ea22efac74
SHA512351b829ee345bf8ce06d714f5e1e0ce734ff2bd8816bb1c14480d34517226417019a38eed78303af2c3cd7c668b1eada26430004d643b32bfec6ac50aec7c8b2
-
Filesize
241KB
MD5781fb531354d6f291f1ccab48da6d39f
SHA19ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA25697d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA5123e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
-
Filesize
479KB
MD56a8979d38cd1d99c33eaa74aa7775143
SHA1efa1b842a8c66c2800e870f090eaeddca0bacdb6
SHA25650fb5acf95563164b7c3e5a922641cfefbfec4abb6d31439dc69fba075ca4b56
SHA5124e529d575800446246c7011c907c5dd7169892680d3a8fc126b22d0996e6a1819e013da41133090bc1f287d4358b059d3d5f1c48f57d02a0a148cdd0e0150acb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2275444769-3691835758-4097679484-1000\83aa4cc77f591dfc2374580bbd95f6ba_6d187d53-139c-415c-b71c-a4b59992e636
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd