Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10137b35a162...4d.exe
windows7-x64
137b35a162...4d.exe
windows10-2004-x64
2030669b9d...1f.exe
windows7-x64
102030669b9d...1f.exe
windows10-2004-x64
10241b251516...7b.exe
windows7-x64
10241b251516...7b.exe
windows10-2004-x64
104ae73bfefe...44.exe
windows7-x64
104ae73bfefe...44.exe
windows10-2004-x64
104c312e3cce...5c.exe
windows7-x64
104c312e3cce...5c.exe
windows10-2004-x64
10540eb4eb6d...67.exe
windows7-x64
10540eb4eb6d...67.exe
windows10-2004-x64
95e1a82be9d...ee.exe
windows7-x64
105e1a82be9d...ee.exe
windows10-2004-x64
10a9b51a1c84...5e.exe
windows7-x64
10a9b51a1c84...5e.exe
windows10-2004-x64
10abbaee1408...19.exe
windows7-x64
10abbaee1408...19.exe
windows10-2004-x64
10ba794fac4a...ff.exe
windows7-x64
10ba794fac4a...ff.exe
windows10-2004-x64
10c2d55f54c2...12.doc
windows7-x64
4c2d55f54c2...12.doc
windows10-2004-x64
1e42d6acc64...6d.exe
windows7-x64
10e42d6acc64...6d.exe
windows10-2004-x64
10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2023, 14:35
Static task
static1
Behavioral task
behavioral1
Sample
137b35a1620fae21dec2f0c3a131d9a0d29cfcd9e82ce8f834eb77d4f4016d4d.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
137b35a1620fae21dec2f0c3a131d9a0d29cfcd9e82ce8f834eb77d4f4016d4d.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
241b2515168df42784e10af72536a6d661d8bd483abae1931d81f11c8ebcdf7b.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
241b2515168df42784e10af72536a6d661d8bd483abae1931d81f11c8ebcdf7b.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
4ae73bfefefb1e74a928827cf4f59b3f136e739775209353af6d43bb5bde0d44.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
4ae73bfefefb1e74a928827cf4f59b3f136e739775209353af6d43bb5bde0d44.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
4c312e3cce557ee17db0299bcc112699e616fb162afdadf12a41815a4a314b5c.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
540eb4eb6d4b81ba016cea7899b4aa104a38d0a539bf018140fb552de00ee267.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
5e1a82be9d8f3ed23343ff5dd356625fabb8a16fb2e8e637051913a9f05342ee.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
5e1a82be9d8f3ed23343ff5dd356625fabb8a16fb2e8e637051913a9f05342ee.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
a9b51a1c8409470cf8204ec646aabdd91cf7aa424dfaeaf5e58447e65065925e.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
a9b51a1c8409470cf8204ec646aabdd91cf7aa424dfaeaf5e58447e65065925e.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
abbaee140815099a2d6b0d4edbc24c39f18bb451a32e67a18c511c7a164b7e19.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
abbaee140815099a2d6b0d4edbc24c39f18bb451a32e67a18c511c7a164b7e19.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral19
Sample
ba794fac4af75d1fb23270a772d17d36b2d84606cffb38a991e41a22a21b7cff.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
ba794fac4af75d1fb23270a772d17d36b2d84606cffb38a991e41a22a21b7cff.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
c2d55f54c26d6f73908c7138e999fadcb9a8617fea8f56cee943f93956adfa12.doc
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
c2d55f54c26d6f73908c7138e999fadcb9a8617fea8f56cee943f93956adfa12.doc
Resource
win10v2004-20230220-en
Behavioral task
behavioral23
Sample
e42d6acc643608d3be98a986efbb2ae23865c200b4f029182943a8b6447acf6d.exe
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
e42d6acc643608d3be98a986efbb2ae23865c200b4f029182943a8b6447acf6d.exe
Resource
win10v2004-20230220-en
General
-
Target
2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe
-
Size
823KB
-
MD5
65510e95f239192ac363a192203c1d2c
-
SHA1
1f35acbc9389e21cfd77cc74f4b633d77b0c732d
-
SHA256
2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f
-
SHA512
9c801085ad441790e8cb761fac082ba69fcb7fb47ee67773029072fd37c20c24214dc8a824a346d181cf0dec486dc4fc61162a0373e17e4ca90c5670f1316558
-
SSDEEP
12288:d0ueVG7/ksXLRittWVAChSaglFAk+JFuLRGzD8PjDLAvJ9e9g0EjslPYHD+e8Rx+:3eE4skttWVAJayHLoDC/ABFaNYj1
Malware Config
Signatures
-
M00nd3v_Logger
M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.
-
resource yara_rule behavioral4/files/0x000400000000072d-138.dat m00nd3v_logger behavioral4/files/0x000400000000072d-143.dat m00nd3v_logger behavioral4/files/0x000400000000072d-145.dat m00nd3v_logger -
NirSoft MailPassView 3 IoCs
Password recovery tool for various email clients
resource yara_rule behavioral4/files/0x000400000000072d-138.dat MailPassView behavioral4/files/0x000400000000072d-143.dat MailPassView behavioral4/files/0x000400000000072d-145.dat MailPassView -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
resource yara_rule behavioral4/files/0x000400000000072d-138.dat WebBrowserPassView behavioral4/files/0x000400000000072d-143.dat WebBrowserPassView behavioral4/files/0x000400000000072d-145.dat WebBrowserPassView -
Nirsoft 3 IoCs
resource yara_rule behavioral4/files/0x000400000000072d-138.dat Nirsoft behavioral4/files/0x000400000000072d-143.dat Nirsoft behavioral4/files/0x000400000000072d-145.dat Nirsoft -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe -
Executes dropped EXE 1 IoCs
pid Process 3360 0ri.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 29 bot.whatismyipaddress.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 456 javaw.exe 3472 java.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4132 wrote to memory of 3360 4132 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe 86 PID 4132 wrote to memory of 3360 4132 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe 86 PID 4132 wrote to memory of 3360 4132 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe 86 PID 4132 wrote to memory of 456 4132 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe 88 PID 4132 wrote to memory of 456 4132 2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe 88 PID 456 wrote to memory of 3472 456 javaw.exe 89 PID 456 wrote to memory of 3472 456 javaw.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe"C:\Users\Admin\AppData\Local\Temp\2030669b9dc24b34099a10012ea0850380a10205475657c3f8e2d34b5e91551f.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\0ri.exe"C:\Users\Admin\AppData\Local\Temp\0ri.exe"2⤵
- Executes dropped EXE
PID:3360
-
-
C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe"C:\Program Files\Java\jre1.8.0_66\bin\javaw.exe" -jar "C:\Users\Admin\AppData\Local\Temp\ori.jar"2⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Program Files\Java\jre1.8.0_66\bin\java.exe"C:\Program Files\Java\jre1.8.0_66\bin\java.exe" -jar C:\Users\Admin\AppData\Local\Temp\_0.364290361119041456231151071522203381.class3⤵
- Suspicious use of SetWindowsHookEx
PID:3472
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50B
MD5f19bbcb9fc6fc2ab8b94fd491ea0962c
SHA1350c28e09ef51003d808bcf2123945c6048f3e58
SHA256dfd543c3ca02b3d9e8c7582fbacb6a9d61a9b7b5b58636a968ae0d737a6ccd84
SHA5123324a20d690ae6705b27ed359f16cfab7388e433b3213fc4282e490404a3525dca2d9d345c34a0ae71753c9f1cbb0e23a0cfe1652dd99d13e1f0fbf452dd4584
-
Filesize
547KB
MD599ee31a1e534fed7a4cba5787376cd3f
SHA18fb763a11511684a347b4640f94e59e19d3eea68
SHA256290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5
SHA51277fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2
-
Filesize
547KB
MD599ee31a1e534fed7a4cba5787376cd3f
SHA18fb763a11511684a347b4640f94e59e19d3eea68
SHA256290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5
SHA51277fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2
-
Filesize
547KB
MD599ee31a1e534fed7a4cba5787376cd3f
SHA18fb763a11511684a347b4640f94e59e19d3eea68
SHA256290ea82aa11aef59256e1fbc74803d4260e1035adb1f9b28d6cac47a196a89c5
SHA51277fecca9f598961824b313178f720c159fdd3aa3c8634698680fe10cf0bb9602b532c0d8f766d8e61bdd6f372122475fc467410437be7d299849181ae60aa6c2
-
Filesize
241KB
MD5781fb531354d6f291f1ccab48da6d39f
SHA19ce4518ebcb5be6d1f0b5477fa00c26860fe9a68
SHA25697d585b6aff62fb4e43e7e6a5f816dcd7a14be11a88b109a9ba9e8cd4c456eb9
SHA5123e6630f5feb4a3eb1dac7e9125ce14b1a2a45d7415cf44cea42bc51b2a9aa37169ee4a4c36c888c8f2696e7d6e298e2ad7b2f4c22868aaa5948210eb7db220d8
-
Filesize
479KB
MD56a8979d38cd1d99c33eaa74aa7775143
SHA1efa1b842a8c66c2800e870f090eaeddca0bacdb6
SHA25650fb5acf95563164b7c3e5a922641cfefbfec4abb6d31439dc69fba075ca4b56
SHA5124e529d575800446246c7011c907c5dd7169892680d3a8fc126b22d0996e6a1819e013da41133090bc1f287d4358b059d3d5f1c48f57d02a0a148cdd0e0150acb
-
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-144354903-2550862337-1367551827-1000\83aa4cc77f591dfc2374580bbd95f6ba_76cff8be-8f86-4613-9a47-5d5870acb67c
Filesize45B
MD5c8366ae350e7019aefc9d1e6e6a498c6
SHA15731d8a3e6568a5f2dfbbc87e3db9637df280b61
SHA25611e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238
SHA51233c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd