Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
26/05/2023, 17:50
230526-wejv6sgf32 7Analysis
-
max time kernel
45s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
26/05/2023, 17:50
General
-
Target
better ping x.exe
-
Size
5.5MB
-
MD5
3c85d6f17c2c8aae40ee91e3ff457a84
-
SHA1
41b0609ee3ccd701e987557f313ca25092e0f5d2
-
SHA256
d2efed38834e765230a4b71ffacf1a4f1c72de783d371d97653b892cb37f5f64
-
SHA512
5139802fa2a6bbfd8225748d788041335431c7e9e8cb49fa9854f2fc8882c14a21ca4c524293ea518a2fb547247b16417bd94ea48ac7e0d1b108ada5eb054af4
-
SSDEEP
98304:EmY+JTA93BVzN4LA2lrQ6WJyZLoyD2kBU3IDPyo3X03:EmY+JUrdN4sEE6WJyZc8ZBU3kyUE3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 9 IoCs
-
Suspicious use of SendNotifyMessage 8 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\better ping x.exe"C:\Users\Admin\AppData\Local\Temp\better ping x.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe"C:\Users\Admin\AppData\Local\Temp\ir_ext_temp_0\autorun.exe" "SFXSOURCE:C:\Users\Admin\AppData\Local\Temp\better ping x.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1481⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\UseResume.au"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
15KB
MD5b273896715ca2aa98506dbc0cf81e260
SHA1d0cf383008fe1bfb218a15136369c66115461dcc
SHA2568e7a3d6a050d179d8a72c77fad325e5fd778555341b88287813d866b4d78e6f7
SHA512aee9f64f53b169ebdb2bf261dfcff68fe59de1fe238e54e6f31047fa8eeddf886ccd4cd2430b4827b8ef492ab1a326492a94760f4c50e02d85f2838f34d6d896
-
Filesize
4KB
MD595113aa3e23000552ec88e92f74efdb9
SHA1071760c118dcf75170285acfc05bf8c4970a2984
SHA2565502c4b74b60baee505ff2dbee4ca83423a0aeed9dc74d4bd7f460bb242f113a
SHA512b184e2b828fafc1dd758cea8c91cf3b761bf9102d24f07d196db6d73b9c99a25be9ef5f69496c68335f9968683abbb283b76f704d9fe04d26cd3218a133cb481
-
Filesize
4KB
MD581b3e68dd44fedc0c5d044fc30bd0c39
SHA171216c5caa90bd7c3176db6226d895e179b3f4c4
SHA256ae0dad60996b021e758e97ab5bdf8ce0245927aa0c3cccd625b1b6863cb531ad
SHA5123e82941fe75ef04e7c14bcc2f557486b29b4e0b2921ca2d8cb6a699beaf67c06a8d4dbd64f202a03f05f0fae164301e9ea3a132aa6e04e7b48c24dc9b7121894
-
Filesize
5KB
MD58e52ea9774c355420cd0923126016376
SHA1cbcd29e7dd376ac692d6832cf1a0143b1c918d10
SHA2569f5ad65c44813151d699af26ae58d7ce5d9df871c85ff3933be8051675a868b8
SHA51202d5d65f8a53c4d626a04e8892827791ed66ec00bcccc8b59651dd39648d112c4342bbbf6d0d63452f5fc877ce3e1149050ac1858c8325fca8ad0bac753cac4d
-
Filesize
173B
MD5746e7f0c6f9db0e33eb7aa603656260b
SHA19eea9d648239b65922b39da2573d4c4421ffa223
SHA256ac6dbde26728402b518726aa1af091f7868eaa539e26c2c5f3b57b9dff4c4f99
SHA512cfec69bbf71ff2bfa99a8699ce53da03b96320cf9063ce5f304d80f785c230e11fe066d4a27bd849ba048134abf27bc98dc12218ab873de4931ddd6530029bfd
-
Filesize
406B
MD5c56497724508d8107ad11822987bafc1
SHA10f6af32031bb98480af3f1015fb1e02ba836117e
SHA2564e16b39e400950f7158c98eadc05d8146830a0d38d5a1ec8a7a49751c6260ea6
SHA512627f7d12164898407a24fc930a56f3b2b9cd3de066dff9ba27961cb29ac16b54e0f9919e1a5b89532a8dd2ac093b6ac87cc3736f317e161d9c9bb1b84ef78050
-
Filesize
1022B
MD5bbfccaf0c4baa5b1445937f9bc3cc2f2
SHA11212e65edff3d2da4555ae339414473e6de0c82a
SHA256b370bbf11ffaab2add1f31ab71d898df9f804690700e5e370fae69e38a64bd23
SHA5121a5ec1324eb543acbd71b0292110908596e71b78bac8bee19c9e42de470d8a458be553e23a1b55d615578613059eabf0e650e64c5f40841fae7ac8fabfd0c359
-
Filesize
1KB
MD552c0062f80a250a768372d8f573731ed
SHA1a352c77a08e633a3263153373d320cb48562d154
SHA2561ed5fba18ac200341fab1b781272b53ccb412f021a46ae09be1eb89b8e7b3b00
SHA5126d112fd29df768a25e7d91709f2203cf2ba07cbc62b8a714dc1335dd1e129f98302ec83e486356a111175c4fecc86ff3b790e16d04ff971d29f3861cece19279
-
Filesize
13KB
MD5a2636e915ce64f2dea3093ac5db01b17
SHA17af0ca96202dd1cd804da23b5787a7cf7f65485f
SHA256de3c55b00c0c4ca4d652feffbd0aae0533fd8ff0fa12224d571308594cb4ed78
SHA512b404173f159dc4d3f45097f301959d6985cf2981a5de5e607274d647169a3f719f5177a4c4333cbb62909f9c325050f228429c8077cbb92671a626e65b0c1cee
-
Filesize
226B
MD5226587fef106ab807305e8928b0d9d77
SHA19a21b24397b5f21deb4debf2676b5b414cca684b
SHA25681c2f972ddeb20ee624d610fa03735ea49db4a74bd4dea4e15a75407ffd228e9
SHA512579bc4f207e8c3749e7ec16945194651ed044ace320cdb1747528213fe75c9cb29a8c2aed452b4f5a90472b68df3be4b9e83f2505f5cfc1ede4b5e35c68fe9dc
-
Filesize
176B
MD5bc13028513e5489f9c4589c63b59951c
SHA15c37041b81bea460b2a6f28e73d43b043f40755b
SHA2569c2f3e0b7a72452190e2249ba9581f3de5a6208594242ea3b7060943b2f8d5b9
SHA512a3c820b4049e606be559e5ea8a00b0b816c15f3e866bc986aacf4c3be060b490c132a8789719f98afb24bcd91f176767e1058e3416bc3a46f9839056c3062e11
-
Filesize
33KB
MD51c2b7c82ed4aae279c5c753d57974800
SHA135ac4559049e34635793a06ae5acd27aa3718c05
SHA256c9c7dbe42c613b2854d938f5b2d592cc26a5d32ebfb0a659112493de285c1a8c
SHA5123211d8734ca9c72b6b84fada507a5466ca58dcdf58c0334eaf11899a54ae7615a1443d5768dd65e7cd4f199c80adf57434054fb053193d9f1c4bbb352318ffd7
-
Filesize
1.1MB
MD52c765644d5053d602ca05e2f6eb7c45d
SHA1b6906edeedd7c8d7ac462203c32fd69823b77a10
SHA256cdc4fd38a4e6901470f64660426d1ad2f5ce86b487ffb0b46e96f1f0e664baf8
SHA512f458272a90d493923ee2768c0ede1f727767565fa5f23817b2024129a8d76137e29d55817c393451ab9ebcf1705f56b8cbc8efd0524cacf3bfac48ee8252f450
-
Filesize
6.1MB
MD502503fbc52aadc7afa263e211ec95d0c
SHA12f62dde1f34ad90502d1308fb6110d3e40bb8ad2
SHA256fc67167f413f27701d8c18d82def1b53a035e7b4bd54a2f706ebf78342967363
SHA5120784a7f0dcd878a386a1e1858bc45de1135413a4d72ede565d99cae1c4dd9076f66c00adc71a8b72df5e4c3859842eac903a0f046edfa482934c8b6793791797
-
Filesize
6.1MB
MD502503fbc52aadc7afa263e211ec95d0c
SHA12f62dde1f34ad90502d1308fb6110d3e40bb8ad2
SHA256fc67167f413f27701d8c18d82def1b53a035e7b4bd54a2f706ebf78342967363
SHA5120784a7f0dcd878a386a1e1858bc45de1135413a4d72ede565d99cae1c4dd9076f66c00adc71a8b72df5e4c3859842eac903a0f046edfa482934c8b6793791797
-
Filesize
6.1MB
MD502503fbc52aadc7afa263e211ec95d0c
SHA12f62dde1f34ad90502d1308fb6110d3e40bb8ad2
SHA256fc67167f413f27701d8c18d82def1b53a035e7b4bd54a2f706ebf78342967363
SHA5120784a7f0dcd878a386a1e1858bc45de1135413a4d72ede565d99cae1c4dd9076f66c00adc71a8b72df5e4c3859842eac903a0f046edfa482934c8b6793791797
-
Filesize
89KB
MD5ef172565132b6a6929639e496a27b773
SHA170be945cd4c6aa136e75c5e517df032cb7296350
SHA256fa7b1c4b1b9b6ee4c4ebd10c3b69cb847b2a2b50c528b0cc00b1f8a38261196d
SHA512fc16e09d4105a9dabaea131f94cb3b99c17aad893ce4e794b5d5da874e075f58866f0a9aec13d05bdeb856385d82c7ba9de71b51a7d8d7a6c08def68cb31d058
-
Filesize
89KB
MD5ef172565132b6a6929639e496a27b773
SHA170be945cd4c6aa136e75c5e517df032cb7296350
SHA256fa7b1c4b1b9b6ee4c4ebd10c3b69cb847b2a2b50c528b0cc00b1f8a38261196d
SHA512fc16e09d4105a9dabaea131f94cb3b99c17aad893ce4e794b5d5da874e075f58866f0a9aec13d05bdeb856385d82c7ba9de71b51a7d8d7a6c08def68cb31d058
-
Filesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
Filesize
6.1MB
MD502503fbc52aadc7afa263e211ec95d0c
SHA12f62dde1f34ad90502d1308fb6110d3e40bb8ad2
SHA256fc67167f413f27701d8c18d82def1b53a035e7b4bd54a2f706ebf78342967363
SHA5120784a7f0dcd878a386a1e1858bc45de1135413a4d72ede565d99cae1c4dd9076f66c00adc71a8b72df5e4c3859842eac903a0f046edfa482934c8b6793791797
-
Filesize
322KB
MD5c3256800dce47c14acc83ccca4c3e2ac
SHA19d126818c66991dbc3813a65eddb88bbcf77f30a
SHA256f26f4f66022acc96d0319c09814ebeda60f4ab96b63b6262045dc786dc7c5866
SHA5126865a98ad8a6bd02d1ba35a28b36b6306af393f5e9ad767cd6da027bb021f7399d629423f510c44436ac3e4603b6c606493edf8b14d21fabf3eab16d37bd0d25
-
Filesize
192KB
-
Filesize
72KB
-
Filesize
2.7MB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
92KB
-
Filesize
92KB
-
Filesize
68KB
-
Filesize
116KB
-
Filesize
68KB
-
Filesize
16.7MB
-
Filesize
2.0MB
-
Filesize
252KB
-
Filesize
132KB
-
Filesize
96KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
108KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
96KB
-
Filesize
992KB
-
Filesize
412KB
-
Filesize
444KB
-
Filesize
68KB
-
Filesize
344KB
-
Filesize
160KB
-
Filesize
144KB
-
Filesize
92KB
-
Filesize
140KB
-
Filesize
68KB
-
Filesize
208KB
-
Filesize
132KB
-
Filesize
76KB
-
Filesize
72KB
-
Filesize
1.2MB
-
Filesize
176KB
-
Filesize
1.7MB
-
Filesize
368KB
-
Filesize
68KB
-
Filesize
604KB
-
Filesize
72KB
-
Filesize
2.2MB
-
Filesize
1.1MB
-
Filesize
212KB
-
Filesize
148KB
-
Filesize
68KB
-
Filesize
388KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
76KB
-
Filesize
636KB
-
Filesize
68KB
-
Filesize
1.0MB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
68KB
-
Filesize
72KB
-
Filesize
96KB
-
Filesize
88KB
-
Filesize
164KB
-
Filesize
72KB
-
Filesize
68KB
-
Filesize
68KB
