Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
05/06/2023, 15:14
General
-
Target
[email protected]/ПРОГРАММА ДЛЯ РЕГИСТРАЦИИ ПРИВИТЫХ В ФЕДЕРАЛЬН�.exe
-
Size
8.2MB
-
MD5
8b7fdb80ea30a675d776ee3c6a2b5062
-
SHA1
763b7358672ff8b8d7b3428faf4fedb3ad2caaad
-
SHA256
1ce18f816875dae22ff0e038c9792d28ea649f119428a6b7e5af47e080f1dddd
-
SHA512
46f8b2f046bf4166dfcd326ddf741f8bcd43fa78ef11af16f6040486f2ce5cd9c632d71d2746d8854e0c1b9d809a09dea557f8e7d4709344026b71fe9af8b06c
-
SSDEEP
196608:egpFdSD4wJsrfJkVisvKWnVvJQxlNM6z+eQVgNuIQHmQqrRNLTswV:7eEwJji0VWDNM9eOgNVQHmQeRNLTs+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 10 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\[email protected]\ПРОГРАММА ДЛЯ РЕГИСТРАЦИИ ПРИВИТЫХ В ФЕДЕРАЛЬН�.exe"C:\Users\Admin\AppData\Local\Temp\[email protected]\ПРОГРАММА ДЛЯ РЕГИСТРАЦИИ ПРИВИТЫХ В ФЕДЕРАЛЬН�.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\buchgal.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\buchgal.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:653858 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\RarSFX0\buchgal.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-1529757233-3489015626-3409890339-1000"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD517fb71eb475eed801023017ea639ecd2
SHA13ba1996e23bfd918244dc17f0bfc05d373fcdc2c
SHA25692656ad7e6d236a890167ef158364dec432e82cef7ec21f214191a535e405b07
SHA512845bf27edfeed84b92810aefda87884bdfb2b0445c92ee766c90e22f0ceb098d0785000fe5b28a0188a622f9894e763f97702a39beba60012c90a9aaeabc7b6f
-
Filesize
50KB
MD517fb71eb475eed801023017ea639ecd2
SHA13ba1996e23bfd918244dc17f0bfc05d373fcdc2c
SHA25692656ad7e6d236a890167ef158364dec432e82cef7ec21f214191a535e405b07
SHA512845bf27edfeed84b92810aefda87884bdfb2b0445c92ee766c90e22f0ceb098d0785000fe5b28a0188a622f9894e763f97702a39beba60012c90a9aaeabc7b6f
-
Filesize
8.2MB
MD5928719a4777f2febd0d3331b0ca54796
SHA18100b747dbe639f2b30ad8c99790d39236d74ddf
SHA256bc5598da035b0d745358d0bc902c3defa217e2688b5836432254bdfd048781c1
SHA51282d5ea447b7b13e7d4612e3c5b267d7dd22a26d07fc4e5e43f7a01aea88fe310f3e7bd6b1e966e9ac77e3c5af217a9a3006a4ebc3843311ebd9100d28234df0d
-
Filesize
8.2MB
MD5928719a4777f2febd0d3331b0ca54796
SHA18100b747dbe639f2b30ad8c99790d39236d74ddf
SHA256bc5598da035b0d745358d0bc902c3defa217e2688b5836432254bdfd048781c1
SHA51282d5ea447b7b13e7d4612e3c5b267d7dd22a26d07fc4e5e43f7a01aea88fe310f3e7bd6b1e966e9ac77e3c5af217a9a3006a4ebc3843311ebd9100d28234df0d
-
Filesize
8.2MB
MD5928719a4777f2febd0d3331b0ca54796
SHA18100b747dbe639f2b30ad8c99790d39236d74ddf
SHA256bc5598da035b0d745358d0bc902c3defa217e2688b5836432254bdfd048781c1
SHA51282d5ea447b7b13e7d4612e3c5b267d7dd22a26d07fc4e5e43f7a01aea88fe310f3e7bd6b1e966e9ac77e3c5af217a9a3006a4ebc3843311ebd9100d28234df0d
-
Filesize
54KB
MD5488b46d903ca0733775cfacee8602b60
SHA1d119ccdb1239509429f3f0c226682f75d61c3256
SHA2568f9e6ecb25657d3c860c4240fd2525073d8b169cb42f88a4ddcc5fe2444e202b
SHA51273e1b66dcc84aecfcc2ac7954e726c5cc950bce1bbca563f1fc23e9998f204df9ed122104b7d76f604e50d9dffd041eb72177e8dfdd8f5d01dfdb8f49a3db4e5
-
Filesize
56KB
MD562ff5016af0b40b436491668bd046797
SHA11109236a3086c5e4a5e896c7edfac5b8946ac6d9
SHA25630547400d372b5170d8d2bf5c53051b09178bdce7c2eb37b0019da196057169c
SHA512104bcf92e0ac3885548c1344a8d0c06d083a4cf6c810ba7c0041469b70379cf962493713214f5365b4dbe702924cfdacf5b25ceeb1819a8c7ccb7905b2306c67
-
Filesize
562KB
MD52a6851974cff57bee62a83c52ce68863
SHA1c3b22bb00c555274d6413ae48e3ed82103462ff6
SHA256d2e97cdb120c1a88340553db0de85b525b2f3fae163715c789dc1ba3f76b72a1
SHA51225e1a733873f8ab294a281ec658c117d8c93b89ab63a73f199d9b53b25738e3f906822fd5915f360c24bcc9ad1672520e8d8e0964e06624e59750b2d176c2f5a
-
Filesize
562KB
MD52a6851974cff57bee62a83c52ce68863
SHA1c3b22bb00c555274d6413ae48e3ed82103462ff6
SHA256d2e97cdb120c1a88340553db0de85b525b2f3fae163715c789dc1ba3f76b72a1
SHA51225e1a733873f8ab294a281ec658c117d8c93b89ab63a73f199d9b53b25738e3f906822fd5915f360c24bcc9ad1672520e8d8e0964e06624e59750b2d176c2f5a
-
Filesize
562KB
MD52a6851974cff57bee62a83c52ce68863
SHA1c3b22bb00c555274d6413ae48e3ed82103462ff6
SHA256d2e97cdb120c1a88340553db0de85b525b2f3fae163715c789dc1ba3f76b72a1
SHA51225e1a733873f8ab294a281ec658c117d8c93b89ab63a73f199d9b53b25738e3f906822fd5915f360c24bcc9ad1672520e8d8e0964e06624e59750b2d176c2f5a
-
Filesize
163KB
MD51efe6ede674eb210b174d752ef46b406
SHA1d872590443d20ee5f5a5d9660e46cb9c67cb4101
SHA2566e81929956d64e44b91937abe574271eac629ea4872624f77726ba7777776cc7
SHA5129963186413fdffba3524b68d10b5ca889905783f073decb2b09b6ef6d6ceb1111b3d25b956cace48c24774320eb13b3be48574ae0680900a31bc0fc559509595
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
