Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

9b5cd4180e...ee.exe

windows7-x64

7

9b5cd4180e...ee.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    133s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2023, 22:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe

  • Size

    6.2MB

  • MD5

    4a4c08233e45d39fd23e78400ca48eea

  • SHA1

    0e7121aeed6ef48c909dc0a7ee4e715ca3762bbc

  • SHA256

    9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee

  • SHA512

    2521f587a8ac7966d8dd86d16f38d1a765bb747f328a760ce64e21ab31aaacdfc9f3e537a2f031d82e93d15cd00b963b3c86c50597d529ee066944cb094ef509

  • SSDEEP

    98304:zHTJSMKP7FMnyBwhlYqdwkLcHHQsSYF8slYvOaV2SnGJ5eJwa27ncMUjuDk55S3h:zpYMGSljABSuzYvOcYeJh2zcG4S34m

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 8 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 6 IoCs
  • UPX packed file 17 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Program crash 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe
    "C:\Users\Admin\AppData\Local\Temp\9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    PID:4364
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 784
      2⤵
      • Program crash
      PID:2908
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 824
      2⤵
      • Program crash
      PID:1956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4364 -ip 4364
    1⤵
      PID:1988
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 4364
      1⤵
        PID:1676

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
        Filesize

        86KB

        MD5

        114054313070472cd1a6d7d28f7c5002

        SHA1

        9a044986e6101df1a126035da7326a50c3fe9a23

        SHA256

        e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

        SHA512

        a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
        Filesize

        86KB

        MD5

        114054313070472cd1a6d7d28f7c5002

        SHA1

        9a044986e6101df1a126035da7326a50c3fe9a23

        SHA256

        e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

        SHA512

        a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\SkinH_EL.dll
        Filesize

        86KB

        MD5

        114054313070472cd1a6d7d28f7c5002

        SHA1

        9a044986e6101df1a126035da7326a50c3fe9a23

        SHA256

        e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1

        SHA512

        a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522

        Download Submit

      • C:\Users\Admin\AppData\Local\Temp\ee\Plugins\rdjson.dll
        Filesize

        192KB

        MD5

        2244857ed4d33e3ab8b32c1a09eaff39

        SHA1

        9af9d5bc1be9c202471075b5222500c409428fd0

        SHA256

        e345f88529b2337bb2719550985a049c61a6bca84c113c7b07f7ec5313446f7d

        SHA512

        c88af689b603c22dac0be5cdb0922d0bb58325ee57d736b6fa090e967704edb5fa535100149fd5d02ac764ab32b0ccea99310dd28101ffc907a58414e8867590

        Download Submit

      • C:\Users\Admin\Documents\ee\Plugins\WebView2.dll
        Filesize

        333KB

        MD5

        31c053643e5776f89462db3284ce9f63

        SHA1

        a86d5c11cc109275392b34aa3ee21b86fbe533d9

        SHA256

        60928b09e8ff531e029ecf465212b377c930102f627ac0150e04b149a50b774c

        SHA512

        f840d143509a54992a3fb790a23a4cce9a7600e0919007afcbe306c5db796655df661a91196030fd52f964b22d31a5ef0ba8c9a4eafc657f2c15f918235a660d

        Download Submit

      • C:\Users\Admin\Documents\ee\Plugins\WebView2.dll
        Filesize

        333KB

        MD5

        31c053643e5776f89462db3284ce9f63

        SHA1

        a86d5c11cc109275392b34aa3ee21b86fbe533d9

        SHA256

        60928b09e8ff531e029ecf465212b377c930102f627ac0150e04b149a50b774c

        SHA512

        f840d143509a54992a3fb790a23a4cce9a7600e0919007afcbe306c5db796655df661a91196030fd52f964b22d31a5ef0ba8c9a4eafc657f2c15f918235a660d

        Download Submit

      • C:\Users\Admin\Documents\ee\Plugins\WebView2Plus.dll
        Filesize

        1.5MB

        MD5

        574d3209c25d3f2595d0ad97fe7dc949

        SHA1

        cab29752a188d3d6128273d5690d5b64837990d9

        SHA256

        7d00543740e6c254beabab4f0b9f788186b75c97463f552e84b394d2b359479a

        SHA512

        4f48054b7ebacdd61a4469c49156e5e53a6403533badfd2342049c7e2ee8ae816dff6009c7d5840f5de99272f17a1705ec6ed53f1437b7923c408be61523641b

        Download Submit

      • C:\Users\Admin\Documents\ee\Plugins\hp_socket4c.dll
        Filesize

        792KB

        MD5

        6637599f87ab11b6238f2f24c55797fc

        SHA1

        a84090bed39c91503300ab3bd78883001bf71aac

        SHA256

        65e65ccfe5b7fc075e06a5cf58507253a92dd9b7ab7a1a2b9e6b31fe7810e6ac

        SHA512

        8edecfb2ac6865bd3886f5ff77c78ccd44a4362d2305b69397526a1e463207430bd838d390979cbdc498040a2fbca21ccdab679df506efec07be400f6b42d828

        Download Submit

      • C:\Users\Admin\Documents\ee\Plugins\hp_socket4c.dll
        Filesize

        792KB

        MD5

        6637599f87ab11b6238f2f24c55797fc

        SHA1

        a84090bed39c91503300ab3bd78883001bf71aac

        SHA256

        65e65ccfe5b7fc075e06a5cf58507253a92dd9b7ab7a1a2b9e6b31fe7810e6ac

        SHA512

        8edecfb2ac6865bd3886f5ff77c78ccd44a4362d2305b69397526a1e463207430bd838d390979cbdc498040a2fbca21ccdab679df506efec07be400f6b42d828

        Download Submit

      • memory/4364-144-0x0000000074130000-0x0000000074368000-memory.dmp

        Filesize

        2.2MB

        Download

      • memory/4364-153-0x0000000073EF0000-0x0000000074004000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/4364-165-0x000000000BBF0000-0x000000000BC2E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/4364-137-0x0000000010000000-0x000000001032B000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/4364-167-0x000000000BBF0000-0x000000000BC2E000-memory.dmp

        Filesize

        248KB

        Download

      • memory/4364-168-0x0000000010000000-0x000000001032B000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/4364-169-0x0000000010000000-0x000000001032B000-memory.dmp

        Filesize

        3.2MB

        Download

      • memory/4364-170-0x0000000074130000-0x0000000074368000-memory.dmp

        Filesize

        2.2MB

        Download

      • memory/4364-171-0x0000000073EF0000-0x0000000074004000-memory.dmp

        Filesize

        1.1MB

        Download