Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
133s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 22:08
Static task
static1
Behavioral task
behavioral1
Sample
9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe
Resource
win10v2004-20230703-en
General
-
Target
9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe
-
Size
6.2MB
-
MD5
4a4c08233e45d39fd23e78400ca48eea
-
SHA1
0e7121aeed6ef48c909dc0a7ee4e715ca3762bbc
-
SHA256
9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee
-
SHA512
2521f587a8ac7966d8dd86d16f38d1a765bb747f328a760ce64e21ab31aaacdfc9f3e537a2f031d82e93d15cd00b963b3c86c50597d529ee066944cb094ef509
-
SSDEEP
98304:zHTJSMKP7FMnyBwhlYqdwkLcHHQsSYF8slYvOaV2SnGJ5eJwa27ncMUjuDk55S3h:zpYMGSljABSuzYvOcYeJh2zcG4S34m
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 8 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00070000000231f9-134.dat acprotect behavioral2/files/0x00070000000231fb-140.dat acprotect behavioral2/files/0x00070000000231fb-143.dat acprotect behavioral2/files/0x000a0000000231fe-151.dat acprotect behavioral2/files/0x000a0000000231fe-157.dat acprotect behavioral2/files/0x0009000000023200-160.dat acprotect behavioral2/files/0x0009000000023200-162.dat acprotect behavioral2/files/0x0009000000023200-164.dat acprotect -
Loads dropped DLL 6 IoCs
pid Process 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe -
resource yara_rule behavioral2/files/0x00070000000231f9-134.dat upx behavioral2/memory/4364-137-0x0000000010000000-0x000000001032B000-memory.dmp upx behavioral2/files/0x00070000000231fb-140.dat upx behavioral2/files/0x00070000000231fb-143.dat upx behavioral2/memory/4364-144-0x0000000074130000-0x0000000074368000-memory.dmp upx behavioral2/files/0x000a0000000231fe-151.dat upx behavioral2/memory/4364-153-0x0000000073EF0000-0x0000000074004000-memory.dmp upx behavioral2/files/0x000a0000000231fe-157.dat upx behavioral2/files/0x0009000000023200-160.dat upx behavioral2/files/0x0009000000023200-162.dat upx behavioral2/memory/4364-165-0x000000000BBF0000-0x000000000BC2E000-memory.dmp upx behavioral2/files/0x0009000000023200-164.dat upx behavioral2/memory/4364-167-0x000000000BBF0000-0x000000000BC2E000-memory.dmp upx behavioral2/memory/4364-168-0x0000000010000000-0x000000001032B000-memory.dmp upx behavioral2/memory/4364-169-0x0000000010000000-0x000000001032B000-memory.dmp upx behavioral2/memory/4364-170-0x0000000074130000-0x0000000074368000-memory.dmp upx behavioral2/memory/4364-171-0x0000000073EF0000-0x0000000074004000-memory.dmp upx -
Program crash 2 IoCs
pid pid_target Process procid_target 2908 4364 WerFault.exe 80 1956 4364 WerFault.exe 80 -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe 4364 9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe"C:\Users\Admin\AppData\Local\Temp\9b5cd4180eba9e41264cca8016b19741b1df67614ad45463b5dcc49013393fee.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 7842⤵
- Program crash
PID:2908
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 8242⤵
- Program crash
PID:1956
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4364 -ip 43641⤵PID:1988
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4364 -ip 43641⤵PID:1676
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5114054313070472cd1a6d7d28f7c5002
SHA19a044986e6101df1a126035da7326a50c3fe9a23
SHA256e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
SHA512a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522
-
Filesize
86KB
MD5114054313070472cd1a6d7d28f7c5002
SHA19a044986e6101df1a126035da7326a50c3fe9a23
SHA256e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
SHA512a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522
-
Filesize
86KB
MD5114054313070472cd1a6d7d28f7c5002
SHA19a044986e6101df1a126035da7326a50c3fe9a23
SHA256e15d9e1b772fed3db19e67b8d54533d1a2d46a37f8b12702a5892c6b886e9db1
SHA512a2ff8481e89698dae4a1c83404105093472e384d7a3debbd7014e010543e08efc8ebb3f67c8a4ce09029e6b2a8fb7779bb402aae7c9987e61389cd8a72c73522
-
Filesize
192KB
MD52244857ed4d33e3ab8b32c1a09eaff39
SHA19af9d5bc1be9c202471075b5222500c409428fd0
SHA256e345f88529b2337bb2719550985a049c61a6bca84c113c7b07f7ec5313446f7d
SHA512c88af689b603c22dac0be5cdb0922d0bb58325ee57d736b6fa090e967704edb5fa535100149fd5d02ac764ab32b0ccea99310dd28101ffc907a58414e8867590
-
Filesize
333KB
MD531c053643e5776f89462db3284ce9f63
SHA1a86d5c11cc109275392b34aa3ee21b86fbe533d9
SHA25660928b09e8ff531e029ecf465212b377c930102f627ac0150e04b149a50b774c
SHA512f840d143509a54992a3fb790a23a4cce9a7600e0919007afcbe306c5db796655df661a91196030fd52f964b22d31a5ef0ba8c9a4eafc657f2c15f918235a660d
-
Filesize
333KB
MD531c053643e5776f89462db3284ce9f63
SHA1a86d5c11cc109275392b34aa3ee21b86fbe533d9
SHA25660928b09e8ff531e029ecf465212b377c930102f627ac0150e04b149a50b774c
SHA512f840d143509a54992a3fb790a23a4cce9a7600e0919007afcbe306c5db796655df661a91196030fd52f964b22d31a5ef0ba8c9a4eafc657f2c15f918235a660d
-
Filesize
1.5MB
MD5574d3209c25d3f2595d0ad97fe7dc949
SHA1cab29752a188d3d6128273d5690d5b64837990d9
SHA2567d00543740e6c254beabab4f0b9f788186b75c97463f552e84b394d2b359479a
SHA5124f48054b7ebacdd61a4469c49156e5e53a6403533badfd2342049c7e2ee8ae816dff6009c7d5840f5de99272f17a1705ec6ed53f1437b7923c408be61523641b
-
Filesize
792KB
MD56637599f87ab11b6238f2f24c55797fc
SHA1a84090bed39c91503300ab3bd78883001bf71aac
SHA25665e65ccfe5b7fc075e06a5cf58507253a92dd9b7ab7a1a2b9e6b31fe7810e6ac
SHA5128edecfb2ac6865bd3886f5ff77c78ccd44a4362d2305b69397526a1e463207430bd838d390979cbdc498040a2fbca21ccdab679df506efec07be400f6b42d828
-
Filesize
792KB
MD56637599f87ab11b6238f2f24c55797fc
SHA1a84090bed39c91503300ab3bd78883001bf71aac
SHA25665e65ccfe5b7fc075e06a5cf58507253a92dd9b7ab7a1a2b9e6b31fe7810e6ac
SHA5128edecfb2ac6865bd3886f5ff77c78ccd44a4362d2305b69397526a1e463207430bd838d390979cbdc498040a2fbca21ccdab679df506efec07be400f6b42d828