Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
18/09/2023, 08:25
General
-
Target
noplic.exe
-
Size
1.4MB
-
MD5
50b74f796a6eb2c5336d204d6308ff69
-
SHA1
1f038238f413178dc53fb8e14326fc347e28b6b1
-
SHA256
ac5444a3e3aa572ed541b69928587f41f1b428405be143ada8151ce843bc0c52
-
SHA512
c65238906b32f3e206d2caf8eaff523e8635d66b9c886c623ef522483b030e8418691ec657f7334909e97b2dde543728eadf54af883cb2b34443b0cfc7382ee1
-
SSDEEP
24576:x6tlE0aJHcrbIfmIj8p0GVxXqAFGGFFADxrz2hXCRTEtIzkM1EZSA4UZZxVmHmqT:x0r8mZxXqAFJFaDlz2h+TEtIHtQZ
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
-
ASPack v2.12-2.42 2 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 5 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\noplic.exe"C:\Users\Admin\AppData\Local\Temp\noplic.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c md C:\ProgramData\rrrpaxuegiukbyvuyyjnqkrorwzczxubljtruxnlwdulpxy2⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c start C:\ProgramData\rrrpaxuegiukbyvuyyjnqkrorwzczxubljtruxnlwdulpxy\flegoiqihhvpqezkgbcdlmhpqoc.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\rrrpaxuegiukbyvuyyjnqkrorwzczxubljtruxnlwdulpxy\flegoiqihhvpqezkgbcdlmhpqoc.exeC:\ProgramData\rrrpaxuegiukbyvuyyjnqkrorwzczxubljtruxnlwdulpxy\flegoiqihhvpqezkgbcdlmhpqoc.exe3⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
755KB
MD5bf38660a9125935658cfa3e53fdc7d65
SHA10b51fb415ec89848f339f8989d323bea722bfd70
SHA25660c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA51225f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
-
Filesize
16KB
MD5973b4b2658796840ad6ff9ac1cb21383
SHA12ae4808a1d7e450707a9f928ea13cd73e5040431
SHA256f671045566c60930dc459aa30e2bb38f25525e670bf72f7b69c1f918ae3d9565
SHA51242e313fae2f84c6ecc7b5c2c4178bcbcf3043fd239d9b05f5614b64e2d8841a7fe54a0786c1b5752bb1b54079b9873d6ade63e7b00cb4118a007d3d0360d6b4c
-
Filesize
16KB
MD5973b4b2658796840ad6ff9ac1cb21383
SHA12ae4808a1d7e450707a9f928ea13cd73e5040431
SHA256f671045566c60930dc459aa30e2bb38f25525e670bf72f7b69c1f918ae3d9565
SHA51242e313fae2f84c6ecc7b5c2c4178bcbcf3043fd239d9b05f5614b64e2d8841a7fe54a0786c1b5752bb1b54079b9873d6ade63e7b00cb4118a007d3d0360d6b4c
-
Filesize
244B
MD5ac2dd095e4ba729b5ee2b9658b8a60ea
SHA128406ad54ad556a16f3fa842184a14522e81a407
SHA256bbd67bed871eb6ab54e62cf11cd55763d01f342960cdac8f2722cc3f781eaa9b
SHA5127e365b02866ffa23650c4a6b895fe68718f559582294927c6c321872116b352adf03ee56c7d0849e8c40237f6302f6c5608c2764bd82d109ee1b966788fbdf0c
-
Filesize
244B
MD5ac2dd095e4ba729b5ee2b9658b8a60ea
SHA128406ad54ad556a16f3fa842184a14522e81a407
SHA256bbd67bed871eb6ab54e62cf11cd55763d01f342960cdac8f2722cc3f781eaa9b
SHA5127e365b02866ffa23650c4a6b895fe68718f559582294927c6c321872116b352adf03ee56c7d0849e8c40237f6302f6c5608c2764bd82d109ee1b966788fbdf0c
-
Filesize
427KB
MD5b03b4a054a1606948a9e71c90295007a
SHA1839d1541efbfc4fb5873457c06f221faf6960114
SHA2560ec802cd39b1c71890621f31efdf9803715369f9a6e3bd2b063496821ed3424b
SHA5127fb3acef27a2596a5fb24b22573036e776eb1133a6462e2c16c74aa26e274993263d84d1f93188b015f2c410f40d0c64301f275b9e0a4a7cefd9771d6b1c2991
-
Filesize
427KB
MD5b03b4a054a1606948a9e71c90295007a
SHA1839d1541efbfc4fb5873457c06f221faf6960114
SHA2560ec802cd39b1c71890621f31efdf9803715369f9a6e3bd2b063496821ed3424b
SHA5127fb3acef27a2596a5fb24b22573036e776eb1133a6462e2c16c74aa26e274993263d84d1f93188b015f2c410f40d0c64301f275b9e0a4a7cefd9771d6b1c2991
-
Filesize
755KB
MD5bf38660a9125935658cfa3e53fdc7d65
SHA10b51fb415ec89848f339f8989d323bea722bfd70
SHA25660c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
SHA51225f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
924KB
-
Filesize
924KB
-
Filesize
620KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
620KB
-
Filesize
936KB
-
Filesize
340KB
-
Filesize
924KB
-
Filesize
612KB
-
Filesize
924KB
-
Filesize
1.5MB
-
Filesize
328KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
620KB
-
Filesize
328KB
-
Filesize
620KB
-
Filesize
2.0MB
-
Filesize
340KB
-
Filesize
936KB
-
Filesize
1.5MB
-
Filesize
612KB
-
Filesize
328KB