Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/10/2023, 22:53

General

  • Target

    ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207.exe

  • Size

    7.3MB

  • MD5

    0fc6fb78a0a489990c43c4712916e609

  • SHA1

    1cacce07ebf085405ad569ed9f9702af6f2fbcc1

  • SHA256

    ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207

  • SHA512

    1abfeaaf837d2132c78bfc0758fa55dcfcb46e01a534f5892a9439c256c32f9686d46e46a5a7a398456971368e2750398998189a6684d97cfd8db8933f222e93

  • SSDEEP

    196608:IQWflVkdVlM33DpXaodHQiGE/NBTawX8:IQ6VrHk+QvuNBT

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207.exe
    "C:\Users\Admin\AppData\Local\Temp\ea7314d9673c1fab5e4d5f3a00f09570c92ed72688ee2ac3213f6abdc27cc207.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:3256

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\HPSocket4C.dll

    Filesize

    1.7MB

    MD5

    707aa56cf742eb934185edf0a69d7289

    SHA1

    dab68976c4bd2d420c8adcd268fc1ffdd5e277e0

    SHA256

    3582d7ad93c54c2efddac6df4cf7d9e4b2ef1d8895dc9d12a781faf3cfb8bf12

    SHA512

    8be50ffedd0a250b4519069cec5781a9d0182fe47dce79c1991fc775a9580550c4b512de37e3423dc5d22013dce4cdcb1f178becbf5ef8ccb610c7ccd6d0f54d

  • memory/3256-0-0x0000000001620000-0x0000000001621000-memory.dmp

    Filesize

    4KB

  • memory/3256-1-0x0000000001650000-0x0000000001651000-memory.dmp

    Filesize

    4KB

  • memory/3256-2-0x0000000001680000-0x0000000001681000-memory.dmp

    Filesize

    4KB

  • memory/3256-4-0x0000000001690000-0x0000000001691000-memory.dmp

    Filesize

    4KB

  • memory/3256-3-0x0000000000400000-0x000000000147A000-memory.dmp

    Filesize

    16.5MB

  • memory/3256-5-0x00000000016A0000-0x00000000016A1000-memory.dmp

    Filesize

    4KB

  • memory/3256-6-0x00000000016B0000-0x00000000016B1000-memory.dmp

    Filesize

    4KB

  • memory/3256-7-0x0000000000400000-0x000000000147A000-memory.dmp

    Filesize

    16.5MB

  • memory/3256-8-0x00000000016C0000-0x00000000016C1000-memory.dmp

    Filesize

    4KB

  • memory/3256-17-0x0000000000400000-0x000000000147A000-memory.dmp

    Filesize

    16.5MB