Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13/10/2023, 16:16
Static task
static1
Behavioral task
behavioral1
Sample
3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe
Resource
win10v2004-20230915-en
General
-
Target
3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe
-
Size
3.8MB
-
MD5
7c82e11fdfca5afdf8202f0034389d26
-
SHA1
6ef1177acc811c4023264e4377031fe07b764758
-
SHA256
3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73
-
SHA512
7d7be97a817a63b351858e397d3dedd0e3d9c2d387590a8ee786e010dfa64fa3af55c90640d6c9b4c3b86475ea0829b36d4abef2f11f25f4325a3a98c2058f68
-
SSDEEP
49152:sw80cTsjkWakawTeeiTqK6hpMkQVOh+bSdXAkt9510MP3cqBCqgIcCE7mK+IW1IS:t8sjkUHziP+pMrwgbcDD5N3cqBh1Ie6
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2804 Rainmeter.exe -
Loads dropped DLL 6 IoCs
pid Process 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 2804 Rainmeter.exe 2804 Rainmeter.exe 2804 Rainmeter.exe 2804 Rainmeter.exe 2804 Rainmeter.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Rainmeter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString Rainmeter.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 2804 Rainmeter.exe 2804 Rainmeter.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 2804 Rainmeter.exe 2804 Rainmeter.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2804 Rainmeter.exe 2804 Rainmeter.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1924 wrote to memory of 2804 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 28 PID 1924 wrote to memory of 2804 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 28 PID 1924 wrote to memory of 2804 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 28 PID 1924 wrote to memory of 2804 1924 3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe"C:\Users\Admin\AppData\Local\Temp\3138e1515e07d00fff8dff8ee60d0724a47a3e21daf99a208e65cc0dc7e81f73.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.exeC:\Users\Admin\AppData\Local\Temp\Rainmeter\Rainmeter.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2804
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7KB
MD5c13ac91ec49a272275cf0c42ef9abd39
SHA1eaf6d697fd5da1c29ef83cc8f74d70ecff718510
SHA2563e50dbf35add52b599bfc5ad4d1beeee97e58d02d70a670ccea36ea49c099755
SHA5123a8d3d2d54ec35fec17838b123cfbc45359fcf46edd880fc213a647537c616bc0462844faff2893b9d49b9585092f9d6797f0f78a9ece1a8d4a7a992b1c21364
-
Filesize
88KB
MD59dd751b298f06a117445002fe91f0fad
SHA15f193eaa43aac9eb30e038f8b0707b5bcdb46bc5
SHA256a908b94bfcf65afe4bebca224e088d75fa6e87cfecd2e3f5c7df99906fa130f1
SHA51266525c1b79f52d0be1f3160126e1f459f0491f993e8eb4064838438ab4262eb165fc1c378948d4b9db798d8cd7415b0bdea734bc951055488c3dedde2df25611
-
Filesize
124B
MD50af93da5bdd604bf4af58180d7dc01cf
SHA1c196209d49f13647bee417063eb31e9cb8ed6b44
SHA256da7040b616c35d986601167facb785c44745bb07960a67f0e86c1dff4cb030ea
SHA512a8d2c225dfaaece2c6e63fee5a124c82860e6dd50731ebac2701e8b9b66059fec48abd120e742383136f248835d0368e2aee86c4b2e45b8a3ff4a69dfed5e74c
-
Filesize
124B
MD50af93da5bdd604bf4af58180d7dc01cf
SHA1c196209d49f13647bee417063eb31e9cb8ed6b44
SHA256da7040b616c35d986601167facb785c44745bb07960a67f0e86c1dff4cb030ea
SHA512a8d2c225dfaaece2c6e63fee5a124c82860e6dd50731ebac2701e8b9b66059fec48abd120e742383136f248835d0368e2aee86c4b2e45b8a3ff4a69dfed5e74c
-
Filesize
1.9MB
MD5a2eb58b4a50252c1c0cb7e07173d5b88
SHA15e179fe775e8a0bacc7d4640d1be7d1de0db5862
SHA256cfe3c39bbc8b82c4f534ae6a7e4c9db80e2de4b29c22a973b7ddb789166389fc
SHA5125b8c6d9175efd89de712c3f5888eb03c71bef1aadedfa6587d9c40a7cef1c1c6efcc7f5621c5ebdf04cb708d9fcad4224f6f4e45dfd6eebfa2c0e03d58409306
-
Filesize
464KB
MD50881a58b05284c3bfdf0b361b0e9b8f4
SHA1cdc0f380164fe3e4eafbdcd408fb7527a359d163
SHA25606e6ac93c84fec7ffdb99d9712556607a2e5e1fd8d066521e3ac06cb60e58fb6
SHA512e6242e2cae9f069035c09dc766668e5d83010b776daff41a4b3cabf5e16b6ccac87ceb39fb50fdf2e0157e2393453a12ca1560103ab5eae6207410591be6d4a5
-
Filesize
464KB
MD50881a58b05284c3bfdf0b361b0e9b8f4
SHA1cdc0f380164fe3e4eafbdcd408fb7527a359d163
SHA25606e6ac93c84fec7ffdb99d9712556607a2e5e1fd8d066521e3ac06cb60e58fb6
SHA512e6242e2cae9f069035c09dc766668e5d83010b776daff41a4b3cabf5e16b6ccac87ceb39fb50fdf2e0157e2393453a12ca1560103ab5eae6207410591be6d4a5
-
Filesize
1KB
MD5776f7f9763feb9a0d0307e9f1235f16b
SHA19f7809ba94928f74ff080a6bbda0445da071f9e7
SHA25695790e2b78540f7a1a81dea781a9e76968ec23167bc35393c8bd28e4acaa96af
SHA512c5a9cd6688ff18df8ada0447685e6ada6d844b93f7bd58571c7e0d0f7959e4bf56b20df6d833974ec0402ddeac3f1e7a758d9435c9291a2f82a63e387b45e5e4
-
Filesize
1KB
MD5776f7f9763feb9a0d0307e9f1235f16b
SHA19f7809ba94928f74ff080a6bbda0445da071f9e7
SHA25695790e2b78540f7a1a81dea781a9e76968ec23167bc35393c8bd28e4acaa96af
SHA512c5a9cd6688ff18df8ada0447685e6ada6d844b93f7bd58571c7e0d0f7959e4bf56b20df6d833974ec0402ddeac3f1e7a758d9435c9291a2f82a63e387b45e5e4
-
Filesize
415B
MD5380d62ed3c0e0cb79d1582a0cf7bfc5c
SHA18e6ebe6ebf66352d09cb47a3dee7d72547dec20b
SHA256e912bd1f028a1824c640d507111095b130c86b74ed472435ed31ee1f14758eac
SHA512d3fa452728e1185ab3f4b166c5490dfcc82056b6983a7dea2a68ec167605a84b022166cab2302159e7df7ec3a94c434a95adc83fd05f50aa0781a0866f32585e
-
Filesize
7KB
MD5a833a9808f49b168cdd4af1a49759743
SHA1dde54b53e07e2aeb68a87988be375e43d7d3e5ac
SHA256b89ad4fb4cf17f7b2b43f454c167d327a1ab0ac7102f23a1d131fcd2aa01bff9
SHA51225028f191ac1df5d676d0e378683682175526d0ea92b881252c1602cd09409c68cf853bf2045e1c876f9b62c834ce7077ed773353a22aabb318a10ce81d83cb2
-
Filesize
1.7MB
MD5a58a499bddbda398e1275972e56b06f6
SHA124dfab81236612d596c97eb38b3adf5de99f669c
SHA2567094b0c994e073c8d01cdbbd1e574bf7d02430bb8848758ff467a0ce415f6d49
SHA512e0fc0fe3a5c47be219ca84c74cfa018cf022a1774a988aff19a34490334a6e776e3557ec8e1341a637a18d1312d669b21bc2d320d5d1c80563de407e5c7ba1fb
-
Filesize
9KB
MD5972fb88b1fe0431e55f601c3b6b5152d
SHA1f0ba170363a39095b308b4238b3a635d9215a0e5
SHA256e21a811ce1751474c6e6d2f1c1de331ec894e6f33f4b2892b2b564279b718021
SHA5122a1a982c9b64e059ac709f648b80a9a92572d598ec1370f269621e7bd3390638c2836d81d433cf1fb4b840168e11fabb91e7c64e82f5f5adb7b3d0e7c7d17538
-
Filesize
5KB
MD594911fa356d071c8bb121f062fc976f2
SHA103aad53971191c04450ac9822b1daaca43d5496e
SHA256e4beecf7fb96f041beeda715a493d0afc60d70f35fc64d92550670b047286588
SHA5126410e550d92731046f7a9c22f394191447762881b41f607b4b4c9b0031ad401ed1d8a1beadbf7de985d927ad12d9a52db62ba4ddd04808daad2fb6d19c5903fe
-
Filesize
5KB
MD594911fa356d071c8bb121f062fc976f2
SHA103aad53971191c04450ac9822b1daaca43d5496e
SHA256e4beecf7fb96f041beeda715a493d0afc60d70f35fc64d92550670b047286588
SHA5126410e550d92731046f7a9c22f394191447762881b41f607b4b4c9b0031ad401ed1d8a1beadbf7de985d927ad12d9a52db62ba4ddd04808daad2fb6d19c5903fe
-
Filesize
8KB
MD5c50802e0671ba5d5120e3fa9b0f6ec97
SHA113355455cb2f2bcf37500de07e33d19604083184
SHA2568d1ff0736ab45b728a9aa879b3924196ff62007ea7b8df4e6172810349a8c6fe
SHA51262e16adba98c1854bc35c9928b58a00330164b896a6fa801d7950f37f7d9e4c2a2ba61eeb75ed2bae55fdcdfac30bc12e31498f1eb54b3f1fde8be9affda3ac0
-
Filesize
8KB
MD5d978d6863652bc8faf4929d472b5bf03
SHA190636937625e6bb3c8bb5184d9a277c43715f577
SHA2560f7a4785b7077c9b7e25b57e6ee51bcf574227cb52674ce73e889e3e690db2d1
SHA5125eaeb4ee9dca82be6d9ec82ca3cbeeb27c932de37860445aa507a55062574832f49a13129013c7cdd40f31dce56eb74b2504b33e8894cc43f28443147abab70f
-
Filesize
124B
MD513a0ae9bccb6f244bb40358dd3d89339
SHA1deba0a03330ea8c248d02f908e334fe11038cd41
SHA2563b4a28e44f08b1070734a838907089a835ddfbe2386d06b579f9dc4513da2385
SHA512fbb4a7107ce9e4ac0d7bd12ef46b06236a53762addd7474de1e178930016d7c0e2faea2666e806b4af1b8960895bb991232802d5b41141daaf7bc1ccfb1794d6
-
Filesize
88KB
MD59dd751b298f06a117445002fe91f0fad
SHA15f193eaa43aac9eb30e038f8b0707b5bcdb46bc5
SHA256a908b94bfcf65afe4bebca224e088d75fa6e87cfecd2e3f5c7df99906fa130f1
SHA51266525c1b79f52d0be1f3160126e1f459f0491f993e8eb4064838438ab4262eb165fc1c378948d4b9db798d8cd7415b0bdea734bc951055488c3dedde2df25611
-
Filesize
88KB
MD59dd751b298f06a117445002fe91f0fad
SHA15f193eaa43aac9eb30e038f8b0707b5bcdb46bc5
SHA256a908b94bfcf65afe4bebca224e088d75fa6e87cfecd2e3f5c7df99906fa130f1
SHA51266525c1b79f52d0be1f3160126e1f459f0491f993e8eb4064838438ab4262eb165fc1c378948d4b9db798d8cd7415b0bdea734bc951055488c3dedde2df25611
-
Filesize
88KB
MD59dd751b298f06a117445002fe91f0fad
SHA15f193eaa43aac9eb30e038f8b0707b5bcdb46bc5
SHA256a908b94bfcf65afe4bebca224e088d75fa6e87cfecd2e3f5c7df99906fa130f1
SHA51266525c1b79f52d0be1f3160126e1f459f0491f993e8eb4064838438ab4262eb165fc1c378948d4b9db798d8cd7415b0bdea734bc951055488c3dedde2df25611
-
Filesize
88KB
MD59dd751b298f06a117445002fe91f0fad
SHA15f193eaa43aac9eb30e038f8b0707b5bcdb46bc5
SHA256a908b94bfcf65afe4bebca224e088d75fa6e87cfecd2e3f5c7df99906fa130f1
SHA51266525c1b79f52d0be1f3160126e1f459f0491f993e8eb4064838438ab4262eb165fc1c378948d4b9db798d8cd7415b0bdea734bc951055488c3dedde2df25611
-
Filesize
1.9MB
MD5a2eb58b4a50252c1c0cb7e07173d5b88
SHA15e179fe775e8a0bacc7d4640d1be7d1de0db5862
SHA256cfe3c39bbc8b82c4f534ae6a7e4c9db80e2de4b29c22a973b7ddb789166389fc
SHA5125b8c6d9175efd89de712c3f5888eb03c71bef1aadedfa6587d9c40a7cef1c1c6efcc7f5621c5ebdf04cb708d9fcad4224f6f4e45dfd6eebfa2c0e03d58409306
-
Filesize
464KB
MD50881a58b05284c3bfdf0b361b0e9b8f4
SHA1cdc0f380164fe3e4eafbdcd408fb7527a359d163
SHA25606e6ac93c84fec7ffdb99d9712556607a2e5e1fd8d066521e3ac06cb60e58fb6
SHA512e6242e2cae9f069035c09dc766668e5d83010b776daff41a4b3cabf5e16b6ccac87ceb39fb50fdf2e0157e2393453a12ca1560103ab5eae6207410591be6d4a5