Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    135s
  • max time network
    159s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2023, 14:05

General

  • Target

    DS4Windows/DS4Windows.exe

  • Size

    465KB

  • MD5

    e04a76a4b5a4c802eb3c228909f60bbb

  • SHA1

    5ebb77a556b04faceba7f89b9b4f13343298889a

  • SHA256

    f81c1245f856b7764ef90626a708c684f6117f6e2125582b2c5de1d1218b634c

  • SHA512

    bcfe476f8b01601dd7411e97b7895a340c65c720881cfbea5218f4a2aba8ab8757de19e8729edafbf8c711efe8ccf07a1f16bdf4034855fced43ce0a9bd97331

  • SSDEEP

    3072:t8vbzyQ6Y1YXrbNK+3FNxacPEMk6VRQAaTWHAxE53PXJagcxjiitVqDRHFljXfuk:tszAXNK+3FVBRQ9TWgi3P5zMmh

Score
1/10

Malware Config

Signatures

  • Modifies Internet Explorer settings 1 TTPs 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DS4Windows\DS4Windows.exe
    "C:\Users\Admin\AppData\Local\Temp\DS4Windows\DS4Windows.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x64&rid=win7-x64&apphost_version=6.0.10&gui=true
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1484
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1484 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2816

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    dc2cc2925cc2cb44d27887e975ce0d63

    SHA1

    e53a0d2ca8c80d69013b41ead862b87104bc042d

    SHA256

    f0600ac3f0ee746dcb5659d2be718c2988a73f0e7c4b9cea8fbd0c18007b505e

    SHA512

    530d181d17fc409285c35b23263a6405a477a205b150efe2b29e8d5c57418e7b0ddc56ed63de6550a45b4e8f2035df7c07653feb391bc86109e76296b98162d6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    077b64961ac61ef200acdf4d2f34494c

    SHA1

    fcc0526752a7ea9717ce5ef80310e71bf23b4af6

    SHA256

    f8835ebf55a228b6165d7f34d6948e7ad6f85879a1511a0a2b3be7be20e5e7cf

    SHA512

    69b67495a5a65dff610e1616d58e34e0f02ed29fb7a8095c48c5558b38b807bfee46611e8ca7171a0993a04280947badb430d9a8326338cae8b569b3a983c6fc

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    709ee75addeacc71cabb93cd9cf8ca44

    SHA1

    78be3ec4b07ddd2653264bdccccd027ed888f9ba

    SHA256

    8d3a9048578755cb045a5c4922af53653923fadc0376fdb62cd4f665ea41b767

    SHA512

    bf882b07af921eed3ec4cb8a08dda54392b5260e355ddca6b3045ff34249492ccfc4546270508cd9e1a13a6af7dd76905155a430a98b14fde751f026c91c445b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    aefc1fa8e0ef21830f5229c11b220004

    SHA1

    1e7ad174cb7c9f20eb915b71641f87b62bbda10c

    SHA256

    842351c17123e8c1f77ea15969f8e117475c9c672950ca3d0ea4804bef4c3d62

    SHA512

    df5e20b5dadcfd0c68de41c8c5a72df84ca6248a01d56984baae923cd4b2a97f05dd72b83004b510dafc18fd4d33800f9ba963233eb750360ef7890938d50365

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    afe0146ddd38b0c7ac8d013942f3e4fa

    SHA1

    a93915b8678c1a023a6cd4e00e1f4f9f43ba2572

    SHA256

    543624e7829717f59176aa5b1fc71950b0848d8485a6e9f8aca2a5066434c980

    SHA512

    eaab20aed9b11b6bce1c15b0371499c4a4c87dc76b89356084f1fc016d75529ef24906d2697721a244234341e5a62a6c4ca6992819811cd3b9d14c5730ae3454

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6010fd063902d3ab0e0847c556f68925

    SHA1

    ab52606bb4d5c10086823c5095298599e4b16cff

    SHA256

    e0d0fda6d92964050e856806c77ee583d87108bb008426c298739d2db97b29fe

    SHA512

    512b779847514a7bc3487309cbcd41b9cb2656692c0a4b628635b8a9fe1525b519f5bceb5f67c6cf19a8b506c42db31a457a588bb207350338035c7012bf0874

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bb97a0f769c17690fe48e94860166015

    SHA1

    7beb6c845d82cce0f609a97fdc51e7a5967b655e

    SHA256

    5df7aa47be65ddf9b88222480dae34dd620cb246ca425ca006482c66fc340dc7

    SHA512

    1709d53199c0c1b4f2f995078c20e1ded1fa25e9baf2675f521ba61c6d74a989c5b1c1570a067529e21a9c6c6b243d0c9443c40ed88fe5ddd421ae0b030c6d51

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4e128fe0d0f37f129319d3ae27dab61f

    SHA1

    5ceeee18d3aa9bb8898ddeb849a103fb0163a427

    SHA256

    a8f88c9cf7c14eb42da78bd9f14ca7271ffe78e5ce3502203fe553f24535feab

    SHA512

    92672a44089c78f80d6569a7a63379fe60b5458ba00c289ee5835ebc9676de30bdf591bf8c72bb8ae2fe0118e21d0358ef363edeb3cc5d6d7f7ef25ed97855f6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ad502cd10c3cc2344639696e78438b02

    SHA1

    e206eeb7da76a4d048b6a5ca89332534c946fbec

    SHA256

    98d35496e8d61f64366573cf43d42abe10260fe16268bc039dbb85c056e99365

    SHA512

    27a19b999537a63c3a09a916b36b1e0098f6b0c02f163039a766ad7b4274935474068da1908c8e4bdadb66318806ea97a58a2f0dd44fb80bd84fbf6acb625f8d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    02b7676cf3dcc9f334ce53700afa0856

    SHA1

    15e0d7d35c82ae1bac3943f9d92949c8829c2878

    SHA256

    468dc29fe9e7d76bbb70278fa3e5508a5bb70af1811f824b8ab6617427b97ad4

    SHA512

    84d0935e3c73342df8d1c3ef23ea662994fddba22247d45a76524dec57e122d7e70f28fadfe64202a197aae429e8f30794606bd180e47085416fa6c56c72122b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    678e459215f8462ab110b457ff8b11f6

    SHA1

    01318377885d0faf594be0f4fdb2ddb1c18facc9

    SHA256

    3e08fbee178420d1e1f6659e32c48c61d2bb063fa5c2194e3f24f2f59a4ffda3

    SHA512

    060ee8f2313e823ab18c3ee824eceb115e73270810cc6f9b989c28cd8febf9545eed9eaa67e24dcfa30a239f8c9c0bd22c2bc65b8e65f9750a04f76c473ccfe3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b88544f5968257ea9783df8b4d9b412b

    SHA1

    9f498a905bfebe350a8609e03c24f433220fb80b

    SHA256

    48a974150a049399ad479f1d2c4f9a57b34053ca7d519d1d4dc1a1bb74a4e77f

    SHA512

    b53d6d3cfdb4f4ff563057c80d476ce14eb637cff9b0e3886bdddf788117fa726847b691cc519112fcbba5896c1af9b28022d3677cff3085d142f68f9fb25341

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    50e66c35987e1976e5460701a1bae5f1

    SHA1

    539751e4f2db7f01a7a2c7a06da3ad0c23e29ddd

    SHA256

    66d8cd2dfba0b3f732930f8cbccdee72bb24413164732cfb3b153aa2a1d0be05

    SHA512

    865a84696143103cc1268aa94b7cbdc8a66472e7e3767e6d78da348a938535461c087b5f4d1a3b67cbf75a012a01aef1331c7052c2970ba65f02cf1c5a6083b2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    55043b494c35ade70fe2d256067ee91a

    SHA1

    356771ff0c06e9effb49405eb33e961b78f1f0bd

    SHA256

    91c49a3d00cb3351bd8a3e995f2442ef16e8153e732d827d734acde91ac1b0c5

    SHA512

    2eb03c341f3f6e2f9dca86f1d74753c411475864747e6c35df77c3ed8e6125ad489e077e4a8e93cfe8f7931775b33ba6414f0ff40702489db197ba592ed6d129

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5f0933afd97b74b64bd3c72f4eeeeda2

    SHA1

    848bd715b00a29a7e302395d92ae08d6e1a58396

    SHA256

    73f7bbf32142a7d4d4aa19f8b3b3e13ca223632d2fe03f22905a66882dce5723

    SHA512

    97d74fe3ef415ea412f56ac8d4593e0460a77e28b686798ba565fe0c777adafb7bb95bebf6af58063c4375a904456dbafc384aa08d7add567ec9d546d481a3fb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    cbbd75dc7f858dc8fa3402ad746aa6ca

    SHA1

    c13831f992b09bf9beb4e304e1897ffb8106ea6f

    SHA256

    9271a4ef0063011afa56499ddb155efe43d95aa5b23dd5a4011aa4175180a50d

    SHA512

    4b54c29b4afb174780b0d6677025aa4a61d3057fdc08db9806755be4837d83ae26dad8eb044495b556f1b066543dc88b16e4bfbf09f4c9fd27815f4b8b862ef8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6b57394e08198184cb237056d3caac1a

    SHA1

    abffbe08169fe6ea4524050f0ac24d3df37558cd

    SHA256

    8e862b05ab717d3057485cf9cb055e95b4060b61f2c551849e7b3fb48ff5f792

    SHA512

    ba1df7e9e6e2f8a5eca46c3f436fadb6baa20995a19c1a02db8e48a7e1a398570992ce265aa904f38beeee158105a45ac50233b5415b8df3779ebad1f1cf608d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c3b2155093520701276ca7aee11fb3f2

    SHA1

    5a3e07022a1d57b5c5ae6cc6dc106e881561689e

    SHA256

    85b757b165e21a9e527645e872fa291a1a2a1c8bb237db929c5eff20e18bb3c4

    SHA512

    b6804e49e8d9a80c741e5fe78fb9af50c3b740eb6339b3d4a05e9f51d5492fd5c8d8d18d26cdf29e9e4b19b513ee1a5914b543b3e0402e54435d935b1027f683

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a44f5292a6d283e95d3769c9d0311500

    SHA1

    69352229c26ebeb4546c3fde883fd7bf401efd2e

    SHA256

    ac356b710bb22902d9589132c66ae5f3a0f39374d084c655bdc2eb5f65286cc9

    SHA512

    276a7d749a4dc1a72f0a5600b78677b9a38a70a83efa6315d6d764320c7109179bd926873467caeec5d44c793ba59d804b9a0ece5c8089250ea59b7cc7230473

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    90a39a1d812abf166dfbd0ee029bb6f2

    SHA1

    9f756f50ab9098788a14d513ab6769ebbaeb3384

    SHA256

    61dd4d19d9e20a3520f751affccf14fd9531f4dbbd0ecb21c3295f2c0c00b032

    SHA512

    93bf5b774a0b2117d1c34c7377d2e7cd0c1b757e03bfc0220e07cfc26bde6125d74a63479c47227da4c5ee1281fa16a7ffd9d8c6326955073bb9d7afce84c710

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4364476293a1b697515cd44fdcb8b714

    SHA1

    2380d7ad362cb5f2b2ae9baa7f4793725ed4e969

    SHA256

    23f901b9a5d05dd3425502e66ff21d396c73baac823ecaac25b5e2077741893a

    SHA512

    5330435987ac426e1360607170df086c92aa6d6b28620d9fd1ec8b76f7fe3a5d2c7d40cf469ee50d45623ac5f7c8c5dd740914368059efd66f14c7ac6c13c57c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    625022cac93bf1321335f71a9aaee567

    SHA1

    27815c78ad4d69ab2ce264a754003ea9d27758b4

    SHA256

    be3014df2c24efbe25d98f33e7e1fbc542df5624390eaa6773060235b66f5988

    SHA512

    2bfea67d7cdf498f78a3f52c002171f8da838c4fce3db096c5936055f2235170e63ab81278eb1e42bb986b01e5f5e17d3aa6e7caf6b47f93de97a9c844185faf

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    011192d73c0e9259b253311d350abd8d

    SHA1

    ca69e354655ff33fab5bb34bf35aeaa5968e8d46

    SHA256

    c5cfd17a0958af3145051a2184d0c9cb99fe201c33208333a615324c2f762054

    SHA512

    e975bd989d54a0a1592fda8f274d8c26bc76b85ce49a9c0798edf7d7bc08b794d2574d4852a312e789e0ea3b7329e1b40ba04eece67c53051469402983b4d868

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    18b5947bed5ac8cfeca7833e136d4a52

    SHA1

    3a0c3a9ecba7682dbc6422dc4bac9a684535c537

    SHA256

    b1dde9e50847956da3b65023fa1b6a7f1a6a20bc438c0b070aa8e54a9c0208dd

    SHA512

    fbb6e09c72a87627a9b080f7f6f4f67c9dca21580e1f9a1f98705e1f650abce9ac622509d2f797752d3f47e8a3c7e87ef01c505e372b7f497a600207d9034ceb

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    a5b1579d0a0334b3f09dc3ae6886e74a

    SHA1

    45572a2f71e34019cc5b2ae75b19ee460d2e6a50

    SHA256

    d078ca958d28fa378d09a5fe54405ae7e8dfe5cf99c20ffc48b4abbc0e13e58b

    SHA512

    52fa33042992393bcba9996fa8c8cf62cdf700a2a8f45d94148f7aac7691323bbe1c88632b5ca9ad27cc9ee16a77b65f3ba124137ad512b1b2a4b142f6bace30

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    74a521028a8ee7313956be1c55da7107

    SHA1

    b6c00241e9c33488880eeac03b633362ed6f097d

    SHA256

    2ddfef28d100af62a51aaec599296d66588d1bbbdcf3a68ceac68bc2b07a6814

    SHA512

    6ead37d93495b8df28c1ddeb34474f7fc5cd705ac0897e4347fbbbd2b6ea98114b0bd3d8fb3daad056c178f062ccf6ee56a5dfd52fe3535eab76e6884467397a

  • C:\Users\Admin\AppData\Local\Temp\CabBE23.tmp

    Filesize

    61KB

    MD5

    f3441b8572aae8801c04f3060b550443

    SHA1

    4ef0a35436125d6821831ef36c28ffaf196cda15

    SHA256

    6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

    SHA512

    5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

  • C:\Users\Admin\AppData\Local\Temp\TarBF00.tmp

    Filesize

    163KB

    MD5

    9441737383d21192400eca82fda910ec

    SHA1

    725e0d606a4fc9ba44aa8ffde65bed15e65367e4

    SHA256

    bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

    SHA512

    7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf