Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2023, 04:05
Behavioral task
behavioral1
Sample
248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
Resource
win10v2004-20231020-en
General
-
Target
248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe
-
Size
9.1MB
-
MD5
731c33ce4a553729e10de4a4be6facd2
-
SHA1
dee8bfd8b9832e240eb1b7e0d3e68dee7e1c3fdd
-
SHA256
248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff
-
SHA512
f0a39a64f780ca98e672fb54e8241c3b3ef14cc17a03fa777599a4b926f8c947496acfbb1fb902352bb252d7546b4fad5e003c4b2fbec8c4f46ef32990ddb11b
-
SSDEEP
196608:02Gl8exN3BiJ96i6ZJ8Ldm7EVxLfu+cZ387vzwquh:02GmGRiJ0i6ZJ8J4CLfu+cZuzwquh
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0008000000022e1a-1.dat acprotect behavioral2/files/0x0008000000022e1a-7.dat acprotect -
Executes dropped EXE 2 IoCs
pid Process 2352 gpuz_installer.exe 5044 gpuz_installer.tmp -
Loads dropped DLL 2 IoCs
pid Process 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe -
resource yara_rule behavioral2/files/0x0008000000022e1a-1.dat upx behavioral2/memory/2916-5-0x00000000006E0000-0x0000000003049000-memory.dmp upx behavioral2/memory/2916-6-0x00000000006E0000-0x0000000003049000-memory.dmp upx behavioral2/files/0x0008000000022e1a-7.dat upx behavioral2/memory/2916-11-0x00000000006E0000-0x0000000003049000-memory.dmp upx behavioral2/memory/2916-12-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/files/0x0006000000022e3c-18.dat upx behavioral2/files/0x0006000000022e3d-30.dat upx behavioral2/memory/2916-31-0x00000000006E0000-0x0000000003049000-memory.dmp upx behavioral2/memory/2916-32-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2916-42-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2916-43-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral2/memory/2916-60-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe File created \??\c:\program files\common files\system\symsrv.dll.000 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\tiptsf.dll.tmp 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe Token: SeDebugPrivilege 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2916 wrote to memory of 2352 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 85 PID 2916 wrote to memory of 2352 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 85 PID 2916 wrote to memory of 2352 2916 248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe 85 PID 2352 wrote to memory of 5044 2352 gpuz_installer.exe 87 PID 2352 wrote to memory of 5044 2352 gpuz_installer.exe 87 PID 2352 wrote to memory of 5044 2352 gpuz_installer.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe"C:\Users\Admin\AppData\Local\Temp\248c0212652288262e83cbedc81a67667bfe7d00f4af3c4f0e2e037e2959c1ff.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"C:\Users\Admin\AppData\Local\Temp\\gpuz_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\is-M9UFM.tmp\gpuz_installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-M9UFM.tmp\gpuz_installer.tmp" /SL5="$70068,721408,721408,C:\Users\Admin\AppData\Local\Temp\gpuz_installer.exe"3⤵
- Executes dropped EXE
PID:5044
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
589KB
MD588ecea0e77f113ff2b9268d05eaaed51
SHA17e2175aa0cd3de8351ad051acf77ac464b6d9308
SHA25699e0c24ab51a20e0a169f52eb615551f16e03bc3bf84f0af9f9207fac5d6f646
SHA51243b8a32515dfa84dbcd85d8f292f4e37a170e6dcf4c97289cda8efe2fddcf3fab3753fe27a7d95a9b6510ce6370e26a8f556cd3c826dff093b9ae11edc41d453
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
67KB
MD57574cf2c64f35161ab1292e2f532aabf
SHA114ba3fa927a06224dfe587014299e834def4644f
SHA256de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
SHA5124db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
-
Filesize
175B
MD51130c911bf5db4b8f7cf9b6f4b457623
SHA148e734c4bc1a8b5399bff4954e54b268bde9d54c
SHA256eba08cc8182f379392a97f542b350ea0dbbe5e4009472f35af20e3d857eafdf1
SHA51294e2511ef2c53494c2aff0960266491ffc0e54e75185427d1ccedae27c286992c754ca94cbb0c9ea36e3f04cd4eb7f032c551cf2d4b309f292906303f1a75fa0
-
Filesize
9.0MB
MD5b12cdd70c477e02ee3cf39443b39036d
SHA1d4c83022ca79a3ec997b007e5875edc120c52498
SHA25695afbc3d36bed06081000a1596e6c14ea9231eda031b1901fcfcbda09aa6adcf
SHA51290d6b439de98d3cbd261df1b505a267d63aa5583adb34270a1a92a259054fd74a0954516e97a72b193c7312df39d1867108ad1e825d2af140a0e98581ccd4ca7
-
Filesize
9.0MB
MD5b12cdd70c477e02ee3cf39443b39036d
SHA1d4c83022ca79a3ec997b007e5875edc120c52498
SHA25695afbc3d36bed06081000a1596e6c14ea9231eda031b1901fcfcbda09aa6adcf
SHA51290d6b439de98d3cbd261df1b505a267d63aa5583adb34270a1a92a259054fd74a0954516e97a72b193c7312df39d1867108ad1e825d2af140a0e98581ccd4ca7
-
Filesize
1.4MB
MD5db0fe2fc8b640f81be6103efabb69fc1
SHA1b8ede445e915c83981ec63b5ba5cf32ec4017f01
SHA2566cdfac9a6fd83d7a0b652bd8d5a971a753704302e697c3129dcaa5f2de465a44
SHA512086695eadbc175e1fad454f3aecee927846fc22ad9f99933b89a722e8e48badc1ce0fb77237711aae674086fff0ee9ba875c79c4f67e84800b72723b1426c393
-
Filesize
1.4MB
MD5db0fe2fc8b640f81be6103efabb69fc1
SHA1b8ede445e915c83981ec63b5ba5cf32ec4017f01
SHA2566cdfac9a6fd83d7a0b652bd8d5a971a753704302e697c3129dcaa5f2de465a44
SHA512086695eadbc175e1fad454f3aecee927846fc22ad9f99933b89a722e8e48badc1ce0fb77237711aae674086fff0ee9ba875c79c4f67e84800b72723b1426c393
-
Filesize
2.4MB
MD58e2d270339dcd0a68fbb2f02a65d45dd
SHA1bfcdb1f71692020858f96960e432e94a4e70c4a4
SHA256506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811
SHA51231eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647
-
Filesize
2.4MB
MD58e2d270339dcd0a68fbb2f02a65d45dd
SHA1bfcdb1f71692020858f96960e432e94a4e70c4a4
SHA256506176b3245de84bb0b7a4da4b8068b9dd289eb9a3a1757d4183c7c3f168c811
SHA51231eac8aabe8ac83f24d4eba21bc3a52b56105f52402aeb00e505a6be3208cf92cc57529b26f1b29605f554dccdff51e9f28f584268bfda689f53be624f3fd647