Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
24/12/2023, 17:55
General
-
Target
09d33dbd5ab6ae807fcd688e37556c58.exe
-
Size
320KB
-
MD5
09d33dbd5ab6ae807fcd688e37556c58
-
SHA1
e439acec35299d99914dc895f9f3ddca73fdac76
-
SHA256
41756f6245938817ad7b6f25a36e9a7353af20171a39860442fe8c5a4222f50e
-
SHA512
a78bb10698f1ab1abb690afdecf4338c499becc5db246ba0051a6325ff806f736e850452da9931c8cdb82867a17fa03f709cd0161cdf7dea2128dd53c2bb1d00
-
SSDEEP
6144:AfuPiR71DaL7IlQ1AnjBfWaf3XEMs4uMAY5KIJe8LsCvZkpHPgpY7so7tGiq1usT:Ku6zaCeAnMaf309tHjCv2dYpY7sbiqtT
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 11 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 6 IoCs
-
Suspicious use of SendNotifyMessage 6 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\ProgramData\aM21703BmPlL21703\aM21703BmPlL21703.exe"C:\ProgramData\aM21703BmPlL21703\aM21703BmPlL21703.exe" "C:\Users\Admin\AppData\Local\Temp\09d33dbd5ab6ae807fcd688e37556c58.exe"1⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\09d33dbd5ab6ae807fcd688e37556c58.exe"C:\Users\Admin\AppData\Local\Temp\09d33dbd5ab6ae807fcd688e37556c58.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD51cd51935674d6c371b4905c1d155f282
SHA15f419ccd448fc109362529d25fceea887941812a
SHA2565dbe5ec47fdaaf4846c4e036224d689f6b81fd7213501ac0c49c6c254d6d2d22
SHA512d07907319368958a5b470f6334abd5fcb765198a3e89c9a17e2d17ba0512851a58ba210b55db7abcc0169505ecb3f536186848a8b7ef058ef1abac1cd1197e57
-
Filesize
26KB
MD5f23fbe526b99de09feb19df881df1dc5
SHA1e6480efc18ac8bd09dbc40d9eee1ff35646a4575
SHA2564a52908d73fd5d2bb11d1d595ddfce070d080e93cba83f8764d32383e4d95db0
SHA512b9e1019c3911fe166750188e3b3138f2d4950f5b16f52cd1e9f53e98f019676080eb91cc2a3b5b42ca8d01f7c4bcfcaebcdafaabb166702ba41858225ac369ec
-
Filesize
18KB
MD586eea03961989f39726e4274e0d7d3e4
SHA116269062eb46932271bc7993c93f3af9cc864944
SHA2568517dfd65631c5040d9665bbb8f97c51e345d8091c31774eb061e9a9074c9fec
SHA512bbdb6898ccdfb7e3a10a580deb47b75b2e2db9fa127fceca9c7aab6875a8d5dfb11f2ae6d3d431c66c96528bb655146eb3a3a36f4a8e650d1db3a0a439f1433d
-
Filesize
170KB
MD52f91fdb03a5e9c6d8c051f98bf3ce655
SHA18cd612ffe015ea4843fffb99cdb8ae1ede729f1b
SHA256f095f055b8090d52d5a4b35ae5b8fd12da7b71a0969034dd09daf05bab40cba5
SHA512966ec71f59eae5c2b8efe0cde5fc80c374d744b90711a873bfc5b06288ade6b10c5926eeaadbec221623bcbc91c59148875d179da79482b66d9f2e79554e1d75
-
Filesize
9KB
MD5068114e7eb63456275cb421ee6bf4869
SHA1e510d31be02fad13f0df19b512e31aff91570803
SHA2561e91851d80218824afe9182b2756de467598febcb6f412187fd69e9a1b9e8fcd
SHA51251dc1c00c82ce729822bf06e75689f6b7a71d025efece884708abc8a580f51125c5683b785e4d93bccb14ccf55b9dbfdc2a029bf85b8e5eee706dd7c1082adf8
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB