Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
3ede5be9823ad0a05a22fea3dac32212.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3ede5be9823ad0a05a22fea3dac32212.exe
Resource
win10v2004-20231222-en
General
-
Target
3ede5be9823ad0a05a22fea3dac32212.exe
-
Size
823KB
-
MD5
3ede5be9823ad0a05a22fea3dac32212
-
SHA1
fd1eda436af8028931f5c91448ee2b949711995f
-
SHA256
14e9fd0e2ff14711c27c6ac5bf609edbddb421ddbce4b383b0c630c66c11c766
-
SHA512
54a3ad223579d61ae0d99658d0d13abe23093004334cdb08f9973bf20f7e9d18f675791f6bc62f8c6006faaf2b263912bb65dbf07a44bae59ec2a4b5bb8f206c
-
SSDEEP
12288:7xpJfslZtuaVd9lpmhwQbift489IVGD4xJFl6Xqb5Kbmkg8SUm:Vp9sVuaVdvgVbmgGDijyikg5P
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000023270-210.dat acprotect -
Loads dropped DLL 5 IoCs
pid Process 3268 3ede5be9823ad0a05a22fea3dac32212.exe 1452 3ede5be9823ad0a05a22fea3dac32212.exe 864 3ede5be9823ad0a05a22fea3dac32212.exe 864 3ede5be9823ad0a05a22fea3dac32212.exe 864 3ede5be9823ad0a05a22fea3dac32212.exe -
resource yara_rule behavioral2/memory/864-220-0x0000000003360000-0x000000000336C000-memory.dmp upx behavioral2/memory/864-212-0x0000000003360000-0x000000000336C000-memory.dmp upx behavioral2/files/0x0006000000023270-210.dat upx behavioral2/memory/864-425-0x0000000003360000-0x000000000336C000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3268 wrote to memory of 1452 3268 3ede5be9823ad0a05a22fea3dac32212.exe 22 PID 3268 wrote to memory of 1452 3268 3ede5be9823ad0a05a22fea3dac32212.exe 22 PID 3268 wrote to memory of 1452 3268 3ede5be9823ad0a05a22fea3dac32212.exe 22 PID 1452 wrote to memory of 864 1452 3ede5be9823ad0a05a22fea3dac32212.exe 20 PID 1452 wrote to memory of 864 1452 3ede5be9823ad0a05a22fea3dac32212.exe 20 PID 1452 wrote to memory of 864 1452 3ede5be9823ad0a05a22fea3dac32212.exe 20
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ede5be9823ad0a05a22fea3dac32212.exe"C:\Users\Admin\AppData\Local\Temp\3ede5be9823ad0a05a22fea3dac32212.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\3ede5be9823ad0a05a22fea3dac32212.exe"C:\Users\Admin\AppData\Local\Temp\3ede5be9823ad0a05a22fea3dac32212.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\3ede5be9823ad0a05a22fea3dac32212.exe"C:\Users\Admin\AppData\Local\Temp\3ede5be9823ad0a05a22fea3dac32212.exe"1⤵
- Loads dropped DLL
PID:864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5a990de9edf0145ca5b01761978f49432
SHA11415f5d123dcc03f286548607bb8238826cae858
SHA256338187c9d996921e45efbbc6d558f75d2eed32fb73cfd2a14189ec039091fc65
SHA51232541e89523dfbbb891a215c1e7261d83a79db5ac3cea711c48f7525e98988955716a86a2ecd0264f04a36c8c8f031af57bd7a16496b3b2fcce055d1264d22de
-
Filesize
25KB
MD50f26c6d34d3841e93145dd00d0175651
SHA157b068569d0eb2336503beed87589629ab2a6f1f
SHA2560cc5dc45b6a04ec236f4ecf0eeee212096b1561179d71c49dd5fc82aba706741
SHA51272785e520d78a4ebd8779e5497806406c1b91b9c05ed82a392a6af689781e26c77f0032c66540b80e2e7e457128df2afd0647b0dbc970a11d0cd4ee3930d47a5
-
Filesize
8KB
MD5e440044afe6c761507a996b5b45ab0f9
SHA1ef772c758fd5d6098b41375f35ac26f3963cc306
SHA256b1864aed85c114354b04fbe9b3f41c5ebc4df6d129e08ef65a0c413d0daabd29
SHA5128a82df90459929de1c91ed29a122a149749d42adbb85faf0c3123d0f0886babc90cb93de85105feb7497b46552a6747ae05b985f5a488d1d8f1a2a7db44077b4
-
Filesize
2KB
MD54bfdaaab9014fe129bc6388fd5687c8f
SHA12c6ff28245e1dc7ec9ac1c43c3cda354d07b2c4a
SHA256e9167e0da842a0b856cbe6a2cf576f2d11bcedb5985e8e4c8c71a73486f6fa5a
SHA5123a1a4d838bb5cafe71da262ee7bd6dccbd30dd4d7abe0d04f6ecf96bf704d5e111967be812894a47f2eb3374ee110620b7cc47eebac8b72ddcf7f506ba82a607
-
Filesize
52KB
MD54a4845ba1666907f708c9c10a31ec227
SHA11ebf626adc84147e5114885ce779f92d6eb68f3a
SHA256a1ffee9687ab4a23a78b3251888aff09e2896d76f8d16d713367b265f125188d
SHA512d009f5e2a2ecfbec5e5e788ade142d612846d0c99921774e4a11b060998dfb0680cf1e1a54604535d5560738093f9ae166866cb23eee5c7d9c4e5cc5a33e7464
-
Filesize
76KB
MD5c10c479b0d3c60996b549af61a284b83
SHA1a272781f7fa57e040e94a37deaa76a19aaafffed
SHA256b4f607b365d24cac701ab7c93017002c1ff6b40243de6ff4b288a3fa9fe021ce
SHA51277556637bb235d6bd5499881c6b7a48eb219c110b7bbd131fa98ba92c2e59137b3dceee0f7f87dd927fe603dba470c0660152171c363ae0c3a303f714d64d3ed
-
Filesize
80KB
MD54bf7db111acfa7c28ad36606107b3322
SHA16f20b9f6663ce0c309a2ce60e718d64ffb6c75b3
SHA256bfe8445c38ee71240e856f85d79e94123d7179bf43688de0e2a14e32e6ef21b0
SHA5120a5e66a65b80e15d8198f2934c58227ae17680f0fbea9865b2f44af82a29c53d4f95cf9616b4dfd75202420eb73b7d962cf2c84fdad6ce26afe1eb4bb978d0b6
-
Filesize
11KB
MD57292b642bd958aeb7fd7cfd19e45b068
SHA119a800620d041634abae5b5d096cb0e87ce4c188
SHA25690f1bb98e034fcf7bfddb8cb0a85b27a9c9ddb01b926b4e139e1e8fc53d41d09
SHA512bd758e0833454e0aa2af976ac94fde17c5401102c5991887cefbe8e337974381584c73e2d1e50e49263c55c3788e24dc7f8bd0b9d2a76a6cbe38e48dd9d6c44a
-
Filesize
10KB
MD57e3c808299aa2c405dffa864471ddb7f
SHA1b5de7804dd35ed7afd0c3b59d866f1a0749495e0
SHA25691c47a9a54a3a8c359e89a8b4e133e6b7296586748ed3e8f4fe566abd6c81ddd
SHA512599f61d5270227a68e5c4b8db41b5aa7bc17a4bbe91dd7336b410516fa6107f4f5bf0bbb3f6cc4b2e15b16bf9495fdc70832bab6262046cb136ad18f0c9b3738
-
Filesize
4KB
MD5d02a497be5f89c44827f142c4662f591
SHA138f83ccbac11de069df0e1cd79a6fdf7f006516c
SHA2566d29dfd24695535b5973d8261d93373603ceaae03ab97662fe1b3dcc47d18226
SHA51281c87f9d56a8ab7703a4effd3ba7b982b6765ecbdc0dbb1c595f549c4310a5db57dcdc38929eafe56983ea8cefc0b572c3faf82a4b62eb7c564b05550215f1c1
-
Filesize
11KB
MD50a29e1b270ccea61aba7d7cdd10e0388
SHA176bf03361bcaef475ffb864bc1903c9bcaac7b44
SHA25667328334d53e7c0c52c23ef5febeb1ab34d87ab7699868a9f547e5b0db4fdceb
SHA512d024407b0852155c225852e6dd1a5440241a16c4b54a408606318ad142381ebf51bc8db09a4d175369619aaac2224311914892d23f763f7b533a6b664b93cf7c
-
Filesize
10KB
MD50566a6c7945ae4b1a9a363b625768d02
SHA1854903aaf63860b2d836db889d0448bc43e8b0bb
SHA25678b8aeecb2f639a5ca46de1bd8d39f8647c3015c91448f40c7b0ba6c3739b737
SHA5121714df0fe9bb5849cabbb511807b3995c9d798c544b5538f40bb400b1e7aa1c320bfd9a441d0462d8d11f99384525949221e6d8e3794f54071253401efd07b7b
-
Filesize
13KB
MD5d4913b3dfc6136467ca1367e5464f32f
SHA1f186c17758c4b95770f2bc4004e3f672a47d12bf
SHA2560ed1939e72fa1e6e24e5c3b8dd1ee8604b4572711d1274fa16dd0d3a46d6b848
SHA512c0e40fda1bf6833a039dbb4046439b25321789d0395a07832f10b3ebe5051d6905a506f1922f0f3ce54a78795e495fe2c08899f2254264035e7fe236cce3f4f3
-
Filesize
117KB
MD57bee2dd5fe4175226ade0e08e14e32b4
SHA1cebd95f07713baa981d9358572ceeaeecf83c8de
SHA256027c48b6335974f1fa837ed274abb9a6f4f348350f7ad3d87834adb19380359f
SHA51266a631ca685a71c6ec26d45a80df583a445186277a48dd293ba9fb5e5f1f9e3ec7a3a30c7902c6f0c81a008085ff1f960f823c2383b575c64d3cad085fce535e
-
Filesize
60KB
MD534aa92cd7f60272652ca127e800e59d9
SHA132768b17617c311b3a22c3570851d9f29381c784
SHA2563d6253370679721f8c0af580360f508ebc3d78beef66f4ea35d9b7ba5000620e
SHA51298dc0e1a60c504fdd3a842137926277aaede3e8c46085e48f1e92d5ed6b12b5ef8681f39c523e74b2c073c71ece6d79a8c32b1f566002c46b3d12dbf860b5992
-
Filesize
18KB
MD581f3897e210d2c45e9da3670c7dbe4a7
SHA10f5fd37672efd549b2fbf89770ed5c95f388fc86
SHA2565afcc891c767234cdd33d49840f35993cb23d6e4f6c31d0afa612deab9c185c9
SHA51206d7be2569a0919f71d427f2f71862ff66a58c63103f714790c51152a359d3057d1208525de3a17d9e6ebca72991e3524689d28cf750ca86f692a1ea380cf83e
-
Filesize
166KB
MD5ccb89411e29b7b7f84e910f847b1555c
SHA1d9100b48421c33940e18fa153a1a7db29e58ff3a
SHA2567dc6c0b4770e415f89d3d367c27671cb289db62209507b4ad8dce1398b9d0b37
SHA51286319c0f2a70e18e9a039d9e152e0cb1be093823dbf4fdc82f74b9ea47c280a8e8c93735c6650f558b188fc1059dc5d6f2a6428ff1c0953ca4271cbb1e35568c
-
Filesize
118KB
MD5f82149b2a439a2c21ce889ca61260ddf
SHA19166b123d60d1d5e4caf6daa6ee1c0c51227159c
SHA25627438c0f58549ae73d0a2cd2a698d0cae170a51e024765c4d96fe45e423235c8
SHA5122bd45a842f224677b45c33cd9949ba7cccd29e2417f53aa98596d825d35302e932b9777ddcc50e44177d98b79c0966c4b781e9ae3d0e1666838be8d6af952a88
-
Filesize
4KB
MD581964864a30ded206b3bd86f14c8cd1a
SHA105f18cf6642e33dddd6f6353eca13e8d5ad72948
SHA256a4ec33d1a368624881a4f08fd46b61c91cfe9af0597f774137630e83f0df92b0
SHA512e9ac8a42beef200b1439fe2a43c6b7f277d5b38963864f614f258dc837accd2eaed7d3da36b82f78c2a7673b4193f84f285212a0ee185c94b095481a8b95c6c6
-
Filesize
42KB
MD5a8abaf5a547369c19f9481118d668ab5
SHA135a934629cc4e27c0ffb86b014a4294a7defa80b
SHA2567a817700cac7ef3bf7a1c6ba8b58c8fe8c59a054dba6c247e2a9c773ef9700bd
SHA512d81653e023da016ae14154f717c1b5bdfe76f1e95e9a31db4a98f32a5d49a6d22616776b9c1be78d6e4f0fa3aca055574aec9a0db219e4344422f0e4b506db18
-
Filesize
6KB
MD5ebc5bb904cdac1c67ada3fa733229966
SHA13c6abfa0ddef7f3289f38326077a5041389b15d2
SHA2563eba921ef649b71f98d9378dee8105b38d2464c9ccde37a694e4a0cd77d22a75
SHA512fa71afcc166093fbd076a84f10d055f5a686618711d053ab60d8bd060e78cb2fdc15fa35f363822c9913413251c718d01ddd6432ab128816d98f9aabf5612c9f
-
Filesize
392B
MD577c50916f90b43c09e38e07b94ce4356
SHA12407be8f458d1aa2f1ffa45b21f782c44e68331f
SHA256902fc7d3982d9386d60c4c304574381563ee28e73de993e28cde7f90499ca1cb
SHA512039a24175948dfbd8c23b070d3aeb7bd93186a6093cbbe760981f1ef87bf7f97ed1f6bf5c6a7d2b9b12834e6776da03c40a03f7f43a9d7803a7f459a8a023ccb
-
Filesize
8KB
MD56a544a1476ac90d7083dfe39ad6ca7df
SHA1e6228d3efb9bfafc743ec174cc8c6d3b5b58a685
SHA2561994f9e3e7ef24737ead6cef4bfe1984afe97ee5aab758ca73058ed7f4419dc7
SHA51224b300d1e66f1ddc38635e517f6a83121fef2049e30269eb83d8fcd7e838c3e25d12567d717e400148ce67940e16fdeefce081d95bd80e8e605d557eae65e30c
-
Filesize
45KB
MD507e03b7a67edf8aec9fa104ffb26b69f
SHA1b2cc254605bc136e9f1bd29c6dd90eee767b2cfa
SHA256293487a745a18ca2054037bb7a69ca7c4bbe19c1fee7ce62cf88672e9b2d064e
SHA5123c2cdc34bb9c18329b475daba4a68f4fe5dbb829e45871286f0ccd3fd475d895830f31cf091e909986367da4c00e0a651c1405f9857998aa5800389d73aa2542
-
Filesize
2KB
MD58004e3f267460e8a83ed24b72291f6b1
SHA101766537875cddf1d48a1d87e2048641c1b4b368
SHA256d2c6858503e065ac5f751365349f236706edbfbdca4b86ed7ea9ef8626996c48
SHA512995b2bcfeeeb7b3a329169973b2d9ba9f69e1042f2b74bb65e9b523c158279425f1dd0688eeb5291850580fd3bc053ac099bd055b8b31ea92625763446525cda
-
Filesize
15KB
MD5fe817136dc3a878750d0d8f5c2df9907
SHA1700552cc548b08602235059f03ad0640d3b568ab
SHA256e58eb2be5a221a497cdbdf817827399bf89730b92c7188e3d9f10a9c88b0edde
SHA512434e6142337d4f2c3e196a4a30bb7c41ea9257bcf9e530c6f28dad1b48c63319cf89a98939f66da984ff3af7de4ed2625aee988157828e723eb928041b654b4a
-
Filesize
8KB
MD5f273a694acedd917336a47ab09efe2eb
SHA18ff862146d5f939ad4de785a9bce2378ef5b8d98
SHA256065a0d4ccd9d5019cb97232a67f5c5ae3e6cb943b48f263f1d1eaf21e15c0e5a
SHA512aeee518d9ef1659372b9b46a09f7bf22ae439e8cb5abf6c588c8fc7971d534388e4ec3ca3fa1e02fb374ee3c5b399e94430eaab87423cbec385ca2db4aa99d4d
-
Filesize
12KB
MD53d8665da9f10eb1cee52aa10aa63103e
SHA1c93598630895b60cabfd22b4fc280158f70e75d9
SHA2565894c927a6b2d7c5c0d43bcb24ba6235ed7a2a1e8d115e3fcea910723eb521d4
SHA512e5a06fa3286319dada66cc0754bd8881698912c917c9b900f22b54f95e3f4b05577b473fac7bdc0ad1ed83457e200103ff2e3361cc6c9b21f969939e4942f7b1
-
Filesize
56KB
MD59071d5a0acae2381208e2b08f683ab7d
SHA16b5cb2e7ee1b5db330b1293f87f5d01c04b32f48
SHA256b07042324547c647b9288d2ab3ffc27037c2751ddd3739fe5b1f097d95d5d767
SHA51299af41f8fdcb692796cae9a5fde1ce5d312e2e34affbd8915f02f4690774bea339eb32a00e27d8ae9d1bd980a080c5eddd553b51f1363581bad9ab6ca0a6eae3
-
Filesize
4KB
MD57dec81a81d64a228af2aa5dddce127b1
SHA1304dc81198081ca2d015ef7dea88a987c7910950
SHA256a6aa1794d8bbafe238f8ba92d62f18bd61ff7884e591582390f3343da3550047
SHA5127ee2dc6bf040ccb1204d90fd025254e7e425eca2fb6a71b18a1c8cdfd489a88c70038e655a29d26e482575e0cc83d585499cc5e6ff215d548befadf117cd156f