Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
118s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 23:56
Static task
static1
Behavioral task
behavioral1
Sample
44abb3e39573a2e1d1cdc787c41bc7ca.exe
Resource
win7-20231129-en
General
-
Target
44abb3e39573a2e1d1cdc787c41bc7ca.exe
-
Size
144KB
-
MD5
44abb3e39573a2e1d1cdc787c41bc7ca
-
SHA1
4800af743c8f6117360aba3ecd4c393d99ff7ba8
-
SHA256
73e9814afae15d32be894cd397ee30391527608368f8f2c4aa71734abf4bfba4
-
SHA512
5be67214070557c0f9f85b3baa36c67d17ee439531e747d726e3f129dee9b39d5d0b217fd21439321a2f98ae27cbf625f497482d22031ecc7e338c1ae00fd0c7
-
SSDEEP
3072:QuYTsR3nSVl8r9rMj7Vmk1Hpv35Q0NgEGQe2wvW:FSW9rEmkZXQJQk
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000002314d-2.dat acprotect behavioral2/files/0x000700000002314d-1.dat acprotect -
Loads dropped DLL 2 IoCs
pid Process 4800 44abb3e39573a2e1d1cdc787c41bc7ca.exe 4800 44abb3e39573a2e1d1cdc787c41bc7ca.exe -
resource yara_rule behavioral2/memory/4800-3-0x0000000000750000-0x0000000000791000-memory.dmp upx behavioral2/memory/4800-4-0x0000000000750000-0x0000000000791000-memory.dmp upx behavioral2/files/0x000700000002314d-2.dat upx behavioral2/files/0x000700000002314d-1.dat upx behavioral2/memory/4800-5-0x0000000000750000-0x0000000000791000-memory.dmp upx behavioral2/memory/4800-6-0x0000000000750000-0x0000000000791000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8C22C812-B77F-494C-A843-69979FB69775} 44abb3e39573a2e1d1cdc787c41bc7ca.exe -
Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C22C812-B77F-494C-A843-69979FB69775}\InprocServer32\ = "C:\\Windows\\SysWow64\\AuditNativeSnapI.dll" 44abb3e39573a2e1d1cdc787c41bc7ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C22C812-B77F-494C-A843-69979FB69775}\InprocServer32\ThreadingModel = "apartment" 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C22C812-B77F-494C-A843-69979FB69775}\InprocServer32 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 44abb3e39573a2e1d1cdc787c41bc7ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8C22C812-B77F-494C-A843-69979FB69775} 44abb3e39573a2e1d1cdc787c41bc7ca.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4800 44abb3e39573a2e1d1cdc787c41bc7ca.exe 4800 44abb3e39573a2e1d1cdc787c41bc7ca.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD538a1e0b1b1c438c89593ea23cab07b76
SHA126a6a2c3eaebd33febd371effdf822b95cc3570c
SHA2563df8599eb71ec82f13c4737d939189cd63a4bd65973e592ea6a73179a0e1a551
SHA51279061a1ffc8ea7f7b6f8a43beb2b4e03cb02112dc145fd761fe14ea563e7f62520c8470e07d08fd77d5c299b69a60580d2c6e7f63d440532237cb8b6690a8428
-
Filesize
1KB
MD5fbf49975c677dc7f1f4c5ba37378d3e3
SHA16fe1f2d1937126fe7e27b2edb57dc25546fe74d9
SHA256376a7af95b28a996578d539e9761bfb4cec1418ef014ad5018858b4121b235ad
SHA512f8d2bd0ad5d628a1ab4db89e23f1853eb9760822fca80ecbaeea57b808b8b05b100ee3bfe89f545af473a213bb01d60fae7883d17ab69e84c727f5626b1d528c