Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 06:37
Static task
static1
Behavioral task
behavioral1
Sample
0c15a3f53629521751355cd9c17a9c23.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c15a3f53629521751355cd9c17a9c23.exe
Resource
win10v2004-20231215-en
General
-
Target
0c15a3f53629521751355cd9c17a9c23.exe
-
Size
284KB
-
MD5
0c15a3f53629521751355cd9c17a9c23
-
SHA1
27818e12001808d37a4b4508e64a1956cb7779f7
-
SHA256
13584a7184b2e0c89a4e7289702f2935b65a108933342224c0b4a65d5ccc5ec9
-
SHA512
cee9962610db07c7129a0750884c63e6745be11f5d6ef608908c2ec3fdd584e5aa06f5f68deacd838f470807a67667c7b53682a5fd0f604d5c8ed99d47b1075f
-
SSDEEP
3072:KFXoDt6QAmP/NO4v4ZkxhJrl+bAFvxoJSdvi8LPkmSXC+Q+CsG4u8GPMUIoDHG1E:rAQnIaoY3l+bMaJC8mS9xCs/i5TmcoU
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x003100000001396e-3.dat acprotect behavioral1/files/0x0006000000015c6f-51.dat acprotect behavioral1/memory/2028-53-0x0000000074A60000-0x0000000074A69000-memory.dmp acprotect -
Loads dropped DLL 10 IoCs
pid Process 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe 2028 0c15a3f53629521751355cd9c17a9c23.exe -
resource yara_rule behavioral1/memory/2028-5-0x00000000751D0000-0x00000000751DA000-memory.dmp upx behavioral1/files/0x003100000001396e-3.dat upx behavioral1/files/0x0006000000015c6f-51.dat upx behavioral1/memory/2028-53-0x0000000074A60000-0x0000000074A69000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2028 0c15a3f53629521751355cd9c17a9c23.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35B
MD528d6814f309ea289f847c69cf91194c6
SHA10f4e929dd5bb2564f7ab9c76338e04e292a42ace
SHA2568337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
SHA5121d68b92e8d822fe82dc7563edd7b37f3418a02a89f1a9f0454cca664c2fc2565235e0d85540ff9be0b20175be3f5b7b4eae1175067465d5cca13486aab4c582c
-
Filesize
13KB
MD5431e5b960aa15af5d153bae6ba6b7e87
SHA1e090c90be02e0bafe5f3d884c0525d8f87b3db40
SHA256a6d956f28c32e8aa2ab2df13ef52637e23113fab41225031e7a3d47390a6cf13
SHA512f1526c7e4d0fce8ab378e43e89aafb1d7e9d57ef5324501e804091e99331dd2544912181d6d4a07d30416fe17c892867c593aee623834935e11c7bb385c6a0a8
-
Filesize
25KB
MD529e2dcdfb57ee3ab5e2bbc2fc3c42f02
SHA1bd6cafcce5b70ee15311f9f53e9fd4aac819ccda
SHA2562b7a69e98ed4975fd4eade513cff17099c43b3eebe7e7641696d1d20e8e14b2f
SHA512f71c981b3b5308566b56156462d106ebf8e49a32e55b70891f9d70338941afd347cb4df374fe38b9b3d7309f63dd75a7c80ebe02bb8941d558cd638a6f8daf7a
-
Filesize
11KB
MD566cfc94903c8cfa492fdab42bde2026d
SHA1d07194419d914eae5dc54a480ebddb0a8cb32f25
SHA25682e21860521feea4d15ff7f30538b9d0ed1860747c98549ec85217178a6db632
SHA512ecbc2c9361bef9332fe8e1675d11884c344b26f437eee9db3ec0b5999bf20e16b1d863c192e2091375a870cf8f4674deec16875ba56757b88cc859288305eeb7
-
Filesize
7KB
MD5b9cd1b0fd3af89892348e5cc3108dce7
SHA1f7bc59bf631303facfc970c0da67a73568e1dca6
SHA25649b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
SHA512fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
-
Filesize
5KB
MD502f1858b3131ffc3fc5e3a5391d3a489
SHA1454a6d749cf55ff990bd9f57941aca9d1f1674f6
SHA256f00bd6d3e7c7b8e8ad18b7dc6275fb80cc720fb164200a6506f50f6e66998b12
SHA5128147fa8014a5065f4fed7de1fbb9c2ee2c1b94d63596f7bbcf6821ecd41a73d25ebdfa1e71ca74d7598cba063042b6dfcaf050a23d0c855a7b6fbc94147ab41b