Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
0s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 07:01
General
-
Target
5b316db7c5c640472cc62c1f760cc89c.exe
-
Size
255KB
-
MD5
5b316db7c5c640472cc62c1f760cc89c
-
SHA1
4a49e0be6076a57a2329548d1668045c1e8bee02
-
SHA256
34b4c9c3d11dc9e1fc6734a5793ffe1adc7c6fe33ae833743d7b95edb46e080a
-
SHA512
ba796eb9b713fd6dbd908cdeda62f02f3ba8042663c8cdc153cbab14d0bbed589d19c12bd449f45af133af98834ae6f101798057ebd2cc5220a735e2edbd646c
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ6:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIn
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
AutoIT Executable 37 IoCs
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory 8 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 7 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b316db7c5c640472cc62c1f760cc89c.exe"C:\Users\Admin\AppData\Local\Temp\5b316db7c5c640472cc62c1f760cc89c.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\xqwibxzcbj.exexqwibxzcbj.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\czjpiiyx.exeC:\Windows\system32\czjpiiyx.exe3⤵
-
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
-
-
C:\Windows\SysWOW64\avjuejjzjaori.exeavjuejjzjaori.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\czjpiiyx.execzjpiiyx.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cjayclegjnmanvo.execjayclegjnmanvo.exe2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5bc10799ee2c1ddf9cc6551841a863a44
SHA1cc8cef7476e4191c6872710a053c03d8b3efde74
SHA256ef45b255e84bbea911e4aebc45ac2f0c055ab5595f2d420d4607bee025817d42
SHA51230169a1d0b4a5ef119b17a696f8d239ad73632fb52cf221138b69ac46ef7717833be9f12e46c0aef46bc5c859403c290799814bbd81353dc7bf198a2bd20fbd8
-
Filesize
9KB
MD5c7ac7bb9ccabcc301cfa2f573b93d062
SHA177e1c011fd97d8eca04ba39253917424df78c0ba
SHA2569cd9f563ea72b3b52435afb408e2867aacba942024d62de27927bbbafe18ad29
SHA512efe5c863fa4a2c0f35cfbad8e4b65e293bef05b6b00dcd24acc5ac4794c792475db015e81caf88ba9f6e2d4fcdf3f11cdb96f4711f204d7242ca58cc55bd0f63
-
Filesize
239B
MD56beadbab11a944bd7fe34953d11cddca
SHA1f1bc4e4fe08b745a84d62c5b4ff234e261b6e7cf
SHA2562246896cc51e6b2042b40cf02345c9bb3cd3f309d3faf6f1e999e64cb6a872f1
SHA5124f6ac5f48fe9a1cc2e291905a2b59766f664a902d3ddd41986d4980d5a02526058f0a5199d4b4ae8e30c2c7c8bad3984143757bdbac44a2db3bd3405d7064cf5
-
Filesize
3KB
MD59b52d3d8653b8aa4cf773de4370a6953
SHA1911f450a63e99d74bc176c397f0c5969892df4ca
SHA2561e6f298aecbbbe52918263424f75121d9a1ca5fa8f426ec5e323019491d6ef90
SHA512274f0b16aea58441fbff09d232f967f5320507462a06da4356c77072c57d9662c11651e0108784cfb960ff9a75e41a6cc20a89d4c4f3e25d7f16c057928b4408
-
Filesize
3KB
MD5d738a163d336449670aec3ceeeb17702
SHA1190acba5ea2de3eb5e38baafb7eb22a3b8c8a2a2
SHA256a199770360417d4195849dd5d8512d97699798bd5b1145dc74edec9d5b4b7d2d
SHA5125d8df3c95fcaafedbc4d214b4951433bdaf5e76bf2d0bbc22d5202c2ebe0b85c19af593919e3c424f339a4f160b2b4cdb341c967a21424f3be1ddfb7cab93ebe
-
Filesize
74KB
MD5ac16026aa52de7862612e2cd58af222f
SHA182ac278fbbaf318b2c8a6691f4626c1aa6f03794
SHA2561834051acafe542491c33d55f6c710c9cefdb948ce4333933a446b593fb8b12a
SHA5123500c2716fa73123333a2693439a1fc8a05b198072bedbc99c159b98dbe73b5c9e058f5491e56f62afd456737a55dc394681eeb13e67fa08e988d612ceae6a8d
-
Filesize
43KB
MD53d4749858002396e8f43f213a7a72096
SHA166bcd0276b7e01d52fdfabfdffb51118ce1e9cf0
SHA25633aed93fdbec479a86bf12751107fb9777c0f01159e6aed6ce372f2e78486855
SHA5121c32bfe412e1b6c670121bf84e31b5b3ef604da797524710789ba83f8573faf40d0abf05f3775c333e2370f0857b0a75cbe4c28e77113260be24be3547564fc3
-
Filesize
45KB
MD5b580fc315dc2970e6b719789589ba720
SHA1986a9717da2f396b790da60e44348396c8970c1b
SHA2566e63d35a9a68190b875f9b7f498c15fceae07344f35ad262029e82de2d44b4bf
SHA51213249b47d1c04f6a698e273d134e7a33f775e635e114287480b586dc88e608dd8ecf0808035a5ce487bb6d1d8a2720c0a4fcb8426cbf966d54a334abbfc544a2
-
Filesize
85KB
MD5d6b01df19f3f56dae9f7e66c80c12d76
SHA1ca29165bbd2757285fb891d2f388c8f1dddc1cb0
SHA25617ec93589e61894a56499f8682198a225f975c04a605994811ff5cc259669028
SHA51248b3e9ef14053649005f011ac54d19e25da027c1fb55442469d6d495b150092d9fd5909db6c7802639f03836d8fca4d21a1568cb77bfba751a57ce7f7a42a555
-
Filesize
80KB
MD52aa4d6a01fb3ab9eb40eb905b5307001
SHA17acdc865df9e66b570bcb8b3a1b300de3901c6e4
SHA2565818f8bd313c1338525f3b04a0f81a5b8ddf122458382c53c397e9a68eedb68f
SHA512573f60626a458ccb95fe3a1ec7e1a0bfbcf900e7e86e88a214e9a08116dd0485370d36bfe8bc2228d899ab56dca2f331034f0c563ccbace6b53e057bceeba3e3
-
Filesize
64KB
MD509a980f239086dffc2cb495f29d365f1
SHA1c83bb2bc98a7d917d544665994d001cf9d1c8f98
SHA256f2baac8d0eab3ebb033dee57c70a4d02b544556699af982a345fafe635d97d71
SHA5122176cd130412ad21f951033172a36ed92c6eaab5f392988669e6467860272aa06e013a881240ebd1a54659bca1914fd10300d775fae1db317619e878d03175e5
-
Filesize
10KB
MD5fdd641e3ccd3ef8a512747610a3ef9c5
SHA1897ac9f232941e9444adf43d10ff9ba503984dc6
SHA2560f1ca5d8c6e2ce56932d14bf7c1050083ba611ededaac283d456dd57c90d3fa0
SHA5126ae9d2b0062667ad29a26e546a2f07cb296c2ff396327e389b7527e10ebcee33c12017bc3b34b834c5d7b422136dcf753e83f7bf4821d9aeda570c4ae3c51b33
-
Filesize
81KB
MD525858b2bf6cf889fe5936e0b8cd46d62
SHA1b526155cdd991a021a34581e5a10c2b4e48ec372
SHA256b60994d582c869cf6ff8be6a01ab05faecd089162cc91517bc6104e8689d6d0c
SHA5127365a5ae9afe476a5826f5e41772a2bc9c8fb9112e56fa0661d41046521f628113bcc8fa6ac9cb634d9344ec77d3eac8dd9e9dd332c32eb16d7a255763efa0b8
-
Filesize
44KB
MD5eaf63226003c2eacb8f596373ab5c489
SHA19151eb065627eec5c0c136846a143916f7106076
SHA2560e9567da2decc398372c5cc9b82435ff56453e9183f42675493533d4a3561a0a
SHA5122a3a46e4e59893677f7ded3f4b9b397a60fca1e4cb67092d11e2e7d90229a5b1092dff5e8f87febf6f10573c68c359cec2a5bb5ac161e9600d92ac61163d041e
-
Filesize
28KB
MD50a6fc43faa1aef4554f68822251dc1fd
SHA11659f5b39c813a65ede5202295d45be81b4d4a95
SHA2567a6f38a02566dc1619ae0ad721f0f03a53a73df003ac82cb0b12d1db5a561156
SHA512c4435e38ec3ac1a8861c9c2e2f722ee6bf3f1e0308a7b6cab77953e54bd590e54031c9947d5240b2f497e46e952f5528f5a5f50f3d2ae705c62cb63bd3e26325
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
1KB
MD5aae9ba560dbc00690437eb1a3dff07cb
SHA167661164a737270763539935b477b4c6d8a01f27
SHA256af70f933480b437f2be17955d43baa75dc9be2217531bc720844cf4c5bdef03f
SHA512408921ed25384c98506097f1642c685e5feec0d654ccf761959984651e9851cc89451913dbb5ae022b0e1f2ae5ce5ad4691c3efde607ffae78f02a07bbbe6024
-
Filesize
37KB
MD5af7f2954656ac53400aa90ca15d0812b
SHA1eed829e477966100e2f7b200d6a8ed0cd14920b3
SHA256b0b156731fe275085acfde5d1c8e3323bfe592cf40323309dabd46baf5f309d8
SHA5121fc5e2383f243a50fbd5e087fad42fc2a5cfe99ea3329c78c11fcfc7e066773949b940c8063982125ebadb5a8e007993c5e50300e248442d6ac2a954145f1412
-
Filesize
50KB
MD55225086fcfb460472e8c7d31c541502c
SHA1d881775fcdfc2b269acddc669226a918256b42c6
SHA25602412bca02b7748b5dbde74dc2423fc1edbe2b0b501adb560f0893b47ad01fea
SHA512937d8678957af8fcd22fc312d54f1d05f861eb9b286e3da058534bd7c04b0ff091042bb4b8c5aea7c694ba1eab48e33adc011ea52fdc5af51562ffe0fef7a0d9
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB
-
Filesize
640KB