Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
165s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
5b793f4c236615d0e919b726ce1c95f8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5b793f4c236615d0e919b726ce1c95f8.exe
Resource
win10v2004-20231215-en
General
-
Target
5b793f4c236615d0e919b726ce1c95f8.exe
-
Size
1.9MB
-
MD5
5b793f4c236615d0e919b726ce1c95f8
-
SHA1
4bd4620de3837f7ac2d728baf86aa03e65e98565
-
SHA256
04ca23812fd999fed94522e3617133a4d46a64fba2fa5e62df4fdb0744f37b72
-
SHA512
30b7c867c636c161565969889212236c247dd218851fc2958f8ace20e4d6e5bf1ec46907d255a3b8fe43a6799635906834949863e5c3cb6b3f55689a9deb330c
-
SSDEEP
49152:6eMMxzYlq98/RkQb8CuMebT6yr3D4DasF1lasFm:6eMMxzf98V4CutbTfrz4DD1lDm
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000700000001e7f3-31.dat acprotect behavioral2/memory/992-157-0x0000000000480000-0x000000000048A000-memory.dmp acprotect -
Executes dropped EXE 4 IoCs
pid Process 5020 RtHelp.exe 3720 RtHelp.exe 2204 Runner.exe 3536 Runner.exe -
Loads dropped DLL 55 IoCs
pid Process 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 5020 RtHelp.exe 5020 RtHelp.exe 5020 RtHelp.exe 5020 RtHelp.exe 5020 RtHelp.exe 5020 RtHelp.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 3720 RtHelp.exe 3720 RtHelp.exe 3720 RtHelp.exe 3720 RtHelp.exe 3720 RtHelp.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 2204 Runner.exe 2204 Runner.exe 2204 Runner.exe 2204 Runner.exe 2204 Runner.exe 2204 Runner.exe 2204 Runner.exe 3536 Runner.exe 3536 Runner.exe 3536 Runner.exe 3536 Runner.exe 3536 Runner.exe 3536 Runner.exe -
resource yara_rule behavioral2/files/0x000700000001e7f3-31.dat upx behavioral2/memory/992-157-0x0000000000480000-0x000000000048A000-memory.dmp upx -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum RtHelp.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 RtHelp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 4972 992 WerFault.exe 88 4656 2204 WerFault.exe 110 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe 992 5b793f4c236615d0e919b726ce1c95f8.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 992 wrote to memory of 5020 992 5b793f4c236615d0e919b726ce1c95f8.exe 96 PID 992 wrote to memory of 5020 992 5b793f4c236615d0e919b726ce1c95f8.exe 96 PID 992 wrote to memory of 5020 992 5b793f4c236615d0e919b726ce1c95f8.exe 96 PID 992 wrote to memory of 3720 992 5b793f4c236615d0e919b726ce1c95f8.exe 99 PID 992 wrote to memory of 3720 992 5b793f4c236615d0e919b726ce1c95f8.exe 99 PID 992 wrote to memory of 3720 992 5b793f4c236615d0e919b726ce1c95f8.exe 99 PID 2204 wrote to memory of 3536 2204 Runner.exe 112 PID 2204 wrote to memory of 3536 2204 Runner.exe 112 PID 2204 wrote to memory of 3536 2204 Runner.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b793f4c236615d0e919b726ce1c95f8.exe"C:\Users\Admin\AppData\Local\Temp\5b793f4c236615d0e919b726ce1c95f8.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\AED09272-4668-6F4C-A5D7-7C1131393B0D\RtHelp.exe"C:\Users\Admin\AppData\Local\Temp\AED09272-4668-6F4C-A5D7-7C1131393B0D\RtHelp.exe" --InstSupp --Supp 602 --Ver 1692⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5020
-
-
C:\Users\Admin\AppData\Local\Temp\AED09272-4668-6F4C-A5D7-7C1131393B0D\RtHelp.exe"C:\Users\Admin\AppData\Local\Temp\AED09272-4668-6F4C-A5D7-7C1131393B0D\RtHelp.exe" --PreCheck 602 --Uid 4F165B0F1E033B4091BC17A8BDBCD614 --Ver 1692⤵
- Executes dropped EXE
- Loads dropped DLL
- Maps connected drives based on registry
PID:3720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 8882⤵
- Program crash
PID:4972
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 992 -ip 9921⤵PID:4632
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 992 -ip 9921⤵PID:4940
-
C:\Users\Admin\AppData\Local\20CE359E-B162-1542-B60C-2AE1ABE5CCDA\Runner.exeC:\Users\Admin\AppData\Local\20CE359E-B162-1542-B60C-2AE1ABE5CCDA\Runner.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204 -
C:\Users\Admin\AppData\Local\20CE359E-B162-1542-B60C-2AE1ABE5CCDA\Runner.exe"C:\Users\Admin\AppData\Local\20CE359E-B162-1542-B60C-2AE1ABE5CCDA\Runner.exe" --UpNav YgByAG8AdwBzAGUAcgAuAGkAZAAzADEAMgAuAHMAbwBmAHQALQBjAGQAbgAuAGMAbwBtAC8ATgBhAHYAUABrAGcALgBwAGgAcAA/AHAAPQAwACYAcwA9ADUA --DownNav QwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcADIAMABDAEUAMwA1ADkARQAtAEIAMQA2ADIALQAxADUANAAyAC0AQgA2ADAAQwAtADIAQQBFADEAQQBCAEUANQBDAEMARABBAFwAVQBwAGQAYQB0AGUAXABFAHgAdABQAGsAZwAwAA==2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3536
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 5642⤵
- Program crash
PID:4656
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2204 -ip 22041⤵PID:3148
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD5e14e6451afc15dd24ebe40e4a2ac20b4
SHA1505665bfc33c035ec949646a374251e4750a9331
SHA256aab10a2a93e4aab741e0b3919378503af08f54b9e8fdf29d3c0bce5585ab2bbb
SHA51248bfa23bd0a299d858cabc739cc12108de2ef3c69acf4944e3b72ba4581be00c6edbb9edf3cbae8518ea59074415754928d9b863db388c29df6bda4eedd84e0f
-
Filesize
47KB
MD51ca77480274d6128af16a97f36fd6d7f
SHA1ac4ed629cf20d61c75c47f89a74e79c116e7b8b1
SHA2560469799f18dee94b7777333bef55182f4512c976036971ca15f44c32fd436408
SHA512dc3fdafe57a6d121d027576e9badf5f22140a0069f5eb1c559f546ba2edef7d737f3f040cf02c7f6697be504dbdf34a2fb13fa350852740539132d46711dfff9
-
Filesize
119KB
MD5deda30850741f7c4e2be5e9dc1942e60
SHA115ef5aac2cc10e9a612b71242a5fb68f707f4e53
SHA2563138311dcbee19a032c76ca0c7174d3ff37e91873f17e18d80fe6c6bd6cdff60
SHA512bca086e5b03c5e9deaf4aa35cd3a1b2630d243d5bcb3001498ee077a9ed14d2e506a43f00af0025115a267b9a5fd8be6307300b68530645b9f096f291c365594
-
Filesize
522KB
MD53e29914113ec4b968ba5eb1f6d194a0a
SHA1557b67e372e85eb39989cb53cffd3ef1adabb9fe
SHA256c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a
SHA51275078c9eaa5a7ae39408e5db1ce7dbce5a3180d1c644bcb5e481b0810b07cb7d001d68d1b4f462cd5355e98951716f041ef570fcc866d289a68ea19b3f500c43
-
Filesize
854KB
MD54ba25d2cbe1587a841dcfb8c8c4a6ea6
SHA152693d4b5e0b55a929099b680348c3932f2c3c62
SHA256b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49
SHA51282e86ec67a5c6cddf2230872f66560f4b0c3e4c1bb672507bbb8446a8d6f62512cbd0475fe23b619db3a67bb870f4f742761cf1f87d50db7f14076f54006f6c6
-
Filesize
85KB
MD5382e18b922ff9db6fd868a7d30f4755a
SHA1be44d626095cdf29b1e1faeca701bba2aac4f947
SHA256014b807f93085b4180117702981e6e56339759704feec96992ab8695e6079ad0
SHA512afe3104df8e6323d073027c50519713c13fc1ebf56277225a4dc6becd92f1087c7523b5fdd150bb5ff6fc827692afab2abbd24f60a9fff2a7299d3ac11c6931f
-
Filesize
37KB
MD5be7743545f785c091ffd235492f12174
SHA17052bd6c2920b744b190b081cb5ca4eca5789cba
SHA256775657c265c9a1ae51049884f09eb39cccbe593949d6c889cb473cc361f15576
SHA512c237ee740d5aa3f7b20b5c8df38cc529970a7649c8a7bc0d3bd59a3610c0ffea296f0b764f616e55dd50591713b1f7dc9f6667b6337fd40fec1c034a89835730
-
Filesize
97KB
MD54a65b708f29e3169fdf27acf670b3ba1
SHA1eb5284242f22710d585108a35327944a6ab49786
SHA25697f9a7d0bea9a19b3a87813aa80dc5afe2c25103579b0baaf555d275845afbbc
SHA5122cdd16ec4be6b0e8de58f51555bde2ebeb228ff992f56c8e0a502bb70fdadd98ab6d459bb02581050deeff36ee2d2fe22f12bb9a8c3fb91648ccca33d4e3a7cf
-
Filesize
386KB
MD5524804c86da18b53fcb2b30bdaa80dff
SHA1f8d5c3da864a442cb327dbe6fdd6ddd630bd2830
SHA256596139d6377efda71e4d9126035e5f009dfd09242b72ecd9a31103c02d82e9bf
SHA512bc16d178ec6b7c2907e5d7a30318a4777f25b6cad6bc2dcb6f8226a9d825db07302447cb0ad7a0a1c63a3c04a4bb96b21abc7379c04c8593ff23f5276bafe6c5
-
Filesize
11KB
MD53e6bf00b3ac976122f982ae2aadb1c51
SHA1caab188f7fdc84d3fdcb2922edeeb5ed576bd31d
SHA2564ff9b2678d698677c5d9732678f9cf53f17290e09d053691aac4cc6e6f595cbe
SHA5121286f05e6a7e6b691f6e479638e7179897598e171b52eb3a3dc0e830415251069d29416b6d1ffc6d7dce8da5625e1479be06db9b7179e7776659c5c1ad6aa706
-
Filesize
133KB
MD5452ce0b8d77359961b7918cbb98a4dba
SHA14d14210d41ac4ee0d3644dbdb35822d6bd28c126
SHA2566e5f58aac49eb4662467f301309fc1b85d588fa71ab281dc8cd57b22850ed7e4
SHA512d7300aab2ef365310334ccf7781f9e1d0b38709f3f740ac4267215b1a8bfcf5889ae72a83fa986ea0542622ce348982beaa17b3ee3c10a67e8dab32cb9aa8d7c
-
Filesize
6KB
MD57059f133ea2316b9e7e39094a52a8c34
SHA1ee9f1487c8152d8c42fecf2efb8ed1db68395802
SHA25632c3d36f38e7e8a8bafd4a53663203ef24a10431bda16af9e353c7d5d108610f
SHA5129115986754a74d3084dd18018e757d3b281a2c2fde48c73b71dba882e13bd9b2ded0e6e7f45dc5b019e6d53d086090ccb06e18e6efeec091f655a128510cbe51