Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
26/12/2023, 12:27
General
-
Target
6e733e40eb840af9f13d09395e4985f3.exe
-
Size
1.2MB
-
MD5
6e733e40eb840af9f13d09395e4985f3
-
SHA1
7595ea346535ca77ca954923426e9b6c344c495f
-
SHA256
9152487eb3e160e6f8d97b1489189f479d845b044018ccf92479021ab70656c4
-
SHA512
474187364de53a27182f6668184d3f80fa1e654d54f5b505129a388d761541ffd5bc2aa929b21a99d7bb19692a3a0071f061d32856c5eeee8fecbf13ff0cfda1
-
SSDEEP
24576:GIx5Kx34IQb8xlusz8HUCa2+9eu1e4B4KuOYrbRL+wdyQH:GCYF4IQwxhzeUCaF9PTjuZrbvyQH
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 5 IoCs
-
Loads dropped DLL 11 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Installs/modifies Browser Helper Object 2 TTPs 5 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
-
Drops file in System32 directory 14 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 64 IoCs
-
Suspicious use of FindShellTrayWindow 5 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 15 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e733e40eb840af9f13d09395e4985f3.exe"C:\Users\Admin\AppData\Local\Temp\6e733e40eb840af9f13d09395e4985f3.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VulanProF94.Crack.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\VulanProF94.Crack.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX1\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX1\rinst.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\khoahocphothong.net.exeC:\Windows\system32\khoahocphothong.net.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\SysWOW64\windowsz.exeC:\Windows\system32\windowsz.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
959KB
MD5e367cb48cd82099f9742c991c46fbd7b
SHA1572ad459c1e0890afc73e76b0146b60084ad4584
SHA25693de318ff9b92ac29a4cf118ebb426cc935f6cde8c96460659c5466f345f0bb8
SHA512395635ce5ad68f5070b79f26bb76ebc503a0116975a1f29ec92c4235a8715adcdb6e424739bd9e7b9222e75cdfe68dd50f238c297aea33de2ce5dcb343fdafdc
-
Filesize
211KB
MD5d8f7e183880950d15e02f48534d70207
SHA15c1184c4d1bcc62a67dd634a0ae35e1c4fe2e58b
SHA25644df4a21c3d1e200182cd8cc3c3ca884d3c02479c82b9dca8df0242452f5602e
SHA5124081fa077a83e2d1c203257ab938186bdf506cb0986f6d3d8c82b80628c90c75b756e3468a9548a723acba9ef90a2ea34384d8cc2601462c35e2c8733d5072aa
-
Filesize
996B
MD554f5dbcf4b39a481d30784c99831e309
SHA13e8cc267683e9c830dcc4fa9e25e50f7bc999105
SHA2566dff5d5ee810a5cb830289b2138dcf4c3863cdbd383365e41110dc50a7671374
SHA5123df8a92e56dc222700ea7562fa4d3b45eb827860d4232a153cbc06bfd36a74f9103536f5c66065e8fb3a258070f791fe3c26ffa6afc7ddc8cde48a49c829a812
-
Filesize
4KB
MD51c82ad81db951e13462a790032877fec
SHA1cb71be3c926885764ec460822511c03c5802134b
SHA2560cf02dac4e829841c22e133ce02b4aa0e582c6c4abfd373979277bc03a367ca8
SHA51208c1c1969037a6b46f157b2fe6ac1c7b268e1797270c41217fb8fd1638e1f206971e124841a27da189614eab53dfe41cec7c46f24f248fd532b3f1f2119fd72e
-
Filesize
7KB
MD5fbe4bab53f74d3049ef4b306d4cd8742
SHA16504b63908997a71a65997fa31eda4ae4de013e7
SHA256446658dd5af649857fff445c600f26cdc1d0c19c86a080f312b89b1890182092
SHA512d458ab806a3ed3d1494a13ad8a75df874a0b227cb4f337996cb82df3c4a26dc9c4fe48a664b53b052a4af123ea8d89911d9d9493870e6b5992d5621a32260c2f
-
Filesize
275KB
MD5a99db180675ff24676ece26421e3a69a
SHA177b61a3d232afb9012bc56b0c2ec79bb1c0ccad7
SHA256f39ac4347c71e571d924f713851b51408bdf8ebf6fd7e65400e0b674f6a3a0f4
SHA512b12e96157a6633f423236078b6d7cfda04298c6be15049687b7c7230a4415ae06f55258b1137b011326ff402f98c2c5439753d35a4392e68582043c4e985963b
-
Filesize
24KB
MD59c74175621b5f6ac5c9300a7cc42874d
SHA19c40871935caf66b92c14999cc7653c81793fb82
SHA2562364ee7e6afd021abdbb9438aabdf6db827f9555bfb869108671f6fa081811cd
SHA5122581c1f2f2cecbda15673da60ca5881fb7e387850c9df057d412dd06e58b6b4633107086fe056e7288647be47870978c5845b529b12904a7a98f94efe5d021de
-
Filesize
19KB
MD5583d1761b700840493c9804878ea298a
SHA1064bead8161fef6a15d54491283e68e193d0ca4f
SHA25680bdb48d92251680b677f873f7da2b17d4d4c8eeaaef900bb826555eae8f88d7
SHA512b87a59acd2a59c364e443912a725179b3529913479feeb5a8b556569a433b0244513703a71dca662ca3e9af884e4d723f3663ee84707fde7d2606ffb75293e78
-
Filesize
798KB
MD55a631c4e4d849f43939c07ef0d4511a4
SHA114b0f7105e3cd0ccac8c5eaff45875fcd1fbd60e
SHA256ef1075d4a6f3351000248fed2d71dce0e37eb420094aab5f0966c8165626d18c
SHA512ca7296c7be1b6ae5bdfaafa0d03f6de0f1a0a18766085e44af0ad01e90157bef3749602946a095aa4f4aeb08b109934e25485f26656e0a7ae4863b156012c3d2
-
Filesize
996B
MD5f34339e5f721aa7d1a742a0172330094
SHA187303a0d03cc4fd941d6da52c8d1bf649ca7ece8
SHA256d484263d11f5aa576fc11074834241e352272cd15c9b8e891aa042aa78a2c750
SHA512b582522636329490eaac3bc970991e7a3923646075f3a0c4e79ec14b4b7faee89281ee8573002ef9cd5488539feec306f1a192d930e9bfbb36fad53386b8d74b
-
Filesize
424KB
MD5f663e93c5579939cfb5fe99af1709718
SHA1ab56041ad5885095889e87b765d8be79e495fb26
SHA256b839386716007754bc82621d4961f91f6ba98fd025a7e54a0698e8a1d060f7c4
SHA5126dd40394aeec71e4bddf2f433fb9623a376ae3506a3e4ba22ee091c154ffcf25944bc5ceda9140e4c7b3f7e3fe2f98380940e87450ee9229f6d7d3cb609987f5
-
Filesize
24KB
MD59b60660cccada3f585c3e4284195e9c5
SHA18c21b1490ccc99088a87f6b7495951a320355df1
SHA256c13d3f6a1bb8a9d652eb7802a3b2dbbf31580cbef1983a982d1a4b73ca45693e
SHA512d68baed804995afa41003393e2894f7fb473d63399a24af0ebcd8955b2789b0989372fb7f06a7d2b67a664c4d44e084867e81cc198737da0d0aafefc4e45afca
-
Filesize
40KB
MD5ea84c1f4209e797370ab6e19c8c83b66
SHA16e00610a3efd07be1c9911181a8ee17da4647f11
SHA256aec793cf2d4a69bf091092f6048cb72f5ea7bea99c039fc4b82ff26f63f97754
SHA51283eaad1b220488dbb59935739e66878d6f29871c692ec5b74ca36ff790e2cb2cfc09ae326ca6e67111b904e2d63bebb7f7b569461e479c892535b4e64d502769
-
Filesize
4KB
MD5d3918d6798d8b0d36325ee84df3867b2
SHA18e137c5cd5c5acac82c36fde506f0ced039fad9a
SHA256c1d638ba2e1b507ca7a863a1c0a156790128471f628bc0edf0a0599820406d38
SHA512302ae4e140a6ee9d3b2ec7b90d0f6f154583964a603ac44c48b022fb713d98e7ace8b8d88f206663978d51147f31ff61b9343b116d5b0b655905144ac19b0590
-
Filesize
4KB
MD5d91055e16388bcfff4e033a8b2628b77
SHA1e38b04d48f3719ea716afdffd6746094c4d06576
SHA256e222da323226e3b5b345e0e1ff949b62afc393b2c16a727acc528ff2d755dbf2
SHA512b0aa5ff750a05df6426eb96c6ed27f73541bbbe1688c140bd83f1409f6c127d62fe5b0d30c52e07c34aad67012e9b28bd7e423e9089a368a61a8f5ddb17a931a
-
Filesize
4KB
MD58e8e18b982439951472d2359b9af8e59
SHA13b8933c900152a2bd30bb22b68a8bfbe2f41d399
SHA256855d4b4f9743eb2194f58e9e6ca7305266c036ae948ec4c12b8c516cc564109f
SHA512ef08571759996916c5af52d5a3487017a47f8a7735e1cd6fbdf3daa5349559a80cb835b95acac3cf7a08b887dd524d0c9e5b02e8c989cfa7a1c4785ae2b2f37f
-
Filesize
424KB
MD5994ffae187f4e567c6efee378af66ad0
SHA10cc35d07e909b7f6595b9c698fe1a8b9b39c7def
SHA256f0b707b1ab25024ba5a65f68cd4380a66ef0ce9bb880a92e1feee818854fe423
SHA512bd5320327a24fbab8934395d272869bfa97d77a2ee44ac6eec8fa79b3ffbd4a049bf9dfeeb6b8cc946c295a07bd07ddba41d81c76d452d2c5587b4bf92559e0a
-
Filesize
24KB
MD59ac9028338d1b353a7cacb563bb91df7
SHA1a20c5dee8f05c91686324cec2d5b092bafe58339
SHA25693c0e7f41d5d74217189e4cc2d5cdb8f97d8e5eeef0a0dcf4cecd67e3393682c
SHA512ac83c8f7b6fe913487015d8d7a2e430e917d230b6b2907150f6c4a73bf64c3a02320dddc29fea03db5df8ac5620d8a902fe7be80ba1b1bd1e6f5b8b1b016ddfe
-
Filesize
40KB
MD521d4e01f38b5efd64ad6816fa0b44677
SHA15242d2c5b450c773b9fa3ad014a8aba9b7bb206a
SHA2563285df0c25d4b9b6d5ccbe166a3ce3d04f5cb3a0d61c8bf29bf5f953e51b0977
SHA51277dae941676a56664da89c7670d29ed5402032c8040df1cc231986733c78f0dc56c41f7a276ec9ea8336e3fa2bfc68d3121048e9585bf0d8a98917d799f669b8
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB
-
Filesize
72KB