Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    163s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2023, 16:19

General

  • Target

    ipchanger/UNinstaller.exe

  • Size

    36KB

  • MD5

    dc463e371abdeffa42cf739fccd7591b

  • SHA1

    c480ba1a718d098cb0dadb4b2246046f9214bb65

  • SHA256

    60ed463eee94e14774b010dbe38aaeee3c301be8b9473f740b1693324667e10b

  • SHA512

    71d085d2782f6b7d3b62f67b8e11d9bf805c0043534fb7e3987cba800dfea80d8ddaf5e107e606c5299e89fd1ab863b7183bf9b473df9fcea7c355122aac5a31

  • SSDEEP

    384:FsUi0Z4F7OlXVCnhwv/jYnC9oWb3eOaq9/21UWU2B22CDw423ogFqi0Z:Fti7tnUEo21UvykB5xi

Score
1/10

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ipchanger\UNinstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\ipchanger\UNinstaller.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1908
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ipchanger\..\unin.bat
      2⤵
        PID:3272

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\ipchanger\update.dat

      Filesize

      8B

      MD5

      3b87ec39aa547ba628a97a292be0e265

      SHA1

      05974c76ecf814db0e933059a586eb55c8c72b04

      SHA256

      1d9aa0bb597213228d3e0fb0ec25f043f266efb214ef1d8d9776f220e82ed610

      SHA512

      1dc97db24b2358fd4309697e012b96cde0bc0d92b7784d72da4ee711d93b727548ca05b8876f34f79bae080830ac9e667dd10c17509504ba6fe04ac49087780f

    • C:\Users\Admin\AppData\Local\Temp\unin.bat

      Filesize

      306B

      MD5

      aba390a3d572fb36dc8750aa3cca774a

      SHA1

      b3c818f7a7498a6b0971b1e8fdbd6d4b97c41e77

      SHA256

      a0dbebdf081c33fe3a71871500c0cdeac3c175d65ecb10469110bd93d76b42b0

      SHA512

      1b45dcff535918600b0421cc1a5e8830c7f8baef07d90fa286ae4e131db195016f23f292e580288b96f325c3816e56c3eb90b91877270b4f1496dce997075377