Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3ipchanger/...er.exe
windows7-x64
1ipchanger/...er.exe
windows10-2004-x64
1ipchanger/...er.exe
windows7-x64
7ipchanger/...er.exe
windows10-2004-x64
7ipchanger/...er.exe
windows7-x64
7ipchanger/...er.exe
windows10-2004-x64
1ipchanger/...32.dll
windows7-x64
1ipchanger/...32.dll
windows10-2004-x64
1Analysis
-
max time kernel
152s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 16:19
Static task
static1
Behavioral task
behavioral1
Sample
ipchanger/Ip Changer Updater.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ipchanger/Ip Changer Updater.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
ipchanger/Tibia MULTI-ip changer.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
ipchanger/Tibia MULTI-ip changer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
ipchanger/UNinstaller.exe
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
ipchanger/UNinstaller.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
ipchanger/comdlg32.dll
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
ipchanger/comdlg32.dll
Resource
win10v2004-20231222-en
General
-
Target
ipchanger/UNinstaller.exe
-
Size
36KB
-
MD5
dc463e371abdeffa42cf739fccd7591b
-
SHA1
c480ba1a718d098cb0dadb4b2246046f9214bb65
-
SHA256
60ed463eee94e14774b010dbe38aaeee3c301be8b9473f740b1693324667e10b
-
SHA512
71d085d2782f6b7d3b62f67b8e11d9bf805c0043534fb7e3987cba800dfea80d8ddaf5e107e606c5299e89fd1ab863b7183bf9b473df9fcea7c355122aac5a31
-
SSDEEP
384:FsUi0Z4F7OlXVCnhwv/jYnC9oWb3eOaq9/21UWU2B22CDw423ogFqi0Z:Fti7tnUEo21UvykB5xi
Malware Config
Signatures
-
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1908 UNinstaller.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1908 wrote to memory of 3272 1908 UNinstaller.exe 91 PID 1908 wrote to memory of 3272 1908 UNinstaller.exe 91 PID 1908 wrote to memory of 3272 1908 UNinstaller.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\ipchanger\UNinstaller.exe"C:\Users\Admin\AppData\Local\Temp\ipchanger\UNinstaller.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ipchanger\..\unin.bat2⤵PID:3272
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD53b87ec39aa547ba628a97a292be0e265
SHA105974c76ecf814db0e933059a586eb55c8c72b04
SHA2561d9aa0bb597213228d3e0fb0ec25f043f266efb214ef1d8d9776f220e82ed610
SHA5121dc97db24b2358fd4309697e012b96cde0bc0d92b7784d72da4ee711d93b727548ca05b8876f34f79bae080830ac9e667dd10c17509504ba6fe04ac49087780f
-
Filesize
306B
MD5aba390a3d572fb36dc8750aa3cca774a
SHA1b3c818f7a7498a6b0971b1e8fdbd6d4b97c41e77
SHA256a0dbebdf081c33fe3a71871500c0cdeac3c175d65ecb10469110bd93d76b42b0
SHA5121b45dcff535918600b0421cc1a5e8830c7f8baef07d90fa286ae4e131db195016f23f292e580288b96f325c3816e56c3eb90b91877270b4f1496dce997075377