Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
28/12/2023, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
f97a6c7ef5e30c138b0240e4926b29b3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f97a6c7ef5e30c138b0240e4926b29b3.exe
Resource
win10v2004-20231215-en
General
-
Target
f97a6c7ef5e30c138b0240e4926b29b3.exe
-
Size
274KB
-
MD5
f97a6c7ef5e30c138b0240e4926b29b3
-
SHA1
74768abad8cc9645e49fd4464983ab9e04002109
-
SHA256
bc81cc531715245d2fa886fd8c88597bb8193eb25126362b023faf8f351dc26e
-
SHA512
53b1f976d88f5781b27dce016dbf04aea47d5a195ca937a3bbf6504a4f21c1c623a66510460234664c7d988812b1053cccc9b1bf14353cbe27dde3418cbded6b
-
SSDEEP
6144:IQq41Ybijvcjtq1pcJGUg1ZoNEiti0eSkMQ2/ndAiti0Q:71gAEp6c8Ugzq4Jx2/dLa
Malware Config
Signatures
-
Loads dropped DLL 9 IoCs
pid Process 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files (x86)\1ClickDownload\mainpackfa.exe f97a6c7ef5e30c138b0240e4926b29b3.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe 2488 f97a6c7ef5e30c138b0240e4926b29b3.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
16KB
MD5f642e8cfce23aa5d124533357de7394b
SHA180ce98a2bc4b416db357ea52a74424d742cfaa55
SHA256f1bed304ea1d96094c1e4e3f8e112b7ce15af4441192e73c9144f774ad132d2e
SHA512d0ec47e3a69cc6c6f54e8ba58cade7875ace43b66946e7bd4b678dc246c61acf8d36aeaf80082308f08783c28424c5db601bdde1d820f7797b60ca4fe948ad26
-
Filesize
25KB
MD59d8ce05f532dc7b5742831ec8a63c2d8
SHA1b014365f723c78a84bcdf8a46cfa016eb2b8dbc5
SHA256fcc46c2e60931a76fe529a9fa5a85ba2f4bf7907d651161f92fc524ac4747982
SHA51298f268bebf0c82d019873a7b109e1822011c0532e6a6d8ba94d2b8a918d9558f4db89100b6ee357c9c510ff56adc349e619489fd7e8d21e7f826877185ede3fe
-
Filesize
9KB
MD5c10e04dd4ad4277d5adc951bb331c777
SHA1b1e30808198a3ae6d6d1cca62df8893dc2a7ad43
SHA256e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a
SHA512853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e