Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
240s -
max time network
297s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 03:01
Behavioral task
behavioral1
Sample
0c6321435777e6821b97444b7af0f8a3.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
0c6321435777e6821b97444b7af0f8a3.exe
Resource
win10v2004-20231222-en
General
-
Target
0c6321435777e6821b97444b7af0f8a3.exe
-
Size
13.2MB
-
MD5
0c6321435777e6821b97444b7af0f8a3
-
SHA1
b0139fa4d9a1b5864e8856688f07f569afc7d2a5
-
SHA256
4de6ae19828f085d30b42388beed05e3beda0379daa6259daa69ba84ed4083e9
-
SHA512
9df5e18dbbd30b6cd4238869209c1fd7bf6a40f25462a442d47d64aa0e4fea41503fa7ebd172a38ee0a713602edcd6d1619a30d69c62a8aaf1422ea177279c00
-
SSDEEP
393216:WCPzpjnbPGWv135W1FYOdHkJQlzjoUWVTzH5CpHu:jPVPPHv18LBU0xpHu
Malware Config
Signatures
-
Loads dropped DLL 37 IoCs
pid Process 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe 2452 0c6321435777e6821b97444b7af0f8a3.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 2452 0c6321435777e6821b97444b7af0f8a3.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2664 wrote to memory of 2452 2664 0c6321435777e6821b97444b7af0f8a3.exe 27 PID 2664 wrote to memory of 2452 2664 0c6321435777e6821b97444b7af0f8a3.exe 27 PID 2664 wrote to memory of 2452 2664 0c6321435777e6821b97444b7af0f8a3.exe 27 PID 2664 wrote to memory of 2452 2664 0c6321435777e6821b97444b7af0f8a3.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\0c6321435777e6821b97444b7af0f8a3.exe"C:\Users\Admin\AppData\Local\Temp\0c6321435777e6821b97444b7af0f8a3.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\0c6321435777e6821b97444b7af0f8a3.exe"C:\Users\Admin\AppData\Local\Temp\0c6321435777e6821b97444b7af0f8a3.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
252KB
MD5be486f4808d175ed1c76d686111fe6b2
SHA13d842fccf09bad78832399bbfc26b915a8549ae4
SHA256751e724ec672cd28dbd3078923d068ce3753369ef412920014c8d0bee2c8a3f1
SHA512caecb2c265512c53ff16a30c8c2fb64634de14e9c68fe47c8604d3943ccaa4d4a45b16f8a1fadf80e8bd8d7f6b3cac38059b28e8e8150148a0f565af6a3b8b71
-
Filesize
84KB
MD5ae96651cfbd18991d186a029cbecb30c
SHA118df8af1022b5cb188e3ee98ac5b4da24ac9c526
SHA2561b372f064eacb455a0351863706e6326ca31b08e779a70de5de986b5be8069a1
SHA51242a58c17f63cf0d404896d3b4bb16b2c9270cc2192aa4c9be265ed3970dfc2a4115e1db08f35c39e403b4c918be4ed7d19d2e2e015cb06b33d26a6c6521556e7
-
Filesize
11KB
MD585ceba9a21ce5d51b35ef2de9ebfbac4
SHA12d695a3e2257916f252d746c5cc0b48ac2ba1380
SHA25669e2e6459ea24237d5fcfc429acbc80bbb5852044a1b79f0aa6b544c4f770d95
SHA5125d2d7e9079f53efa667f29529ce9c9c10af8d7ef541b62e2934c6b68a0a16cbfec57e49297091a99c9db3bd0674f3173036e018f6559be5d6bac554d1da8f29a
-
Filesize
15KB
MD5408019e57d3d2da62a9f28389eed0ac1
SHA1e48d1166a8fb95da90787d820ae7cae859bc626a
SHA256096139cdeaa408c3e3bd393a7188cbd6c296c3fe4e4cc15da113286a3f713dbd
SHA512fc18b2b1aedd2611ce78e92c4b283f519b5b25ebb0be5fe618a4fdbdf60c68f1edb486b74e59990e04f6b2606a9681edd433a32e6f9dc10ffe043d8dcc64eb03
-
Filesize
504KB
MD54e7888aab608573cf9bd978f67b1dc5d
SHA1f348fae983f5b805e3e015824a7529aba8e32942
SHA256c39e6f15f699292463dff51183b4e0bf239e4bebc2113828d818a13b0f801685
SHA51277dbe62fb2e630e83aa86f878e915b9eb20277ba2f1627a2b5bce6e527f9c986e05019cc9246fe1201bbd8fe3117d87e2b7807b7fc35533495898b1309383600
-
Filesize
298KB
MD5c82984cc770e2d019f0806977e2339a6
SHA15e22af3fbee687916232cc58abf80300c2deb5bd
SHA256502bfc7bf6c56f232fe966582c71cbdae69f29ee3705e5ec74daaf02b0a042ee
SHA512853167fa12dc4b9be335c491e717842252f13010cf2832057a0ae833a79e085302aa1a6ed6ad808d3ae92e4f50e7c7944aa818eaa9486b42829b377054a08efb
-
Filesize
506KB
MD56449a0d0db6a6a3867f7db8fa72a05b6
SHA1d86d2a75492a885c97219955862386f232e1fd9b
SHA25662809b3a052909401df7463c8e13f43a422bd3b53226b8a3a3b62aded703c69f
SHA512f52f185406b19ff2438188dd55fd593b5dc543c3364df0dfb5fb76d01ee9e942c6b0faee864a641bbee1984e3248133902cfdd396df225b3bd680d24b282e97b
-
Filesize
443KB
MD5c14d518ce83ba5439e5fd0c50db26312
SHA1f4eaf13f5fbd13ef13cb6a7c05443a889ecbc883
SHA256cc02ca0a4bbd2e9c3932978a27101cb162c4871f82d85b2ad750e1214d549092
SHA5127c0a6e4b855696a35e6efd213933228d55386f92d6f0f1781a3643e5189a66745d5cd4173305f407796bb29f688bad66df595ed54caea909c9b7b1e8c835ffa1
-
Filesize
1KB
MD55900f51fd8b5ff75e65594eb7dd50533
SHA12e21300e0bc8a847d0423671b08d3c65761ee172
SHA25614df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
SHA512ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc
-
Filesize
386KB
MD5f7db67c0984d89d4346b60d69abca2ce
SHA193ec7268ab282cd70c915531c673cd7fb9497524
SHA2563da5b909cdc02da99f957d7323989fd63292694795514b78dd9080d3e980e00b
SHA512ee60b00688a7fe98cb89c9dfb795364d1f2d48d4d4bd4632925727c6b55b2ff99b13d93c45b2c2b988a624cd229826ced75036ba4d89cc0d190a6c7ebd818d20
-
Filesize
1.1MB
MD5cc3bf1319f2ef9c9718735bdbd2441a9
SHA1ee1cd03129e6a00ed5aaf31e2c36b7f4356ae0ef
SHA25650825771d83ed274c814961c7d84e124539821f647f71c8a60b620a3008a1605
SHA5124632f285624ba9aa963b0198ed5467dec7e71e683cd324623a255ae71d486eee61cabae135078e5dc1b75e38bf524f9547ecb00248bf93ef6691a2edab5daa5e
-
Filesize
472KB
MD54128135b30b7c9a411de7720c058234f
SHA1791983e8c78f54896ffe86a181f0aaaffe2b3798
SHA256e8842a5db6a55a4bf0115e926594834d52bb3b2d3453328e848bf41f8ed491ae
SHA512c1205ba29fd054c9f9eef173be59dab4b934262bd3e88ca2069d619f4256c3eb435b043ff8ea38c4bb337a5e4f995a66a2f3e64e3aeae36fd3c60d1602068510
-
Filesize
320KB
MD598de911a9f0553885dbd0497041186cf
SHA1eb63c9ff3188b4f6daf9c3bda2979f127d62651a
SHA2566d193b0a71ac02553b62bfbec24281da1d590cc066f7feb8a68d0a3ca330d5a8
SHA5121970543d84906559925459ecfe0127287efcc427fd58230bd1b3c7e5e532674d5088fda92bbfcb8a9628857ab3f99ce98e9cc296726f98918f32ae2396844563
-
Filesize
71KB
MD52dd25ac2510c5640169d89ee220e748e
SHA138fd561088e61e4dbb97a026bfee8fbf6533250e
SHA256f5086031019c5e03afcfee227c4d30e82b68c24f5a5871640c3e8682852d9a54
SHA512e4fab2e20031dec366c113fe10ff81d759a2a1837cd1ee2598bb6c1107cb16a6db13501b69e80ee08e61005020b557221f858b690e2a3bab13a94fb04f87ef62
-
Filesize
105KB
MD54873eef1f9b652605cb7567bf5f63a59
SHA1699bcc7439c2255eb54b3048a0255624cfcfb1d4
SHA256c1688643a182f1b9692284ee24293ae90b5496e95b356d6ec175f18d9a6ec566
SHA512335a9d6a6f5f0189a1b906561e3bf1d5f6c86d17fdc952fd45a8e6a3d6b814ad919e8ca9ae5f3a6261549361cd4b5f00d366ceb77c66b4c562fd53692b24b2d4
-
Filesize
31KB
MD5d7fb745382c6356cb58a865b7868a87f
SHA1c05940c7e57e7e1c8e031d1644cd91f507adf5e1
SHA256a5ced194f4a143e6f517c22e6a1edbabca0d875243845bc57a87c2d70c07f23d
SHA5121a19293c041811a72dbc88807aaa6a396600732f716ccbb2d976850c01f69d1ddeb5101e56c9b92fbb02496481e9da3fcc47af96bf8e9102477f9f28386f94c4
-
Filesize
180KB
MD53f9883975873f598093f33164be01fbc
SHA1851b304266d19ec89193ade145e7aa7094cb9217
SHA2561afb4acf310dc86ab032cf27fb59c468ca7e65448b899dc31d5a53317d5bc831
SHA512a0613ed7bbab49a8da297d4947d5595c0637df1186834e19db8bc800d2f01bc1f8531e20921093778e1006edcf6705d9e49751106552520c0dd001c66a5dfc6c
-
Filesize
56KB
MD512b7fa3d944c5313759016bac921f6db
SHA1d1f7aedac4b8e0a9617cb6c80ede202a44dde821
SHA256082401d8be5bceefa18b16bbed73f672ea199ee3a42a3ba0698d055309a3e366
SHA5123bdbcf756078f6248b10e0c32c34c7627ccfe07129e57c6144d67749cbaefe9c2304f4301f75b2e673d30c72a5f5ff6deaae014f844a8f300e1c860d49ba75ea
-
Filesize
18KB
MD54c544e7466420b46c91886c58ce90537
SHA12efc27c43f0c2abbdb1a14ca61c19f093a706dc2
SHA25694c41ef05c4cd7fd0e7b0266b8be5e2aef4aedec704428ff8f82712b71747ade
SHA5126698943055e360166c669b33ec090ffd5811008c94b2dcd9ba90c1a16f0fb611cb3c1cba47345cda4cd995ec50054b5b6797a688c9fdf12e4237f70b25154747
-
Filesize
18KB
MD5b87db0d6cac805263604d4733968f786
SHA1546ab87ad8999587062b8aafcda403b03459bcd8
SHA256738954850c4c70a6336ed856824504c3042767e13ab10cf9ca463a3f3120c2f4
SHA512044fde5f01dc496cca9ed03cbb972ea357f2b91544d4e702fba2e98178c27771e644d0dd0c775c1c359199bc2221764632377ca7d1533d1153a5a115199dfaf7
-
Filesize
21KB
MD518cdededc9e9ba62eb83498baffda43f
SHA18be0f10bc91eb5cfa8ea9aa86894f8e1972c8264
SHA256bcfabb053d831a2b4c640144bf5064839477ff9f9e36864cb638ab7d43cf8c44
SHA5121a95cb7c7e9b0ae0b145442a3aa5d304bc1abead51392b482872276ee3cc5f85aac0aa70eea8945e4e728cca3339b3640669ba6c944aa600aceb58929db2206f
-
Filesize
19KB
MD533ee00d951da4901651e484537fce714
SHA1533a6aeab9ead127fd5c02fb4e94f21371750b1a
SHA256cd78cd4201b599f79ea0523df309ef902a3312366b1991c4e4115cc6b86341aa
SHA5126d98c03d04a1d13283fc730f56a8bb463a22e55ccda1f259bd07f5b7a3540ec0123ee414d05c6546284f7a9d72c28f04dc9063cefa8e3c5f7ecc04099cb79591
-
Filesize
18KB
MD5d5d58ddaed6856ad7a33389a4024618c
SHA175806570e99f3983b7bca6410b06ec2d59a4685d
SHA2560af8caa08ab824e06dadf0e6aaefbf383fe0d283c2c0eae0421cf3647d466cdc
SHA512a2f3332d16656cdc4659eae708164fe7e4c7e7e1c3385687d7cee3209fc92985834f88d43cb4fe84dc43715daecec6dc854629fbcf40a7d20ba05f5a23af1458
-
Filesize
12KB
MD58e534f49c77d787db69babff931a497a
SHA1709380f53f4bee25ad110869ac4e755391346405
SHA2565b679b8119bb5d53107c40c63df667baef62de75418c3e6b540fdbafcceddca6
SHA51249e293828c96f159e2311b231e13d7292b9397aa62586bd0289c713e541d9014d347cde07c8529df3402c40e8fe8a96ab72efcce9f731ba95eb416506efcdcea
-
Filesize
15KB
MD533e8ccbe05123c8146cd16293b688417
SHA1d73246eb64af4f7ded63fb458c6e09c7d500f542
SHA2569ce840d9a67c4700d271f27a8e5163eda506ce46c85b501687955b55fcb3d136
SHA5125468adb8e76aced26f1f33fd0cdc72d194f92b1cbdf3f8169bc12e0eec1593f568c18d0e937898ccc3463003f939181131e41c6d5928bf393ded09c95f63e705
-
Filesize
13KB
MD573ced8b30963e54d262dae2559116e46
SHA1090e42c4b7f736e69c248ad6b790bb68b5bee9ee
SHA2568b018f12e560d1179f1ad72811dbf7c60743061bedfa332a6562cf3db5cb413f
SHA512b7c0514c14ff82efbdc69ad42a3fef0a9aa1ba5112e98f7911cc6abec238980ac1104d467278608fea65f5674b6097cdccf17698c076ee14cc5d963819877ec3
-
Filesize
12KB
MD54669249fb01ea369c7fd40a530966fa1
SHA1106454588625bcf1a86db25333bb519e7f09ee61
SHA256bac9384ba44857279ac04865686941243ea4fac9c08c3d29feb1b53d92e76edf
SHA5122036043c318d164d6701c022c7bb7569051a8fe8e87518a62fc4259fcabee3da481197a375c607ee1505ff66467dc019e1fb4a9db0087c3b0e064c1d4ef864c2
-
Filesize
11KB
MD5b23936cf83dac4b64660a88711b5234a
SHA161431cfb47f8d36e67d2a046db318015af4d3107
SHA2563927a4b0b4591989f8c7b25e747286b359618b4de6f7680b2230c1cfb0d12782
SHA512f9c4cdda309b64a51cc4ddf0d033d2c20ec11a92b8cf46c190d1f341434f28bf683960e5ad7d06ba20776bb95f5d9725155864efe20fcb2775cf4ed2d1568b41
-
Filesize
21KB
MD5c1096da4634ad3356a10c00b24f53393
SHA16ea87bf1a88e57954f1c34047423bc342cd407ca
SHA256a2dbfc1a5baa66e257a4acc63289fa73adba893f837e2b304097ab829bab257a
SHA512d0ed94cb0b7746c324067d9485620d8693140c04c110482d685560e21c730e840056c87dadf58239f6a9f3e28cd650b0b8ecac011e03b6d6b57adc76213f0427
-
Filesize
12KB
MD500a0a24bb2e9aade11494b627eb164c4
SHA198c1121324f8e8aaa64c673d79315cc27fa0d25c
SHA25658dcf9ec3d0747a4ec23c7a1ccdb8eb0a6ad3aaebb0d8c0dd480922d012c8ecd
SHA512c8574f04172aed489b8ee91e0189314ca6b66d0d8b99275968ec888ee5c13f5f7b6d211064620b62fa1bfb6b54d7fd832823cf582e7949a07d5ecc45275b4f79
-
Filesize
17KB
MD59d66fcc681389ec619d4e801f1ddbb2f
SHA1605385439a2b9295efff604f27849778696befaf
SHA25651c54ebaec17c1216e0fcd926a2dc8a377cf278127e4fbf6cd26e0fda51c23e1
SHA5120776dbc733491502c84c4eb3d532b52acea0f08258647d488ffb68df2997ef4cd750b2667f94069991ac7c4001be681cd525e56af51bf1f43dda4f095f6daa00
-
Filesize
17KB
MD56c7f782fdbf9aeffe7663fa1579a610e
SHA1d1504bf86117cd552bc1b97a49745780d35007bc
SHA256083b8b0e45864b12c60417dd3c5fe88b68ffc45a245d50df84f2a55b1dfcab38
SHA512d293ed48b09a0ad5e6b3bd0ba45feac092fc4c06dcb06eb661b6df7a061e402148a31b45b2074be97b4bd6ee7daf92f60cc17e1bd4d655f4b1cbc0bf7b3c8974
-
Filesize
13KB
MD539f9d0f1b698d53d78c79576c7c60526
SHA1a2015e56318b650de7436231db6a09ab95f001db
SHA2567a69214583d61cca3b8d765b488d6da070fccdcc02b76ee4c66aeb809f88c1da
SHA512262fd3231c73f35deaebcb5953ebe3a639d8e4461a58d546ee962f5f1e254cb40eaad235ed4c2da780b737158ba82bf7c029e35007183a7891bea307edd922b7
-
Filesize
11KB
MD59f9fe5f52e9b2ad655c896b849883b1a
SHA1fd1119dbd0c38e7fc075be6a9d0efe4789f78387
SHA25644d5822d611fe29cb8530fe4bb86eaa8f9f2e135504e2304f8ab4ad6e37b8d36
SHA5127970b3ef135423602234737da54ba6b248b670a818616f501db6e64455c7a89fdc023ddd711c6a45a7cfc25a715fa8a9c608013bca2a724f5d605b95f32830d7
-
Filesize
379KB
MD52a7096b7c5ff5b02595636aba826d1da
SHA1c6f9fa7acca16799834de1e6d9ffd46095c818c9
SHA25694ef7364e32281396cf95f16ea14601e9abc7eab04eb92539ce3216e3baaf828
SHA512e03762a32a4fecff1e83fb691a33b59954a192a10a31adf188acd426e67a50e4558853af65fb9266ea5a307e225c2cad71a7ccb11a4e509ebebd62e4465392f7
-
Filesize
244KB
MD521006b7eb18797a0843f927c0852505f
SHA12accee9dc60af7a2f66f8a593ebc5511db524c98
SHA2560b5c8722ff23a371da264cf701490a5e64a51556576d112a8e68fe27cb1e3197
SHA5120617f74c30ca7f4ba3bf0c56a4f74eea8d986bee2d384a227a0aa02a578b0520b5cf0a10783c5dae7d23bbf608015610193870c09e8f36eeab0c0a7bc8064de1
-
Filesize
566KB
MD51917ba6828778a371f4897d72e2c19f4
SHA1857a298cbfdfac364676ebca8d4b977ebcb27676
SHA2567595862a03c2f331be2d66a727e864d865640decd652e32aa16b85285bbe9e69
SHA5122728414f9d268134add981d18732cd286ff7a8e483ada7d2984a9e1debd1f243381fdc9c849287998d6310087d416e941650196274d49192a2d93e129391edc0
-
Filesize
416KB
MD574e1977e79d79a515e17c31c5b5be9fe
SHA190d14a9f309d71f871bab10dcae8f3782bedf62d
SHA256989a952840da92614e3da450cf9d0276ac0b28f67cd67f46000eac3c72620a32
SHA5121d0f838731d943f0b824723d0804e4632ad703f18464f57108e08e4266ee3b5ff796db2b783f2f60ab6c2e001e18cabbb9f1827a517f0a92a1a22bd0b829c53d
-
Filesize
876KB
MD5015120ddf9ce1b92b2e8af09277574fa
SHA173a9351a481b926065ae74d6a5e633bb8c55fee5
SHA256944fc0d9e955f804060b23c5f53174256b25af3c8cc4fa2140beffc6bab8f411
SHA512a3a2d4da60213be4af7f3225b83d80d34ed83a7ea6947be56f93f3708c8f63b4de7b6d78465b10beaab8715b6e5019b8f70df85c424024cb50dfdf6b6be4a91c
-
Filesize
306KB
MD5e91d03edd67ff7def7b5b0210f0d4760
SHA14c8e8a6e3d4f9b62e659d61f47891d1418a823cc
SHA2561bd1a35d449c307a9e40878d8a0a20784c87a274e595d2e3f14f3473c655d21b
SHA512ba6ad5cefaab7d5190ee1c3ef2d0d8d9b5b749d295cc91ea51c8f04ec9b16e16a1dfd1817547b94066a5558d7729ffa049eef9508d1a141d2e2b907bead24e7a