Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
233s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
3725cf3f74f6b21781696233273b668a.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3725cf3f74f6b21781696233273b668a.exe
Resource
win10v2004-20231215-en
General
-
Target
3725cf3f74f6b21781696233273b668a.exe
-
Size
1013KB
-
MD5
3725cf3f74f6b21781696233273b668a
-
SHA1
9cc591a6c28dad8dba46a676a82449368a838ecb
-
SHA256
24b74a95082c1e7b13379049b6d0762a8a70aa5368d05b917f793708d53d939c
-
SHA512
68f8d042a1e844853f4d9e681011325324491b1057f337de3666ef7b21c60b5c9424a2a2de7eac682a401d5950ef7487f902089181bb5bafeaed0f6a63a4cbb2
-
SSDEEP
24576:kUdHNU0BDDiAtmIKLoQRGGm9bDq5d9F6DZBA:kwHNU0BpK0QRkZ+5jMk
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2152 GoogleOrganic.exe -
Loads dropped DLL 1 IoCs
pid Process 2716 3725cf3f74f6b21781696233273b668a.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe 3725cf3f74f6b21781696233273b668a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2152 GoogleOrganic.exe 2152 GoogleOrganic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2716 wrote to memory of 2152 2716 3725cf3f74f6b21781696233273b668a.exe 26 PID 2716 wrote to memory of 2152 2716 3725cf3f74f6b21781696233273b668a.exe 26 PID 2716 wrote to memory of 2152 2716 3725cf3f74f6b21781696233273b668a.exe 26 PID 2716 wrote to memory of 2152 2716 3725cf3f74f6b21781696233273b668a.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\3725cf3f74f6b21781696233273b668a.exe"C:\Users\Admin\AppData\Local\Temp\3725cf3f74f6b21781696233273b668a.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c start http://www.fulltekparcaizle.com/?setdown=ok2⤵PID:2428
-
-
C:\Users\Admin\AppData\Local\Temp\Alexa.exe"C:\Users\Admin\AppData\Local\Temp\Alexa.exe"2⤵PID:1968
-
-
C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe"C:\Program Files (x86)\GooglesTool\GoogleOrganic.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2152
-
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Public\AlexaNSISPlugin.1968.dll,RunDLLPingServerStep1 Welcome alxi-10.01⤵PID:2332
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Public\AlexaNSISPlugin.1968.dll,RunDLLPingServerStep1 Welcome alxi-10.02⤵PID:1472
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:828 CREDAT:275457 /prefetch:21⤵PID:2336
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.fulltekparcaizle.com/?setdown=ok1⤵PID:828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD52b379059b1a29948a470b6e7d76d2cc4
SHA17f90baf04646ca31d9025765b8f34eb2fdd4683c
SHA2561d158fb047ba284420c29a352a7d6e59aa559ca941a4773c7f49185f1d87aaab
SHA512e71080587729e39901b81c05d5bf18aac841357a958d5be16194cb9c77311bb2afe04d64884339df0f450061b3dff401bf7f445aaae3630d5832727b1b5c9a6a
-
Filesize
68KB
MD5d3234937a07d93da20527292d3100cbf
SHA17357c983c965c5940906b341fa6eb8cff4573484
SHA256a69a22f12914104a5f5dc5d584407e8cc65825dece759320f4f5554912c2e999
SHA512795c2de6a2a2bc0fb9c1105f278562a1ac9faffb0d814bf10ff26eabc7898a5e5c20e2f7a295b3988aee0e6449c03c941943f7acf1a2c30b618bda62051f1f13
-
Filesize
266KB
MD59054686c9f2619f83ed15ef8336a3400
SHA1f26dd5e21335b7b343e5d63ea89a8f13d714c815
SHA25645dee3558a5d7d887ef7ca29b115486da45b6d7004953572fd4624a4a3a679c4
SHA512d642b6de43b93eb119e796ac64d01cd33e40bb85c0ec007886e5a3da1c4da669ebf3fb807a808869a9531672467f43993592ed99b1815cc58a385a064813c13d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD530c1bf0e669180918c69cb5ec2004d17
SHA10bb593c8bfb64d114012fbaf6dc8c8afe2d3538a
SHA256026c963687683be55f15eca47963bb1ed04dbcfafdc759bf5103d8ab7c2add98
SHA5121d042f148370e5c5b18e10692e5e6409e05bfff3835cfb148d9e16f354da6bf69a4a5d75fd264d237badf43444b9cfc47f3fb865811f0e4223936fa5a27e189c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d71e67c6ca406f7771d69fb27769dfd5
SHA13f06ab2552fcf9f73847f096f2c6178981a19ec6
SHA2565b6f0bbb6f86598f1c9b58b8c5e1ffd7d9075775e0032c933cbac7366a784365
SHA512649b611244d22b54b3a42cfde17133ee91d9da8825ca7ef6bdcf22ef74767c8263486e3cc720be36eec54eb88eeeca80ae09984cb4aa495a267a2dd9ebe4374c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bf82c4acd94f0ffa1a88d2925ca23065
SHA12e30127785f4c3ea1c8afd74c02f38376972aab6
SHA2567268e1b3416ab3e92f34bbd597a0ba5a3b3883742d86b1a81716d3696cf77519
SHA512df4721486a8cc09361e801233668d7c0cfd99088fdd28d1e7b2379dbfe50471dc346d7c5a0929aafe111ad3c4af1a95d089814f5a1157e8afffff4d3ca3f9149
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52956f6dfeff8bc7b7bbe428640e318e9
SHA16f790edb60f988184a3c7a3a1d3e6c5612cae59c
SHA256398e399bca4f94789147c52785bcb6df756a9bbe5ecd66812c9fc48c00720495
SHA5124d481015f942660fa01b90d89d0a1673cd7286759519ee7fb8e196d88d5fbbbe88c56cc9407a0e1873002f181dd8b0098268375205da12f5327de4f4e926ef81
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5d9d2f67fcb912344f804c9361f3d0d07
SHA15195206e7074a48763048a140e6eddc3fede9b19
SHA256f60868501df2156bf4c4c2209d07291b1f9ced336dd18ce765a5b3776cb42e14
SHA512aee549c256f213f6022f3b5ef9a30e9989f9a7562f8f9c60219e7887bbd0128e8677f7f8e06004fcd9779fafcc86005e6f6dca1be752ba85a63bc9f2b0c1fcab
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53c176d27e0484e8634fd540cdd4d36ed
SHA18dd7ced6db7257a0f07d1ee2c0dbfd3cd314684d
SHA256c527b6bd9ca45027303fe6baaf8221acc0b94da28d4e4387564151866a7c586d
SHA51288044476d01b6ed251bb1112ad0a788b2f510e8883c026d78b127b01127595e76274cbab742e0b3803e53b6b45996d7fdfc5e9e25cb0d9c621fe6a078010bcb4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5677da88d803d5188dd0717889a37fbc3
SHA155eec45bbb102844fea5a135f0f18ee4bde63f6e
SHA25673c1b083b9a7cce1220ba33be0c5887910da5e47bc7ba52f6fcb0375376b5151
SHA51280b048c51c3a7e5df8e52a233580764902614c932afbe65a23a8e284d9cb505b5ea9cdab261deeda0d27e06f95345a80237aaae85f82cef30b309625193d7e79
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD589fc94cd81dd3da7a1e6246e19633caa
SHA1927cd4143e4e1a5d897bc4073ae26ca797f44299
SHA256b2931ec0a5b14d8a7380b9112580e9210e1de4611541e44614bc4fb028434901
SHA5129ff20aedb23d4f2c1bfcfe6f2d278d5f87281251fd593d349696fa17cdc89c242c8b0b565836fb21ba0ae023d4d8cb2ca01f6e085e8807da0d5545d75dfa6230
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD510fbfd684f151f354ce1c2294021dca9
SHA140f238586fd63b67482531c6eef40f825f581ceb
SHA256319b4111524f4ddd59b2048490e335fb76eeb66826d8ad2c24b28811c181dd82
SHA5127e501eb85a89da79bb5db3aa1114596cdb182dfdf2987430027ff76cee172c68a54b67e143c945a78dc8f88d8d0dbb5276fdd1ec41bc55c3e98f3a23dc024c0a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56ce512a89293672a0a4cd29271bb4bdf
SHA1939f4a37f01786116ebfa2c90c975ebcf03310d8
SHA256320dc7f81bd1c1a92a18c3b4b9a547166e60e8a5a58377dc166a08521099c435
SHA5128af53dfe2302d280f700ccb47fc70c60d194578beb85c42f218dcda6f7d3ed13e2dd851b3f572e1f9b7c19f5273a862481b1d40abd06390d20635740c9712b68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b086038b91e343c55738c671ec9ba3eb
SHA111574ce26da78d44d513a7c2ebf7c419785bbfbb
SHA256a464ed1bedef204b425fb89f1a6dc54bbce938a3c96cb8bfb1d645a2fa0e6d08
SHA512b17e7b86a0518e484dafed46b1527a2fd33a5fdb5dbac6fdce8fc1fbaedec2819f45d7afae73fcbb6ef818a3ef51b34af577b769ab2d03534c6530daa15fb80c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD507cd6f17a85489364376461a4934602a
SHA193c4cc65233dd353453db9ee50c1fb221c7ca778
SHA25606cc67712b9cf68f03d90e72cb85dcb4dbdef17ca3da012ecafece1ca3583512
SHA5127d2e2bdd5a4742343b20ebc3df5d3260ef2dbb7fa866712a014bd3bd88a6a12b16bb50142f76373c97a89ae127988facb5c48e4738a342dc3eb065c70e1c2d81
-
Filesize
84KB
MD56959f87d10d447d0da14fe3255d8c092
SHA17e464d8aaebd8db747e1c489f42b3a633b2d1456
SHA256748131cff32c17b8c04a47ccfd34b0978ce35af48f258bf84eb8b01710b33573
SHA51268fe1e43146da7dead093e644e0aa2ed75ae12819fde23c2642cc0bed17ab5b640b722166b3688ae9594271be81699b241d72a5a88b0ef5471fb227909a92ac6
-
Filesize
1KB
MD5eb9d2d10bd5505e288b6861fabe223a2
SHA1b3843cd8edeaa79a05dd98bece5540722b1bdccc
SHA256f88263b8a9025f528c1b65e67acfdc4a9854115c5e14855123941c499047fc3f
SHA512dec7bfcf213f593427f89fee753668bb7235a2e11e21be57658e9df58eb975fe73a821f1aab581539d72c09702cdf0a175e35755c0a01ec399dce448de36e430
-
Filesize
38KB
MD53bbf5f0d0c01ed936ff5a96a50ebcde2
SHA1ccf1c8accc81c51bcac519bc9d1d5c5fe6e81084
SHA256d43ea39234de590af0fb7b0a71cd56b640134fd1c91905d105d817e2336c7e4d
SHA51208fedf382d39ee879ca5ba4c158d81d4c1b0a6acdf3f32159447878ff17fbb482b311bc6d93204dd6678b6f5aaa4d29b1b30ddad42da6b73bd91394a406911db
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
92KB
MD571e4ce8b3a1b89f335a6936bbdafce4c
SHA16e0d450eb5f316a9924b3e58445b26bfb727001e
SHA256a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5
SHA512b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7
-
Filesize
46KB
MD5be96c7d83b5d0fa46c5473ce60d96ad5
SHA1836f9d8f5b53148b42adccb57a3172287c4a6bd9
SHA256eb70180cd89b359cf6137782fa069f9b9f1db59d0a59e1cea882e5c7ef4d87f2
SHA5128ef212ed1946b9f66e1542a75607706f7637346496a90f9c6489ec0495f1f1b2e7367f4601ab1df0d00e047ae4f6913fe9990dc1866f7517542b1e50a7bbbc7f
-
Filesize
1KB
MD5a7f6659ad1fb176299c2721cf60d7eb3
SHA173562dbe45c602cebbb1bf5ca3141142e0f461dd
SHA256914a1d1935671a1a8845b185992b22ed26d0170f66ce9022b569b11effcd6f2e
SHA5122eeff881c662b534016f9787d1186712dd9bdd9ca5318b8ae923953937d5ec2bb3305e6c8c41e0cbf20b31ed50a4ca2a010e8ba28e7f06680687a3df9d101b05
-
Filesize
186KB
MD512d96be7787bd3a8d6426603190280e6
SHA13d472f86ea8c8247a16d06bc20dc5b0b19409ccb
SHA2568a205234453b82f6a138cebdab2b22197dfe6e5527877b07c662a70888109ca5
SHA5124ab6e38c4446bb3ec4d76746eb9e7d76a4a4b0f4f672b9f3ee44912f4b5bd5625c4569e6f49cc20c024d5b4f158308d67409b9a6f3c79a69e4684e8932ea5e5c
-
Filesize
22KB
MD517269da772a16850827ab252a8231201
SHA135fce7d447f9d7393105c58e934b44a1a41680bb
SHA2561570515ecb52d0d091a4ba2c2803a141ab0ad0b9f1cef28bffb3f299930d40f2
SHA512e4368c4f813c90a5abc15d4c4dde8056cf9f329b3fc638dc7f9ded5d640bccc14cbb03c93d43caad98e0c85ac385fe507ef916a11a06f2662340e06ad0ecdd2e
-
Filesize
1KB
MD5b1b6be33a8623958e18edcf5b66da209
SHA1e128f75b902597aec54463053e8f8e43b54f424b
SHA2561133f573760415ee03468a56798ad6581f25fef5e6dd9686eb98ff363e1a30b2
SHA512a5f24a496690fbd7000331868e64521c254823e6964c7df8d8f169f0fae2c97ddb51c2274350c4aa3a8abaec2d9538daaa722d2a6f8d6c3806d4e9662edd22bb
-
Filesize
15KB
MD56e663f1a0de94bc05d64d020da5d6f36
SHA1c5abb0033776d6ab1f07e5b3568f7d64f90e5b04
SHA256458b70e1745dc6e768d2338ccf3e6e86436488954ca3763472d8ffec4e7177e4
SHA5122a037c39f3a08d4a80494227990f36c4fef2f73c4a6ad74dcc334317a1372234c25d08d8b80d79e126881a49fa4b3f2fffe3604c959d9ceceb47acc7192cc6a5
-
Filesize
66KB
MD5f9784284f96fff529fa330ce2c91b042
SHA1e985e8c74edc5b7d2d878066d4e2aafa60b963cf
SHA256e6d960896e8690a1f212a9fd944a0b4960d5ba17565c1197f94d221520d79f84
SHA5121aa92d803a41fdf6bedf280f37dba5677dfb59a06c461f84b8e27fa26096984f45d6ac17794edd8acab334ebc4ffd0385dd95b902a7ff9de116216dc436d18da
-
Filesize
88KB
MD5d86cb3256d031f68ce38f909a824d161
SHA13d46312210b8a739f59948c1af96e3118dd2a2b9
SHA256074773f7b492a6e966677d5552a88002c2dba41df6f3314fe96771a0b13361ec
SHA51229a6495d97f69a31ac82f17fb5971c4b50a4edf6fad892322935a070269bffa8dc6d64b5cdb5ed6501766b062256d0e24142cb1e27ce86d507fa19974e9a1d7e