Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1815s -
max time network
1854s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/12/2023, 14:52
General
-
Target
Duplicate Cleaner Pro 5.16 RePack/Duplicate Cleaner 5.16.exe
-
Size
48.7MB
-
MD5
ab413f5789c16c5607a489bf608f1036
-
SHA1
230985872b049138f416642e2c9e2d499cfdf5c7
-
SHA256
258cafd85557926016126321b0ed7d3df31a728c5b16c16c7da1744fcd0415bd
-
SHA512
2c36b9b6215657cd4923222e271ead27c691dad36ec60bcbcc46ce63f1b5d5c83338dfc8f60312295068739ef25d9a523a165e4304ae3960f189b0f7ec6cbcb6
-
SSDEEP
786432:T3jWdZevCMBksIblng6Fv9MPHw6GQnEdTg6KIIs8qJ4EogI97YDW0:T3gev/kZbFg6BynGQ9Nds8ELo9qt
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 6 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Duplicate Cleaner Pro 5.16 RePack\Duplicate Cleaner 5.16.exe"C:\Users\Admin\AppData\Local\Temp\Duplicate Cleaner Pro 5.16 RePack\Duplicate Cleaner 5.16.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FD6SJ.tmp\Duplicate Cleaner 5.16.tmp"C:\Users\Admin\AppData\Local\Temp\is-FD6SJ.tmp\Duplicate Cleaner 5.16.tmp" /SL5="$400DE,50670845,58880,C:\Users\Admin\AppData\Local\Temp\Duplicate Cleaner Pro 5.16 RePack\Duplicate Cleaner 5.16.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Duplicate Cleaner\Duplicate Cleaner 5.exe"C:\Program Files (x86)\Duplicate Cleaner\Duplicate Cleaner 5.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5b4deeff0fdc0a9d10715867285d116d0
SHA1f3aa5286e5164e2f850b286a122433f5b30b1bb5
SHA256e92e08cdcd33e163ceffb7233dbe8c9b38fd6bfb342c004d2bd37ad9e89e8ea1
SHA51276b15a30b27f4d84395a91a5a0f146e6feac104f1c397c014ad28020c557100870ce4525b5a1263448391e535731b679cfe2ea3bd4ecafa686f9158b505d40be
-
Filesize
348KB
MD539fc6d7339954d2314bcc14ce2e4e574
SHA1e6eb8400fc53eccceb2935422443ce9181b4143e
SHA256e205b482f71398c02591f5b3a3b486f445e4d36b63350606a4e2ddb9fbaf6c6d
SHA51211afa29ec595c4a8f12f3bb570664dfbe4475e9d71723371fcf9ad78570a6104340eab9b57f4a502a978b106df32dd096555480944e191d61607888b65a5ae2e
-
Filesize
3.4MB
MD544b59e0f6e79efc87db1dd01fcb01c46
SHA157344c6c08d02ec112c1de0d0d09bbf80862d390
SHA256ed2d604760e4bc8677595e2a6c17522d228d18c309c212271b6c6f6712785b3d
SHA512c88ffc2d76c28a7ad1009d47b2d8e114ed8b70374357c28dd3e6156f77ff51f1e5aa4333e0d91e7a9b590f6fdb1f988bcbb737ea2758305f267de499163aa589
-
Filesize
3KB
MD5b6df270030cfeac0eb39ed4c437d4221
SHA19639323cb9ecfb2eefa9937fb007de0693f61e92
SHA25613edfe2cd3c3c9d58a280cd1e23577fec7a24802585eead6d73f71179aacf4f9
SHA5122af5fe0fae2b676cbe90a8722efba9a1e0ce7b811d83251c3867c813ee7b67ab0fee9fc815214a30c6a0ef41c2b5b4f2a90d03d887ca0b5e0a65bc7ffd5673f3
-
Filesize
1.9MB
MD5ae347ede9072b035778f462fd3028869
SHA1150ecf7b37132b788204002ae1209a9e01ccde4b
SHA256d4ec58c1a8ee6316865f5c22e6046a426f9017d50994075639b5040722132275
SHA512ad9641aa2c51547824e8c8b4bb4b99af5db6ae263fa0d970bad5891d7351b392f1eee8c9cdb445d7fb194fa4fc7dd1b40a18de606fad3408a471a8d142c44338
-
Filesize
915KB
MD590b4f778d1c40053bec5a5be0ecb7d85
SHA1fb49d586ea9c385696c0a29456c9a53c6366856b
SHA256a26e135ce3945988545d4982bb81e2c17c55a7a672c28b528c81cc97191460fa
SHA512a744a042f57088c803bb810bbe5ea929ac946c3e2ac05636eb92e2e47756fb12dfe984c816cb9af808cf9d7f3e8e60eca909a136b1c4a53ba9bd692686b025ca
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
84KB
-
Filesize
992KB
-
Filesize
84KB
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
504KB
-
Filesize
40KB
-
Filesize
5.2MB
-
Filesize
104KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
392KB
-
Filesize
1.2MB
-
Filesize
148KB
-
Filesize
4.5MB
-
Filesize
88KB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
216KB
-
Filesize
192KB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
9.9MB
-
Filesize
512KB
-
Filesize
512KB
-
Filesize
40KB
-
Filesize
40KB
-
Filesize
512KB
-
Filesize
512KB