Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
168s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
31/12/2023, 18:19
General
-
Target
3abaf7302682abb2c7d851a7f9f600b3.exe
-
Size
4.8MB
-
MD5
3abaf7302682abb2c7d851a7f9f600b3
-
SHA1
c6d1571fd40320dbd5322827fe9f1c4b25a73520
-
SHA256
382a040cad6beda3e363a0bc564f341bd92d3d3592175d449599ca877dab6ee9
-
SHA512
db11ca34134ff57237453a8f8f9dfdacd2a9a808bba45bfd083252099e63b8377181eb64b0035fb8be6e098c7bb6f7114d2bb7c1fee5163f32902daafb20bb3f
-
SSDEEP
98304:PX4Nwhsxua0GgTReHnDjBDYwSGWeIAAWC8yazx14:v8WsGRiF0wSigWya0
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 3 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 22 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3abaf7302682abb2c7d851a7f9f600b3.exe"C:\Users\Admin\AppData\Local\Temp\3abaf7302682abb2c7d851a7f9f600b3.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-16K9C.tmp\3abaf7302682abb2c7d851a7f9f600b3.tmp"C:\Users\Admin\AppData\Local\Temp\is-16K9C.tmp\3abaf7302682abb2c7d851a7f9f600b3.tmp" /SL5="$A0154,4315556,721408,C:\Users\Admin\AppData\Local\Temp\3abaf7302682abb2c7d851a7f9f600b3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Ut\Qui.exe"C:\Program Files (x86)\Ut/\Qui.exe" af5733f5dbedd236941f32dcfc6054b33⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD56a4ccea746c1c6b07bb8f6d4e10c0d6b
SHA10668851940eb0244a1add330c40e503728af153c
SHA256c54f318950c9607a00ee92623da0b57eb5f1c223a35f613b490c005246728ac1
SHA512efb89f3c4e428b367e64db1b77d1b4ed80f8793ec4517afe59e9ae4d031fa6c23d9d77efe053c6854f26c27ef1c3b38046f6ef5cd260ae2e4f15423ed281a878
-
Filesize
543KB
MD58753e6fd8301a7ca7cad20251f002df6
SHA11d1bb2bc6cdaae770e2e7f1c99e69ef3de04ea22
SHA2562b233f8a2608357a7f8a804cda4dcfbf75082b5f8d9df82f762857aa6f9ca083
SHA5128efb4d2d380a76e3ff16b06b9292789436c6534f338d9b84c69a544cb31b40c9021c8737d6a4e59c36adedfc1111dca437e474f6eb41dc812216aa817fa090ef
-
Filesize
33KB
MD555c6a396adb1f3d1bdbd4ef106779b73
SHA115403614654f6a25df6159ae699405722b6f7da0
SHA256294fdffb1b00836139a4765a909a7e8d7127a47abd155ea1cf86f8f7841d3d95
SHA5128a1387fad65c432f272fba5dae18258dc0a3d92bce4c1bdc055c760ec62a62433f95c6c2c01185ebb6a18eec868baaf3ed6dc7bac647abd9d5bb92c3edb7f721
-
Filesize
249KB
MD544b6bb998c24e1a8ed59da3261b68bf1
SHA12bf4c3b57b4c847f9acde720cb8ff8d0025dd653
SHA256c08ab5974f72d32f3ead865a701e313330e699b9fcfb2d8fa226444c689c9bdd
SHA512b2aac200e6039c27e2f371ae00d512d9e778a3743eaad36a809a319903e6a2587474c9d784aab3d8d15a539cc4ae6497372a92e06dde9e3bd3d735cddfc9559b
-
Filesize
21KB
MD5f0d2b23caef509bb1ff64c76c5551cd5
SHA13398e9a6f25d800fe2f082da697f3fe1adc7506a
SHA256850f40c799baa411c6648aa669d2ca60d6ae569a765b1511e3c05af2cc4cae91
SHA5129a3ad97ab4caa15bf39efe2b87d717aba0518ae4b79005cb783f2e21f4e75de80f68593ea3b4e421bd1277a3a4480e3d2688aab59b785b591299b5e35648aad4
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
4KB
-
Filesize
19.0MB
-
Filesize
19.0MB
-
Filesize
19.0MB
-
Filesize
19.0MB
-
Filesize
19.0MB
-
Filesize
19.0MB
-
Filesize
19.0MB
-
Filesize
2.5MB
-
Filesize
4KB
-
Filesize
4KB