Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
25s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 05:01
Static task
static1
Behavioral task
behavioral1
Sample
42d222cfe08a8e609a71630308920e58.exe
Resource
win7-20231215-en
General
-
Target
42d222cfe08a8e609a71630308920e58.exe
-
Size
194KB
-
MD5
42d222cfe08a8e609a71630308920e58
-
SHA1
764114e089c49036c692a898fbffa02a6b911e8a
-
SHA256
ddb4a02eb9092efaf14750423a5d1c2b76e34c586ef6499891e1d1875770ce08
-
SHA512
32c2b6da0d26b1efd534b1b6492854dd44da339d1b27d2604b9f7f1d3c5c519cc3bd8b7d1ee33daa96816e073e8fca613dfcd80a577e10262a8df051bd562a60
-
SSDEEP
3072:hn1/uEAgDPdkBlyFZ+ScjaiKWbETBquAEXlqsUUTzwQRvEZ9yu:h1OgDPdkBAFZWjadD4s5TzHELP
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000500000001868a-73.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1928 50fb742d02760.exe -
Loads dropped DLL 4 IoCs
pid Process 2700 42d222cfe08a8e609a71630308920e58.exe 1928 50fb742d02760.exe 1928 50fb742d02760.exe 1928 50fb742d02760.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral1/memory/1928-77-0x0000000074600000-0x000000007460A000-memory.dmp upx behavioral1/files/0x000500000001868a-73.dat upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jepfhbjdcfdmjkijookhihmpcgmcamlm\1\manifest.json 50fb742d02760.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 4 IoCs
resource yara_rule behavioral1/files/0x0006000000016c1c-26.dat nsis_installer_1 behavioral1/files/0x0006000000016c1c-26.dat nsis_installer_2 behavioral1/files/0x00050000000186c3-80.dat nsis_installer_1 behavioral1/files/0x00050000000186c3-80.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2700 wrote to memory of 1928 2700 42d222cfe08a8e609a71630308920e58.exe 29 PID 2700 wrote to memory of 1928 2700 42d222cfe08a8e609a71630308920e58.exe 29 PID 2700 wrote to memory of 1928 2700 42d222cfe08a8e609a71630308920e58.exe 29 PID 2700 wrote to memory of 1928 2700 42d222cfe08a8e609a71630308920e58.exe 29 PID 2700 wrote to memory of 1928 2700 42d222cfe08a8e609a71630308920e58.exe 29 PID 2700 wrote to memory of 1928 2700 42d222cfe08a8e609a71630308920e58.exe 29 PID 2700 wrote to memory of 1928 2700 42d222cfe08a8e609a71630308920e58.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\42d222cfe08a8e609a71630308920e58.exe"C:\Users\Admin\AppData\Local\Temp\42d222cfe08a8e609a71630308920e58.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\50fb742d02760.exe.\50fb742d02760.exe /s2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
PID:1928
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5f3c79bda3fdf7c5dd24d60400a57cadb
SHA11adb606aaeedb246a371c8877c737f0f8c798625
SHA256a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
SHA512c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935
-
C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\bootstrap.js
Filesize2KB
MD541a7ed649138e701d9a20f43c277a09f
SHA13943bbe2aecdf86030ea8332f7d9b296f064165f
SHA256e00037272acfa824ef1f11c7d79ebe39bd630fa39a71fe7557efd3b0cbdef981
SHA512a3d54680cb6e9ef766bc4833d81809a1e15522a0c8010c7d28e8cba6a437ba6d1457f8bc8b00617a533a84a2fe33046e1af9f415c8e1200e8e0f7a811c6a85aa
-
C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\chrome.manifest
Filesize116B
MD5fcbdd0b465f36525eb9e3935cf4d68d2
SHA1171d4c0b7560063efaebcdb6de862651a397ee60
SHA256bfa3999b6dadd0f34be2e58b00497e631c3689a428b27f65f6938282d7d756ce
SHA51268bf6e66a4adcb709d8c85d761cac96b0f6aa9270453035edf119b93d56d2afd245e0a047053289cc6e38e669b12553a52a4f398859953db1ce19104e888ee43
-
C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\content\bg.js
Filesize8KB
MD50f2794c17af3462ce560f62afd777227
SHA1c5156569f57273d0c1f9da7a2159832107f09aff
SHA2561de305313d4d482282b89bb2af616edce5d6291d1afeb853975c04b53479739b
SHA512a584575553960c1e9e5a935b9f9ffb0b009f83cc9ed7aaad0d54f8d378de93791ce57f81540182738a0eaf0a6b6057f4d73f910dccae92d024c3529392528132
-
C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\content\zy.xul
Filesize225B
MD5674b9c82c62c5c116a9cd3f651622630
SHA19adeb8944fcf093f46a1bb6601e69c9fda417e09
SHA256aa9e1c5371772e44b3dd6b6e75be265701b3673f4a8662847dd0a41a694aa7bd
SHA512790bc3ab359a266893a8a33b1c3b1dbe1025ba8cf45b40b60c37b69e708817c119b0125e75041636075e3b951da60db16ef9e79609aeb60375c1261505f194c6
-
C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\[email protected]\install.rdf
Filesize700B
MD5374ab42378df1fe57c1f537dadb240a9
SHA131bf848901cac98e2fb0f729e84f901c63403f44
SHA25635e656f0eca83eceda5286ce9c9fb5370431fb63154abbc74b6221474524fc1a
SHA5122792fdb54da9f6ecc3ed994d945a2109bb586f35affb9d5bbce40ba928830dd4ee0eaf0420ce789923bf53302047fd0f5a7e540af6d29b05d76d1ed763329973
-
C:\Users\Admin\AppData\Local\Temp\7zS622D.tmp\jepfhbjdcfdmjkijookhihmpcgmcamlm\50fb742d0256e7.82991795.js
Filesize4KB
MD59b89a6c5d719efcebf857d38f518f561
SHA118bdf5683528666a9febd8ca0944beaf937968a7
SHA25625bf4260b90151f4508f4c5a7a5bc65ad0469976aef04143e83a2b0ab0b0de3f
SHA512f78313b02cafdd2b09d89f99b8c1ef634f1e1f202ba4b59a68ecb9084c6923371750370852565e90eefc4359b7558f062c49397ee337f5d753472d6ca77d386b
-
Filesize
161B
MD5c07d19093a178bfef21e49e492e8c9eb
SHA137c10130497c8d4cb7e2832845e5092d2a13917d
SHA2561deec4afb6b62f36b5250c4d56a3e24b10f96a5d53d0b4b9388ae7343fdede9c
SHA512cf1e472ff72cb917de69db92f5d3e1c0d9bd484589ac7d67052350095d4a0f167f7698466caca12a592b61543f4cec9bc0a31cbae8a095e3c748551478a6a51c
-
Filesize
197B
MD55f9891607f65f433b0690bae7088b2c1
SHA1b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA256fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
SHA51276018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
-
Filesize
559B
MD5209b7ae0b6d8c3f9687c979d03b08089
SHA16449f8bff917115eef4e7488fae61942a869200f
SHA256e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
SHA5121b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
-
Filesize
475B
MD595b6b9aa3a3730d6d373a68eb5b411c9
SHA105cc71bfa2d2a2a18e169def790cca29f757dd3e
SHA2565ac43caaa60d48d2c5bc8059dc845eb344b31c088207c8da714f7a36d500c69e
SHA5125a178056071d0c94d2cfdf72a60403fbf9703cc28abe560f1f04fc2e073188f595c6bb3b687c7e2654899e103a229fe123c41af8aebbe189c9854ed71d8c672e
-
Filesize
1KB
MD50cd60262c81ea56fa5664591f42e6681
SHA17575c25332bc89e9247d090a9b9b27e01b9f74cc
SHA256de3024fa783106dc7be968245370eea22931c87d5330841ce83f367114d459ed
SHA5125e3c81df569f033dd4e3ac462dee5b2e66a14988490171b63cad45a4c2193b02c5c874d34048d7149e36997803c8e9e765832c322c462810d681ebfb63f849dc
-
Filesize
882B
MD5c468db40505cd2d006b223aba84f1a20
SHA169795b63a8ea1cbb9b6c5d467afa870ea9a12386
SHA256791dd1858890532430a37310dfd8eff0397e78b3d38bc77707c0913e9119b516
SHA5124ac84112a9f31b39d9c4ccbeb814399dd3d82231827ceec1204e050b4c22d0ee8283331f58a0d446a922acdff180d856c02009e02b4a71747e3879cf92116aeb
-
Filesize
71KB
MD5b78633fae8aaf5f7e99e9c736f44f9c5
SHA126fc60e29c459891ac0909470ac6c61a1eca1544
SHA256d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
SHA5123885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
-
Filesize
7KB
MD5b9cd1b0fd3af89892348e5cc3108dce7
SHA1f7bc59bf631303facfc970c0da67a73568e1dca6
SHA25649b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
SHA512fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90