Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    06/01/2024, 01:50

General

  • Target

    41f756ba68f28ad179407c860324d973.exe

  • Size

    1.1MB

  • MD5

    41f756ba68f28ad179407c860324d973

  • SHA1

    93114c7d4f61b569d09dc236c070e2cd7b576531

  • SHA256

    71bfaeea754eeabccc10bf475ffd95dbb04fcb2d27840c3ac9ce443b2ffdd395

  • SHA512

    467152ea3207730a835cff2b8f0bd5d7ab585e77674be9f919c2ce07cbfc14f7544128222faeff9374fb5e8ecb62ac4cd6bbdb36d2638350446306974398f4ca

  • SSDEEP

    6144:5e348k201q1zQbe9DP3lpr4jAxLY6kEVagK1:c3zQcbRx9BVPc

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 5 IoCs
  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\41f756ba68f28ad179407c860324d973.exe
    "C:\Users\Admin\AppData\Local\Temp\41f756ba68f28ad179407c860324d973.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nstF8C.tmp\LangDLL.dll

    Filesize

    5KB

    MD5

    9384f4007c492d4fa040924f31c00166

    SHA1

    aba37faef30d7c445584c688a0b5638f5db31c7b

    SHA256

    60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5

    SHA512

    68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf

  • memory/1660-20-0x0000000000490000-0x00000000004A2000-memory.dmp

    Filesize

    72KB

  • memory/1660-35-0x0000000000490000-0x00000000004A2000-memory.dmp

    Filesize

    72KB