Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06/01/2024, 05:30
General
-
Target
456844b2101210da7476e2e51e8d2998.exe
-
Size
4.0MB
-
MD5
456844b2101210da7476e2e51e8d2998
-
SHA1
95802ce9f817333974c81b506324ee4e02ce07b3
-
SHA256
ba1e8ef96683117199bf2719352ba88161fc0f2105165340599f1d2a52a390a7
-
SHA512
244646020e5e67432fcd4f967def1a2732149a6008bc3613fd60af8ab12b78399236a4fd3db9145dff1d00b50e39c98adca97eb7a5f22d8e86e201aaf67eec20
-
SSDEEP
98304:PJzytbQjlRePmeeekWG3MBW4pOF+Fo58jWaCj:4QR+DPjW4nI8jWZj
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 9 IoCs
-
UPX packed file 21 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 17 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\456844b2101210da7476e2e51e8d2998.exe"C:\Users\Admin\AppData\Local\Temp\456844b2101210da7476e2e51e8d2998.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\RegistryOptimizer.exe/VERYSILENT2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KSTMQ.tmp\RegistryOptimizer.tmp"C:\Users\Admin\AppData\Local\Temp\is-KSTMQ.tmp\RegistryOptimizer.tmp" /SL5="$30120,3734389,54272,C:\Windows\Temp\RegistryOptimizer.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"C:\Program Files (x86)\Optimizer Pro\OptProStart.exe"4⤵
- Executes dropped EXE
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD55637376b14490bb2d2c24b99d0c4c6e8
SHA1dbc71d31bdb9a80ce8932327fd6a773b78f4cc9e
SHA2560854d1caa37ec0926a2f38cec7cf7196b86f82409da17ca672c93c87c35fe3f3
SHA5121c6c1ad426ccce58d883c38fb05ce0ac35f6acfdb5da6edc35f162c475be5e908abc87272597eb93e5974c87833f7823951344637d339051c9d418ec7c98b47f
-
Filesize
125KB
MD5093c0782b40fca1bda55e08da2176722
SHA13477d220576ab7bc131083559227d3d93bc14d31
SHA25687f1fc551e1c0b2e86bc01f18eb7c3407e6ddea6de587ed3189f17b6fdf6985f
SHA512af0a3e655cdc918bb703211a023b95fec297d4d57d891fa399672bd0d456b522552a96c2c3acffaf16c0dd748262ac8fa8062ce1c656f31f0fe287e7369d8a9e
-
Filesize
76KB
MD5613e10441ab74471cc3743fe7e9efe8c
SHA13204648fc7cc7d11a611546f098cc1c8f65c0bf3
SHA256064133c48597afb6b3a940ea0acac39d6f3c7382a0da6c9eb31e2439c48afe5a
SHA512fef596abea7b96556240d8bf5246c12c27cedf8232f157a209b97dd59c12bfa1b353dd48177173a507e81fdce30020b19efd8dbc1c8242149c27265212346fb0
-
Filesize
820KB
MD5374a8e7a551c25effd48a60a274d912a
SHA1e7ee8fefb250e43e94d53bf422914387cc6f5f18
SHA2561912606c353dadbc68f08070849742c332a90f481fd44b443a57d8e095f0498f
SHA51284f7d4677aafc42a122435ba387559fc244b0976861338cff84acf4ffe115b30c6517d06810aac55ed1724c247b0d742407612cba05931b3d1d4e86a8e2260d6
-
Filesize
791KB
MD536a31b59fbba3a3aa158841c503c76a5
SHA1eeae93b87b2f9876c44f1ee1bacb754b11345f4f
SHA2564e5893c94bdab067f798d059a131a57222427dcd1d2793a3a2fecc05f706857c
SHA5124f7798a82d970e3d75fb39a811bfc5a51bd5583178a7be64bf58561602ceb2ac677c38b903cc821999fb3f146f71b995fe0d0b8651498a785bba0bb86b392a56
-
Filesize
123KB
MD517ae0f87108cf3b145ee967bbf370eb8
SHA101a8d92355f51f542c43197da498df4906456a8b
SHA256c952eaa4800c6b85a99225fbf05977116f9793d43e8e409ebd0b37e7ce173b2d
SHA5121ca169d758715b8360b870631e994a3f0e56cfe705840908f275cbc075b217b26a6971b03e895e3d7851d3ca5cddc6044a65e4061297ccf5f92dc96ac7b0749c
-
Filesize
99KB
MD56cd2c00f2cd2ce41c525e8c2cc755c79
SHA19e2b4d2dd97b20f5a616eec1d6a1e3e12ecf1bc5
SHA2568169b2dbb535b6ea95a9070865ca8b32485f50676480ef4951846818cca36fc1
SHA5123a101a3967b27cc8ac453d5c27d06cf15a1bd7bef0f907f673fb6b63551cc0f82c78e7012fee16ffe17439c92b13ccff40e9f8a77d22beeb068df0676338d310
-
Filesize
117KB
MD52aefb3dc1159de2cf350656e86111b2a
SHA173d69f10f956635b781161b7d67e1c57868148b5
SHA2564798e7e2052a36060684587aee1797c42b87550ecac10555940f350317db6ac3
SHA512c3f8dc1f2e5f8c351194c03da38254d19f4a45020fe5762555b666b9930356533a39c7b1db63262ba06aa43a4dbc1138bcc68b936f96e6d03548c06ec3e826f0
-
Filesize
53KB
MD5427bc7012874a12566cdd70e7d54a7b2
SHA190d41d64b335099251e4e7903b87d06fd652acb9
SHA256de23ece88ed98f4dfb17bf4f1f2dd31347cc0828f7bbe8be496573ea218e3185
SHA51286399741bc4c592b3512e3fd328c1e42381a29d1f034ad07f29100c688c6442f34d59ff4040dcd8011dc9eb38922288c96f3f361c9fa227a17d06d6a9d9bf422
-
Filesize
158KB
MD5f97e249ba36979afdac08b186c566797
SHA1bc7fea0df17bec54cfa47b6ca54e8b98009e9b07
SHA256cf26827a46f82a02240cefd84b6618a1f766acf0153b0e7e6a5a3a83be48b558
SHA5120d83af4d014152953c518a7cb4d6dfef5aed8e39162fb218a8f26092cb7b656fb04aaffcdc04f6486104156d15f6c1b6e1d19eb7d7858b818fa6982fe4d67aae
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
680KB
MD5ed69e64731547eba52476a2d2a2f7882
SHA1cbcd56bbb5230d11a01f18e9bf59f97802bb475b
SHA256427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0
SHA51204202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe
-
Filesize
925KB
MD52ed86328e1cb97e6456a28c4af94bc20
SHA17b87f1d310df713a06e04915fa76ceeae7e411bb
SHA25613e1093df86b15ad12fa03b2a6761c331828fae7faf5330b67c4a30fa9600d72
SHA512ec55e5c89b306472a72bbb54145e210c40a60e929a15a2516d2240faa6b2bbccf79c32ec73f04bf7deda51cb033f71f6c5abe6ef03c31a4759c07c727f91c514
-
Filesize
516KB
-
Filesize
64KB
-
Filesize
744KB
-
Filesize
516KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
4.0MB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
4KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
516KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB