Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
06/01/2024, 16:15
General
-
Target
windowsProxy_2.0.9.0.exe
-
Size
62.4MB
-
MD5
6790611f5b8913cdd10f4c284af8da08
-
SHA1
93c081a1a6b3656fcb66beead69587878d392d99
-
SHA256
f0729e62c4bc3633797eea6c70969503993eebfce3fb8a852a029c0ea81c43f6
-
SHA512
3e7eafd3c1bfe782676e702474565d546c1e2f6cfa7feff351f915eb0d12a25050edfb07635b1bab5963afe2302ad9502595005291fe1b9e8f83c2449c51bee4
-
SSDEEP
1572864:5ypH6HJ6XKAZJy9oxpwAlroxZXWjqyE1rTR9Et5nubC4:YYQK0y9oYA4XWNEWnubC4
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 36 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 19 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\windowsProxy_2.0.9.0.exe"C:\Users\Admin\AppData\Local\Temp\windowsProxy_2.0.9.0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-R131V.tmp\windowsProxy_2.0.9.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-R131V.tmp\windowsProxy_2.0.9.0.tmp" /SL5="$40016,64583684,1047040,C:\Users\Admin\AppData\Local\Temp\windowsProxy_2.0.9.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\winproxy2.0\vc_redist.x64.exe"C:\Program Files (x86)\winproxy2.0\vc_redist.x64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\{96CEB16E-6AC4-4EF5-B6DF-3F96616022A7}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{96CEB16E-6AC4-4EF5-B6DF-3F96616022A7}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files (x86)\winproxy2.0\vc_redist.x64.exe" -burn.filehandle.attached=180 -burn.filehandle.self=1884⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\winproxy2.0\ppt.TXT3⤵
-
-
C:\Program Files (x86)\winproxy2.0\naiyouwl.EXE"C:\Program Files (x86)\winproxy2.0\naiyouwl.EXE"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 560 -s 5484⤵
- Loads dropped DLL
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
381KB
MD506f09bcb5726907f54a55e0939804d4b
SHA1199d69d08c31bb90d44505cf96fec0ca671ae847
SHA25694021aa954c3cf4286f49fac91e17ba0668589d90fb81311238cd18e788848ab
SHA512504302b036a560f4c173a91867d034535bc45cc3071ac7b4aba94437755ae30872bbb6081c83461a99ffa1d98c0949f5b3f330922f2b12796ede1e82699a3c32
-
Filesize
1KB
MD50aa3617b3ef4fd6ab38b469c1063f944
SHA14914e93add79be7ceb9dd03d3fe8ce25d112bf0b
SHA2563edab6fd14846db990192b0fa7ebc78941cc872036b1ba3fd8be881aab91f41b
SHA512ff6af58e624d86d92e467b277690821e51416beb28ef7730974ff099ea79cb17f8c109faec6345075bf9daa5b44e16e1f22e37bfd47533aaf86aa8dab1794b26
-
Filesize
1KB
MD5597877df09f2c0de126f303dfe266bfd
SHA186bdca524843fb8dff4bb6dfc99b8ae10d39a792
SHA2568a9f24368087235c4fcf11a0f8203b2e221ab8cd9a5a41bb412f25f0c05523b7
SHA5123000faa86a43bf48c22a6069466f31fd4d03a3d4d030fe89c442c92e835bc1381c07c8c70627da3d949ebb362ac9a09b63101bc038f5fff616ddd9996114f303
-
Filesize
13KB
MD5cbb1e57ab3678698842e1c722d7dfd17
SHA1849a251286b911970e5c74b4847df4ad9461251f
SHA2569bbce8f3b2518e5e9c85cccd9699fe5a01e39816815d2f8724bf6c3b6c1802f2
SHA5129e91de1c24d04c41df3d5722b1959ca633e0f76fe3e95e349feef557183cf25390d7aa943b8f72d438e0602b371d63bb1c66ff35a97e2088bd2f1b458c5d2951
-
Filesize
1.1MB
MD575f5042e364749c51031b5b01cd9b692
SHA1b5fcffd06acabaf21dd61543f8fe579a2e348647
SHA2564e1debcf01de9bdc64762c24470b81f9db50c92765e7ab83afbb4a374649637a
SHA512b68b3eef37b3057837981237056ce48cd5d8d761f3af629e1261e2bc4bcbdee403ea80512f6c8316cfe636752c1eddeb17e915843b899419c749f2e57938daed
-
Filesize
71KB
MD557ef7050657dc0893162cfa6c91b9231
SHA1946134410cfe9f2a56faaa3c9941161d3e9296c2
SHA256778c2bc1d8b08366e9f7c8f8e4a8610bcbec3edc7b7e4deffd0e05c9157c4c25
SHA5123f63f7ce8d0d9a89bfa9000a2f8a887df89653e3d06b9064711217248aa7ac9eb4da6db48e7e5240320d81b8bb834b46aa699c2cc23160d753daae28896da0c7
-
Filesize
970B
MD5b3dcb5003ffef02751b0e57c5ec3c6b7
SHA1a9ad3c9b8de3092deeda2ac9b92de2437283a3c5
SHA256928c0ac4d153d4ff3fe178d2b173f9909caf2161149030fbeb06eee11cc17e02
SHA51255166940cf55baf25de3ca67e784f23f1622dcef99720b4a9831cb4b814724d446f954f7fb2f021ba5ee603ede2ca6cd5e0a3281f0d75b29770628dd1a47113f
-
Filesize
1.5MB
MD5063fdec9b2dd3fb4e18f6373e2e74f14
SHA162c7b41e9d7ca3249c72da3efbbb6bbf3acfddce
SHA25606644ee8666b409a100dd6433fc0316bac17ccbc15da57b39ef4856e3ae1c880
SHA512b6ede3057ec3a2ac6e19baaece4ee61500f54ddc2d284f9bfda0d784eae94552b6bd78647d580d79f466582a08ad000e7c19a06ebc01c44761f0725790535237
-
Filesize
1.6MB
MD57ce992b8bbeacf4750a57a808aa88823
SHA1fc18757391e703441d5eef4cdfa775d0a4ae1570
SHA256c3d2bcbec6d2dd54a3beec74fd43a81af2a99db825c90d02e6b644c5d80b4ad7
SHA51293832f71b0774783f71bbbec3ee2ef4111926a8964d653aadbd01556bee068a6470b66206aba05eeff99ffd26fe39dd288baf148492f66d80099c7df4d7aef37
-
Filesize
64KB
MD526c983533566180b9b2887b58a7bbf1b
SHA12a425740c1c47a561617caa188c24885b5707dd4
SHA256ae005c6bfc6325664d82d3e6126ac590fcd2124828fb8f8de569602eefd4396b
SHA5125109275cf481e30e493bb0281c0f4a6ad8a3b0ad2965c94ed7d0286dc1292efea3a4362d693a9ce083fd4b0b3adab78a8ff13c3962a10e8910c579fc4b34c0b0
-
Filesize
2.3MB
MD53999514816af30144e081a2fa6791a36
SHA158b78acd43e56b296c72efe33a620ba87e258bde
SHA25627525e4fb7e633edc3dc525f2e8c37cbbccd5b1d3ed06af185215866afd37984
SHA51237ecbff98ac20e1a8e9417b430a13d8fbba8c22446fa54b13af57fe5dd11f135aff7f8853421f254a3d63ad83791b1de49c1f6952728c7622d0289a863dd6af7
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
86KB
MD553b89f65cc347a79da33cb2f0276ab91
SHA127913c1aca3af640e0a6116e5e3f67255ebe0933
SHA2569165e8b26855d1c86c1901abe9856cc84ed48b1b7684a0a56551c9509d40e5be
SHA512d6d62717fb3186cc93ea5ac1e5d28e14452127fbc14e688295f1d891ba3ad8b7b8345cd7d869daf7f72717c430ef898a02ec31fa9696cc1d68baa1dec4d77e7b
-
Filesize
101KB
MD550a51b3fe7fdb4897436eafe58f58a47
SHA11ff1dc0858db9ea7d48f804099a06592a6c7967b
SHA256f835c9dfb53e1bfb55c0a2212ce5993618f44550171414ac75f68b4a0f9dc50a
SHA5120b56d67da4e7ec2216064654ad03500081a94037488eca25d02e0634782a32594400c5236cf277d17a05a6c23be7e41728dcc3a801153a6a4ced704560cbe107
-
Filesize
85KB
MD548a189ebbe3efcf0d149d2bf79d651ca
SHA1589a7c877b004d17e5d54175e717d1a331e84a6a
SHA25616e3d68805974265868997ffe13a95bd35fd2ac02c6e5b99834c1414bfbfafbb
SHA512859e9b33b0a64b5974c472d1cd697bd98de60e620f818cd4a135f704cad49eed400addb8725da9689db88eeb3a787a64a8781ea8c3c441601f9652fa0ff12052
-
Filesize
1.5MB
MD57438e9515add78a3b38042124194d352
SHA1c990738a780173f9e0f8cdd5bc3e166877ae929a
SHA256be10a189c59df83bba334cfa182c3c3c2fde7943bdcdf0f539c450e20d6a008e
SHA5124bdb636eeece149d573dea051ca3c15187f2b32bc7040ce1756556735ef39e5d3264bf4c6fadc5f51818eaa42b5a0171525843d28a13d9fea5b96e55a87bc335
-
Filesize
110KB
MD563b7b44ab33179a5d1a4e1ff6f51b730
SHA10dd47157c76b882ae125a97ee21e1ecb7f2adcac
SHA2563cb127a5a2970e95af3cab7a0eb989e9c4dad5a33332d85f3a964692cd31b13d
SHA512cf1f9d587575a05fda672510d560248930871257e41b7870242e922230b7d75e96974fbc66e8dd207a7eac1ac494dd19d5073bf424578f47df14445576d930b0
-
Filesize
90KB
MD5c04fd9f303d74c808d0dc7a0cd0a2e8e
SHA189319137ef5e224c36596c2183c6b2df9d32da12
SHA256f870232d3e30b72005fdac7a165f8399fd403300462d4c89440b6336596dea91
SHA512c849ccc6036273d922262e7d3214e8c955edc595baf6757beaee45a105a9ae818a4a8c0e9a4ccda7896898c2f42c0d1a84df27279a4ae3b1ea8867f2f60594bd
-
Filesize
82KB
MD53718eb3597435ece470085d30957d018
SHA1e0c3bedad9093bb685cea4f6c9f55cfc3b50c6c4
SHA2567117f740e5f0456daa16a1ff4a915d4cc7eb61f61c7fea893f02fb07cfd3354c
SHA51295a93e7cfdbc836ed495512eb922b809e8f1c2c8a9d557427fbfdb97dbe0ec898e65b54a76d53899cb5dae665d3ec246b8d38d59751bf9481ece6a6669c364ef
-
Filesize
96KB
MD5e78dbc0f4e856e35de98edd811e6f453
SHA18212babf31a3da4e419e918e92a4d9a17fb26d4a
SHA25620b0e2761ccdfacb8677a95b530c94bf327507d052b3322a7add767d5d64a55e
SHA512c1746fd32864eab52c0bb1934e416176a5ccee78ef52cc08662f4ca8674cd9c5855be80dae8162a5ee410508a85224b825c98265b203b65872c156372db3d64a
-
Filesize
103KB
MD55d00961020e0ccf75a1e79938c3410f1
SHA1c0e65aa4426da92a21cda041f95c6a43cd3131f5
SHA25683acffa2ad5be64a603e5326545ba37b598884814ea92212502b08d47e26e828
SHA512e1f33be792908e16daa1bafec91748d3343adf0ff5ec43e90aa958f01bc20f4842fda5421391c566866a51ee8a64b3682f88696001d11c93820a40e21781858a
-
Filesize
84KB
MD5dbefa917fe45dbc1e81ebdbd33e30294
SHA1b5afb37adc69a2278edd9613184de4beb0a274a2
SHA256fd5865adb3a154fc5054d0ac51c9c49356cf5fd3196464c5e89e9122f260df9c
SHA512d5a23484b1f5b78c886311ef94b3db7d546a13e0f74307464db246cb59f9af31f92b55623c871af14c05384f725250f25f543b2375981dbf504899d40f5fb778
-
Filesize
2.6MB
MD5b1070382a4876d578b5820783f50524a
SHA1c336c01e71d0ee58502630afe99d439c383552c6
SHA2560b785c2464e3cb142afe1ed5663b454777a8a0d91aebed6ed1821fbfd2fa4d29
SHA51249396937c23676745dade828eb696c22f7a346137f3a50a31aa0e401e51efe94fc62421a8f6e9ccb9a47ed3264805f17fa580d0551173a5aaf892b8d5e01f457
-
Filesize
135KB
MD59de2fd3d64c63220300d05d5176268c4
SHA1acf806efa83e3f080bc0210c0ff607c0ff1fa0fb
SHA25664ab9b5643a3186314231e5b40e7582e24d0008ebcae32e5a9e72a5b9e808b10
SHA512b6583856643fcd5efa67150894cde7bd079e346b15190e4e218eb4df0e61764beaa485bfdda2e5278894b63ce179787122b97b4226257327bfaeeea525ed40da
-
Filesize
83KB
MD5fd91b59d8ad067da38c51f06cc3175ae
SHA1824b0c4145b6998e916c8555fea27f5421d6e97f
SHA2563783b58b7e01bd33c74dee3109a5cf997c3f64d635e4d3ff0989b92d87ac11ec
SHA512a5dc0ae95b7f270f057a3d8fca341b5afe4c7495e25ca2f8ff0de3cf448a28529d4619fbed7428eb8b78e0a9a1953f330710a1969c5199ce0f2fbc5bb70eb021
-
Filesize
28KB
MD5077cb4461a2767383b317eb0c50f5f13
SHA1584e64f1d162398b7f377ce55a6b5740379c4282
SHA2568287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
-
Filesize
3.2MB
MD52f4b6c3c676f4a4ec6193c662d7237ee
SHA1d39df5ee7e5d22d342c155b3877b332e288260f5
SHA256dcbd79f914729daac6890f93fb737a2ddb7cd4d2be3c6dcd9d92ed6eacad5f63
SHA5122420cc8b95a53b624ab3bd8e63b5c14e4b2e735c1d61acb898c8290b5c30efda19ac0f6b5eb5d92699a2a49db9d7831a380875e0d5123c21df36b91c1268f903
-
Filesize
64KB
MD5aa7c40c5c65f62fda845e6f476d24602
SHA111772f409b02c7b5079fb1d00bbf334b963e39a9
SHA256746c5d6b641663096cf2ecc99770cdc9051614e6b2b35d9dfcd5432eb118b447
SHA512f8a3dd1ced612b4975cdca37f25d9906dfab5b389c2a2809ad5c8a9b376ff52a8cb17169acbe7c202d016a77bf5ec64ec82a9a6155542e88a60ab95fe9e5ae4e
-
Filesize
635KB
MD5b26ea60ea4341cd87c2a67e061e34439
SHA148f80f1defda08c555e99d55f9914c9674fa8ac9
SHA256f4f22e86366343d12d68a925ad3cfd3aa5986a26708f26b5cc5ebbbb7d7ea461
SHA51289f1e978c351cf01d570be1adee11f412840bb255d2b53c12d7e2c524153def7a0e618c0b35b4479d79633cc5e51d990f0ef60419d879a9729926f969ea07330
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
7.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
