Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
06/01/2024, 16:15
General
-
Target
windowsProxy_2.0.9.0.exe
-
Size
62.4MB
-
MD5
6790611f5b8913cdd10f4c284af8da08
-
SHA1
93c081a1a6b3656fcb66beead69587878d392d99
-
SHA256
f0729e62c4bc3633797eea6c70969503993eebfce3fb8a852a029c0ea81c43f6
-
SHA512
3e7eafd3c1bfe782676e702474565d546c1e2f6cfa7feff351f915eb0d12a25050edfb07635b1bab5963afe2302ad9502595005291fe1b9e8f83c2449c51bee4
-
SSDEEP
1572864:5ypH6HJ6XKAZJy9oxpwAlroxZXWjqyE1rTR9Et5nubC4:YYQK0y9oYA4XWNEWnubC4
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\windowsProxy_2.0.9.0.exe"C:\Users\Admin\AppData\Local\Temp\windowsProxy_2.0.9.0.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-K1FQC.tmp\windowsProxy_2.0.9.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-K1FQC.tmp\windowsProxy_2.0.9.0.tmp" /SL5="$D00EC,64583684,1047040,C:\Users\Admin\AppData\Local\Temp\windowsProxy_2.0.9.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\winproxy2.0\vc_redist.x64.exe"C:\Program Files (x86)\winproxy2.0\vc_redist.x64.exe"3⤵
-
C:\Windows\Temp\{E622BA84-BD52-458D-81D1-6C11424B0DC8}\.cr\vc_redist.x64.exe"C:\Windows\Temp\{E622BA84-BD52-458D-81D1-6C11424B0DC8}\.cr\vc_redist.x64.exe" -burn.clean.room="C:\Program Files (x86)\winproxy2.0\vc_redist.x64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=6924⤵
-
-
-
C:\Program Files (x86)\winproxy2.0\naiyouwl.EXE"C:\Program Files (x86)\winproxy2.0\naiyouwl.EXE"3⤵
-
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\winproxy2.0\ppt.TXT3⤵
-
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 session1⤵
-
C:\Windows\SYSTEM32\net.exenet session1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD553b89f65cc347a79da33cb2f0276ab91
SHA127913c1aca3af640e0a6116e5e3f67255ebe0933
SHA2569165e8b26855d1c86c1901abe9856cc84ed48b1b7684a0a56551c9509d40e5be
SHA512d6d62717fb3186cc93ea5ac1e5d28e14452127fbc14e688295f1d891ba3ad8b7b8345cd7d869daf7f72717c430ef898a02ec31fa9696cc1d68baa1dec4d77e7b
-
Filesize
1KB
MD50aa3617b3ef4fd6ab38b469c1063f944
SHA14914e93add79be7ceb9dd03d3fe8ce25d112bf0b
SHA2563edab6fd14846db990192b0fa7ebc78941cc872036b1ba3fd8be881aab91f41b
SHA512ff6af58e624d86d92e467b277690821e51416beb28ef7730974ff099ea79cb17f8c109faec6345075bf9daa5b44e16e1f22e37bfd47533aaf86aa8dab1794b26
-
Filesize
101KB
MD550a51b3fe7fdb4897436eafe58f58a47
SHA11ff1dc0858db9ea7d48f804099a06592a6c7967b
SHA256f835c9dfb53e1bfb55c0a2212ce5993618f44550171414ac75f68b4a0f9dc50a
SHA5120b56d67da4e7ec2216064654ad03500081a94037488eca25d02e0634782a32594400c5236cf277d17a05a6c23be7e41728dcc3a801153a6a4ced704560cbe107
-
Filesize
85KB
MD548a189ebbe3efcf0d149d2bf79d651ca
SHA1589a7c877b004d17e5d54175e717d1a331e84a6a
SHA25616e3d68805974265868997ffe13a95bd35fd2ac02c6e5b99834c1414bfbfafbb
SHA512859e9b33b0a64b5974c472d1cd697bd98de60e620f818cd4a135f704cad49eed400addb8725da9689db88eeb3a787a64a8781ea8c3c441601f9652fa0ff12052
-
Filesize
71KB
MD557ef7050657dc0893162cfa6c91b9231
SHA1946134410cfe9f2a56faaa3c9941161d3e9296c2
SHA256778c2bc1d8b08366e9f7c8f8e4a8610bcbec3edc7b7e4deffd0e05c9157c4c25
SHA5123f63f7ce8d0d9a89bfa9000a2f8a887df89653e3d06b9064711217248aa7ac9eb4da6db48e7e5240320d81b8bb834b46aa699c2cc23160d753daae28896da0c7
-
Filesize
110KB
MD563b7b44ab33179a5d1a4e1ff6f51b730
SHA10dd47157c76b882ae125a97ee21e1ecb7f2adcac
SHA2563cb127a5a2970e95af3cab7a0eb989e9c4dad5a33332d85f3a964692cd31b13d
SHA512cf1f9d587575a05fda672510d560248930871257e41b7870242e922230b7d75e96974fbc66e8dd207a7eac1ac494dd19d5073bf424578f47df14445576d930b0
-
Filesize
93KB
MD5e97a9faa75eee327214186428dd72eb6
SHA1dfcdf47b2377a1f08ba09360ac99586ee319beb9
SHA256fc1655ded54825ae89df35eae40ae9dfad98bc21623e35a787a78cb9588bf911
SHA51258c0876ccf3d69a799faa011ca70fdf028d14d1f20d9e03a06ad6c571c977031b3d1a4f02d3eff31539bd3615aff8bbaedde91b571584476e703357da8afd34a
-
Filesize
894KB
MD57df554e81b1a1fbd2017e1f2ad2433c1
SHA110a20a9731def0916f79eb1862dd94146ca6ca79
SHA2561ee3dfec848d6ef335c0511d7b8bf5ccf0c1587c5b6e55d9fc1c0a7f76ae94d7
SHA512a20e23dfea80cd67793becaf4d03990c38333c4b3478c28726ae078506cc2cf5673f988a45f5eb1a837f65127f56c351d832bc97fdb089f8f4e352ea56669322
-
Filesize
28KB
MD5077cb4461a2767383b317eb0c50f5f13
SHA1584e64f1d162398b7f377ce55a6b5740379c4282
SHA2568287d0e287a66ee78537c8d1d98e426562b95c50f569b92cea9ce36a9fa57e64
SHA512b1fcb0265697561ef497e6a60fcee99dc5ea0cf02b4010da9f5ed93bce88bdfea6bfe823a017487b8059158464ea29636aad8e5f9dd1e8b8a1b6eaaab670e547
-
Filesize
1.9MB
MD514b240c3435eb8dd4f781f151d69fd83
SHA13d733bf3b7ccd176f3195477fbc078f1aec5ea44
SHA2565ba51ef6bbe2a0c48c8e7641c6ea1cb27b11b2ac1e095e05d7e39998f6126ae7
SHA512a09f7ca4f7588dab856da574392516dd6b1a45c8e71250f23dadfdcbe710da0d1dcbe2ff034a0e3fa09909e9429f49476d615067494fe7406bb6ce0c7a0c293a
-
Filesize
57KB
MD57188ed57e619c5bfeb79f6755f0ca785
SHA1581273c2617360f45409dc91745d5d2d2bba85ac
SHA2568e128951ef3a397a77e4ce65f8b379eee35f9d389598aa35054b92c873287cb9
SHA512ab518a2973c04c29c87508746187b7b4b9921c1d5687e67ca7edeca1c90028ac984d5113343a80c4acbfb3e86280a45e5fbe5fedfd0ad59edcce1578fdc77bea
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2
-
Filesize
635KB
MD5b26ea60ea4341cd87c2a67e061e34439
SHA148f80f1defda08c555e99d55f9914c9674fa8ac9
SHA256f4f22e86366343d12d68a925ad3cfd3aa5986a26708f26b5cc5ebbbb7d7ea461
SHA51289f1e978c351cf01d570be1adee11f412840bb255d2b53c12d7e2c524153def7a0e618c0b35b4479d79633cc5e51d990f0ef60419d879a9729926f969ea07330
-
Filesize
381KB
MD58f61a477a3f5681fa28c7655fb4fe246
SHA100b46e829634139a2b7efb2863b8f705d56e79ab
SHA25696324820670b60419eff227e4f84298bed49604b5ce064777cca264912beda65
SHA512b72cc133bfceb8968ad82632648e2ea1b1dc67069c305a445f0d3eb113c088eed428233ebde50605254ecacaf5f68ded4ca6890816bc04b6c2273707466e4134
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
7.0MB
-
Filesize
4KB
-
Filesize
7.0MB
-
Filesize
7.0MB