Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
09/01/2024, 16:13
General
-
Target
4ec415fae7663a7b2a5ab238e8dd47ec.exe
-
Size
449KB
-
MD5
4ec415fae7663a7b2a5ab238e8dd47ec
-
SHA1
984b185e8025edd571f4ee4a34353824d0c974f1
-
SHA256
e861c3656e94f99a9a642b6d1e3d0685bc5230859bfcaa1a4c55316f8708a11a
-
SHA512
7a38ba6617dcf7c37d0467a89143f72c0e9ef81e828cb1bfbb818ee401f83c8864a2d0d584c9e78418d243d1b5f63a9dbbadccc128d387f794d9af0c2f36811a
-
SSDEEP
6144:DSE6PwjBhRD2pggYV4Iys19B7vCNzB5O39YxfCtNL9kxBLj9C3bdu3sz6c7eDSaC:u4Dng3d09YHu9YszL9Iad6GCtC
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ec415fae7663a7b2a5ab238e8dd47ec.exe"C:\Users\Admin\AppData\Local\Temp\4ec415fae7663a7b2a5ab238e8dd47ec.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\iO33602EpHnN33602\iO33602EpHnN33602.exe"C:\ProgramData\iO33602EpHnN33602\iO33602EpHnN33602.exe" "C:\Users\Admin\AppData\Local\Temp\4ec415fae7663a7b2a5ab238e8dd47ec.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD5ddf0bf674bfd61706414026179b39832
SHA1ca0d31310f4ebae090ef322fecd7bfed33781717
SHA256b5796ef280071943451927607b625ca6f94f54413e8748980a31cd88e93a1f47
SHA5123f6585af9c578e2792f871f9a18bcc1dc5cf9e410376a1014a3c8f680316e80f11fe97f3fc8ac80f029aed2ca487e7ec1268dce448b0d159f2e3791fb83c4f7c
-
Filesize
79KB
MD5967871625918c56a1c01c2e262b9cd0e
SHA12fd5dc7d0af57f38c33aeceda25979aa683396c4
SHA256f500c537742f84639542f8e83b2b67d604680ea082dc6c59755a1e91a9d551dc
SHA512c56c79d259dbb1dcad5eb221004764e35b653d1c582a01b6ffd95596c87574f8db88ce02b5d8aa1b6576f0fb1ab301d21b949290d178f10f5e7439ed9985f3d9
-
Filesize
388KB
MD5d42ec479626ce0283065fe18263526a5
SHA1f699e4d807142c981c0b6aa96e95ba66e6e9ebf4
SHA25657d0c5c07d9d351220a67a117387ffb86a2bc413c33263520b685dd5f00b2a5a
SHA5121b95521b47e96595934eee7e7c557dd6f1a69ea61cf7a6ec211da1027c4af9a9beb022f87b3b5f2c72f1d781147e1c329374b677ce79e584f8085a810f33adc1
-
Filesize
414KB
MD568d14794be0584054241866e00a06fc1
SHA10cbc9c43251ef9e7c958e84391a5c7e5ece32ff5
SHA256fcf172e4ef8116f4f1cb6c5fbb5b35ec041c527ed639c77a7ffa5e05640b65d7
SHA51200294aa7db4d688720f6fba80ce9823f0915cd31938a79247dda4500725f5b2c4275f7f6337f598ab8b4a5f1f588f1393ac6c504988a801e4d37e5c944a4dd4b
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB
-
Filesize
1024KB
-
Filesize
776KB