Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/01/2024, 02:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
5253f7a06c69c8bed0eee411a7e0bb55.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
5253f7a06c69c8bed0eee411a7e0bb55.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
5253f7a06c69c8bed0eee411a7e0bb55.exe
-
Size
39KB
-
MD5
5253f7a06c69c8bed0eee411a7e0bb55
-
SHA1
3a3f36e94ad74a700bc6d48a498773de192bec17
-
SHA256
a6d0900830daa30ced5171f0c6863a235dc1b676c18924162758eb1baec8c605
-
SHA512
6a0869c21f89c392c96a64f5899a59904b3bc5239e6c6852b16143d852eccdc00eab147e68bdf5886ead6afeb1ec68534d018b9b4b5f28ef068a026d838c6bc2
-
SSDEEP
768:Rik+jTpwqPyR9qKARp1tgeWLikd0WwHj2c:RibCci9qXRrtgeWLikd62c
Score
7/10
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000900000001410b-3.dat acprotect -
Deletes itself 1 IoCs
pid Process 3008 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe -
resource yara_rule behavioral1/memory/2816-5-0x0000000010000000-0x000000001000F000-memory.dmp upx behavioral1/files/0x000900000001410b-3.dat upx behavioral1/memory/2816-6-0x0000000010000000-0x000000001000F000-memory.dmp upx -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\BMsg6pdMD4ht.dll 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\FOnts\MhaUKGazkr3fZZKp.ttf 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32\ThreadingModel = "Apartment" 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37} 5253f7a06c69c8bed0eee411a7e0bb55.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32 5253f7a06c69c8bed0eee411a7e0bb55.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{737858A9-9AEA-4838-9B49-54DA731F7F37}\InprocServer32\ = "C:\\Windows\\SysWow64\\BMsg6pdMD4ht.dll" 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe Token: SeDebugPrivilege 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2816 wrote to memory of 3008 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe 28 PID 2816 wrote to memory of 3008 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe 28 PID 2816 wrote to memory of 3008 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe 28 PID 2816 wrote to memory of 3008 2816 5253f7a06c69c8bed0eee411a7e0bb55.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\5253f7a06c69c8bed0eee411a7e0bb55.exe"C:\Users\Admin\AppData\Local\Temp\5253f7a06c69c8bed0eee411a7e0bb55.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5253F7~1.EXE >> NUL2⤵
- Deletes itself
PID:3008
-