Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12/01/2024, 23:12
General
-
Target
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe
-
Size
10KB
-
MD5
2a94f3960c58c6e70826495f76d00b85
-
SHA1
e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
-
SHA256
2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
-
SHA512
fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
-
SSDEEP
192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K
Malware Config
Extracted
stealc
http://5.42.66.36
-
url_path
/1fa9cf51b66b1f7e.php
Extracted
guloader
http://www.mountveederwines.com/a1/bin_encrypted_C58FF9F.bin
Extracted
smokeloader
lab
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Stealc
Stealc is an infostealer written in C++.
-
Downloads MZ/PE file
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Runs regedit.exe 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe"C:\Users\Admin\AppData\Local\Temp\2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Files\yhdl.exe"C:\Users\Admin\AppData\Local\Temp\Files\yhdl.exe"2⤵
-
C:\Program Files (x86)\炎黄大陆\炎黄大陆.exe"C:\Program Files (x86)\炎黄大陆\炎黄大陆.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\easy.exe"C:\Users\Admin\AppData\Local\Temp\Files\easy.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\updHost.exe"C:\Users\Admin\AppData\Local\Temp\Files\updHost.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\Files\2k.exe"C:\Users\Admin\AppData\Local\Temp\Files\2k.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\2k.exe"C:\Users\Admin\AppData\Local\Temp\Files\2k.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe"C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe"C:\Users\Admin\AppData\Local\Temp\Files\c42b27e42760a1e1812ef9db5f9abb3424c5f9fb5390b006b0a39f6b28cc259c.exe"3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\7169.exeC:\Users\Admin\AppData\Local\Temp\7169.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\q9s5meceg5735_1.exe/suac3⤵
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\SysWOW64\regedit.exe"4⤵
- Runs regedit.exe
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /SC ONLOGON /TN "Windows Update Check - 0x1BB70478" /TR "C:\PROGRA~3\JAVAUP~1\Q9S5ME~1.EXE" /RL HIGHEST4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\785C.exeC:\Users\Admin\AppData\Local\Temp\785C.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD538368601612714a437a3d89a95c8ac91
SHA16e719bb04a623b141c4726f2f5c71b7833419eac
SHA256ea36a9c8034cbea2a143c4ea91bc483bbe608c2dcabd6dba91a804a2f3e01a09
SHA5126f474881ea4fd95f4acdfc3619ac1153f91efbbc7840dd60be6b686577f1c0dc2bd36b5452d4f3e987e11491eaea6931db8cfbe905676ebc0059a940d5653712
-
Filesize
344B
MD58349d92c75cbbaa4b31f19a38647b312
SHA1464e57cccda3e933a416e2f5cd978e64836bda77
SHA25681b67977e46e4770a9e87835436f2a35debf074f9534228f3abcc44f31bbf46f
SHA5123eee29c1575bf3cf2eb0a5e23a691d812908950268c243da3b5dc212136dcde9ea650161a9da8525a1700d50ce6cd50dae37d2c596796ecb5f446a6a77b3bb70
-
Filesize
96KB
MD5bd4c39c73ebb1958e75aae2c605c056d
SHA196ccfbe44ed6ee2374e25b3b022c0154da9adea8
SHA25694416103d53f33e1860567a4ecc3aa81add7439b1caf676c56ba7c2d9099ab01
SHA51261eeb1fcc77aa50c395308da67c8300934b627e6ac5fb15567876ab86a78de3d3aafd8481b6d8350c1cdbeb71d2a1d618ed25eae18262b4e2692a7ddaea34d95
-
Filesize
92KB
MD5466b29d280dcdffa55451031921958ce
SHA17d80acc9ed98fe8a699520ac1678889dc9710b1b
SHA2565da619cd850f359b0da2c53a53fea1e81f78051234d6840fcb1e8d6eb11c1588
SHA512a5028ea5a9612dea45671087e10d5666b7a142902676ffd9cc5142e9a8fdf4ec8af82279963dbcd9c15319beb6e21051fe1de3192eb5a1090881b2de65ca4798
-
Filesize
7KB
MD5d56ab6d2d36708b0b9e3c91c406b1fd7
SHA1d7fb8aed71d2bb9cf85e4dac8a815ceaea68c66f
SHA2566cd6513045f27f0827642b05123bf5c08af6b055b0d1ae0d999f05293d0e85b4
SHA51258f5c76fa9257324deb6849c86e715ae5fb416c248b8648404a9ecb989e2d70a739bcaa41902943e001cbc75f5233619e2f95b3ad8430a002d56b2914a07d748
-
Filesize
99KB
MD506707ba6a5c77fb4b47c74167bba877b
SHA14168c3b548a665ff5abbb7e8047922329358ddb5
SHA2562f1591e937e951e7ea6992e9c9e3449ae4c88a054e7a618066cbdd1fbc4f500a
SHA512aec887be1b9c92d66c86b984f4bcf28d0758a1abb48fe4ec252c309818ec7a7c75a96f18b14c3cf65ec0c006e494a8628e45c31c18371d669319c1b3b7173d94
-
Filesize
33KB
MD5177a7366a2001ad55ab85e5bbaf7bc57
SHA1bef2426b26abe8c2523feafba523df0e12ace887
SHA256d2380b66ecc30b590efbd5763df30c25983cce36c0d9eab7d72bca5cdb6d0733
SHA512083c4f103ed711a2e163244ef620c734d5c801df534f577c3dc30c85aa9dcdde0a54ba7d401ce28e733b03a754d645bb99f178048e99971ca6d31df3b72a70ff
-
Filesize
111KB
MD55992208ff18b564428ee583202667d44
SHA139954097da8d7c5641ebc0b07417ff73cfce4d5b
SHA2560b367778d91a54d1bd182a5602086c1ee357ca0c63066a7e54a456ea8870d28f
SHA512574ec9071d7b9e711b5f94fbf59e1e9224ef1016b9fa9863d4d6fcdd08afc4ccffbc1efdf612f292e29ce60b15a276aba69433cbee0c2f93af930bbe9a09158c
-
Filesize
381KB
MD52f87f3e40f5a3acf839745930a92c18c
SHA1ad031482e0a7ea313ca724b4d4b88e21b74af2ee
SHA25693739c8dffcac7acef39833a8cd3b7da8252209997213d09b559444a459507c3
SHA512950d6e9aa441152efee321b56ed7e5d87908df15e9b140ec3f4a966dd55c750217fed0ae2f93ed96fefedc0b6f68cbb3a795bcf1e45f93a7511d3356cda872ec
-
Filesize
56KB
MD597e8176d875adf30d317d4f7d123dd7e
SHA135be6c85f86f8f3f44913fd744549a2f93aa3cbf
SHA256a52a70c7f00e5e0aaad1be187d6c5d4883c7e02e0db8ef1b167b372cabee6d98
SHA512d8c5d9f5505f00d9f44e2f28df80cef46bc85782d1922b071dea67f12ea1b95b7a8bf16ac386bcb5f616528e3bf3fe294ab1abc0385607ed7a693ecaf94b32a4
-
Filesize
16KB
MD59dc44de2f057b90694f26e91b80ac251
SHA1bb2f3168e2abb424d955ce01c1e4aca0b204fb04
SHA256152677598694ec68c01d270de55159790d2a5419f659bcf9e45524bfac782a02
SHA512299032f204fc344443151e776c2a42a79b0f90e842b53a9a14669573de9d265de81ef38c96577ba08575075df690ecda5f2fa41f725b25c7df79001186a69af2
-
Filesize
44KB
MD55cdbd1ae1736acfb68f40655e5fd8e77
SHA1b670f6524f726c164786368640773d967fb7a53d
SHA256fae8c7215e26c21f2105a494604cf595b65571a6512a43fc52ca581aabf6299c
SHA5121be7afb406345b9c1a875de56f542749008e350b2816dd96e09f9038ffb703ca40a1d537dab672bd51ec9f9e25224858b063e8c7a07d24513a6b57107732b334
-
Filesize
92KB
MD50ba8fcb4aa2286beacdec2c1a690cb46
SHA1de48ad5787d3bda34d335d02591d28ccf72c2ed7
SHA2562721c2c60bea8a03b45259e2c4a69cf0fe9d3da43faea0131d4f81cd1fed7742
SHA5124f197b0b3c6e20b49a072396432b1752631a9c3bc98682994f1286c73b60a4befc991918a718c086bc737bd2f4fcf606ca522fed863c983237d7c156c16c1ae1
-
Filesize
481KB
MD59f6bd7bd7dedcdbaa66697ef5a486224
SHA187abe850e6730eedbe6edbde2e3b5ddd595898b0
SHA256689fe142de28b091fe6047706a435a5b5ef5662a62f0ee2268bff7bad4a17cb8
SHA512c8ff12318b27dd43d951bb04a5f0b23f78933a309dad2e4b130adcf8335bc130adea709130e6ca9b7d2b0e435a62dd78526511f918e440bea2b505b358491ca6
-
Filesize
1.7MB
-
Filesize
856KB
-
Filesize
32KB
-
Filesize
88KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
52KB
-
Filesize
372KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
408KB
-
Filesize
24KB
-
Filesize
408KB
-
Filesize
48KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
408KB
-
Filesize
4KB
-
Filesize
408KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
48KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
1.5MB
-
Filesize
24KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1024KB
-
Filesize
112KB
-
Filesize
2.2MB
-
Filesize
24KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
48KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
36KB
-
Filesize
88KB
-
Filesize
408KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
32KB
-
Filesize
6.9MB
-
Filesize
24KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
24KB
-
Filesize
784KB
-
Filesize
32KB
-
Filesize
48KB
-
Filesize
892KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
1024KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
856KB
-
Filesize
1.7MB
-
Filesize
892KB
-
Filesize
5.6MB
-
Filesize
5.6MB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
36KB
-
Filesize
256KB
-
Filesize
216KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
6.9MB
-
Filesize
160KB
-
Filesize
784KB
-
Filesize
6.9MB
-
Filesize
784KB
-
Filesize
256KB