Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
13/01/2024, 04:45
General
-
Target
5803d10dba05acbc6c83bdc63a991933.exe
-
Size
321KB
-
MD5
5803d10dba05acbc6c83bdc63a991933
-
SHA1
1fda4366dac7efc1b2604a08871a418a0be47f21
-
SHA256
6b604235eafe60490fce7854ae5391b2e0e3157e9db42262a92e4573c8b4e657
-
SHA512
f65e1d16bd849c32689c3d5857bdc63315ce0df64c913569cf2ba894eddc3d256561b00992338b8cdf58116be2f820f716263f8b3461104f54142229660eea98
-
SSDEEP
6144:36YajbofxCvXQhHLwiVwkI4aZoOg43LiyIlm0kz2taotsoeOXXKx:xWPu8ibI4aSOg4O1taotsoeOXXKx
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
UPX packed file 23 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 6 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 8 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5803d10dba05acbc6c83bdc63a991933.exe"C:\Users\Admin\AppData\Local\Temp\5803d10dba05acbc6c83bdc63a991933.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\rinst.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Lagger.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\Lagger.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\spk.exeC:\Windows\system32\spk.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD53a77583b727102f607a09887b8ec63f8
SHA1b0c49f6ec5804d2901b4cb2153d9a792b2313ff6
SHA256a998e6006c6a2b8115c237df5e372c161d5bb5520f33706c8aa8b9cdad1811ca
SHA512d55c44bb119cbedc99546d5d2b1da9b53cc1feff1ff74327f2badb698b165465f95a0e569e9d069375061a965aa2eb96ed7ca3e52e24364d0c2a9e6625f902c3
-
Filesize
964B
MD56e8a97a13a5354287695a8c3557444a4
SHA13549d293aaef82428edc4e6c7ff3a92119286722
SHA256ba78732a606c9b738bcaeba437f185fe89111d7da2f476b87094d516b415ef3e
SHA512814f5fa13e8cdf215c4d3a07b566fa4b9fcb95dd7ccb480ea0e515b9ca2e297e77a581d9980c0817ed5b3106613204b58deda46adccfd138f0a91768a827bade
-
Filesize
3KB
MD5321f3d62e732b5af058577db2963ae78
SHA17fd4546ffdacd2c3672623ae460019c74b86d5a2
SHA256f5c9b6f55bd437cd94e340f7b01e1a3a4f03321f73b7d7bb4a9821db6ca0de40
SHA5121660ff45166d476336c4c662850579e773c38764feb2d68a9898a60a9849611cd7cc7d28d07bb1b7d169307a683831b38b2f3624bab27a3036779ace5509f030
-
Filesize
7KB
MD524f3e464fef5452377b580f3c087304d
SHA19ce0c9babc8b2a23d31aa24aad5fef8a763b3484
SHA2560abb07381e293e021b8d2e185feffdc9a66addf503561ad71576b1ee924d8d6a
SHA51245caa8ce639e9248821c72268db83a43c6de7b1be3eec4823e19ff4f31b5da5f8c353854bba392980391cbdb69acbe0c546e531e7950dcd8fdbfd67ae74d458e
-
Filesize
213KB
MD5a392b38b05fda8a4c43283eb6a78fcc1
SHA1ed9b6ed983bd6706e5af7833c7a42f389970aebe
SHA256112b017583aa7f61ed5c651c304bb6d22948dcd93f2d1a09d648c76bc4c6a492
SHA512c4969978d8bec385ba5614ee6ca92b0e427ea7a766d296ee7a5bd3f739cdda17876ab9f87089e98359b5e81b804d68c13800008853ab9fec4f093c8e85155d93
-
Filesize
19KB
MD522193f3140cf0ad1adf6461c00e337c4
SHA129e2746738a4c82b05291ed0f7b306c02660f2fb
SHA256f78c156a8a76fb11c479fcbe94a7a599812c34ce71ddea5ed4d0cc9c8f42a690
SHA5129b05d3e91dacd93355adfb92271e67535f1fd7e7211f9c2c7bf1c1030aab235447b16a5e6f01659812f353bce56ec0bd610a9bc960b8a6ae81577c93c5a26170
-
Filesize
3KB
MD5d2df04d0189de76ab5922edaa7122e4d
SHA170cf07378dc4aa1eeeb5fefd25df14e97166f8fb
SHA25691d3affb4ce756b39f3a3a7c32ddda60f235773bf8f9f1b3dfc228ad10666128
SHA5120c348f587e5d15885995e994e85d357e8e444ad815b369b845bf9aa8333be5ab040565d3948011794c9c444e717b0b93531c3ec13ecab7588220d1aca8fbb7a8
-
Filesize
213KB
MD5d0572ddefa42687cf903a123500faf20
SHA1f154692f339a4d4d24257e57afdb85d2466c88c7
SHA256d506c74a96796a530f974a7e2337707e9da18f201e12f2539ecf12f4dd098221
SHA512e594b07f5d1a9b03f9878db333aa85fae79e9b9e840c093b23c97840b25a062969deb5baa312dabd979c32a363c6a37c7fbe661135b7766fc0e26ad9cf1296f5
-
Filesize
19KB
MD509e08e10336e8652ae19ade8f18c3893
SHA17bdb749cbb45a1532d00ef08426a667dc11b7d0b
SHA25672a81a5179271a1f7a7da748ef5e2b53edc955efff690126f50856dd2befc65b
SHA512248b10a00890dd7624446749263adac9c6674b25b433b10153fdd47e018734bd97705e50aba1813759ba622242e4f1a840038e6028dfd46c89319f9f2b7b7752
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
524KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
88KB
-
Filesize
88KB
-
Filesize
112KB
-
Filesize
112KB