Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    130s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 15:33

General

  • Target

    7a9d8452bd42b564f5d7f002800e2f16.exe

  • Size

    13KB

  • MD5

    7a9d8452bd42b564f5d7f002800e2f16

  • SHA1

    bc9f331365078095baf8d5c5a0351127d9d28acd

  • SHA256

    9db76a27ef225c7f3128d2fb0da7960e72f14d7402b4727111c1c406b0234edc

  • SHA512

    740bdb976183e100122ae13cf73887c4fba27bc9c59fb4e6d30491369f4072d116a8fbf6b841028959292358215289e007e416ecb95366dd31499b2ba0ca42ca

  • SSDEEP

    192:Lu5POEuXky9UAMG5Twv7E6wVU2D5r9ZCspE+TMwrRmK+vhOrRn:0uXkymAMCo7Nw2TeM4mI

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a9d8452bd42b564f5d7f002800e2f16.exe
    "C:\Users\Admin\AppData\Local\Temp\7a9d8452bd42b564f5d7f002800e2f16.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://ads.eorezo.com/cgi-bin/advert/getads?did=433
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2484
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2484 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fd42ed205c23fce00171486293d2718e

    SHA1

    82ee7e107d97e4299ea81046e2003376a9e197bc

    SHA256

    6e54c3bfdeca60a11b9d3074d8298807bfd60a7a1c05bf32c5ec03c5e55ea487

    SHA512

    60c3ddf96a1eee5b2052bb38019063c3ab056c6798858daf42383da5b19747a45fd46f74fecf61a2fc1b9706749dcc5bacab1433c85b5b8503c5a5d813068656

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b489748f195ccd044e33298fc8188c9f

    SHA1

    d8554609ec85330bc54d9a00362ba20040564fa1

    SHA256

    6cf9e4161bee593aa108fa0eb043ee96a3a9f2a5d04ac7ff3f7d782bf78826be

    SHA512

    84cc4648b37d62db7b3fde6e110dbdce117b2c9d66ebdb27d3dc8008bf08ede90de3fd2ac5e9932ef26978455f69f2258209c1c7a9f93cbb70df2fed107af3d6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7f40e32b491d86351e808f400a398864

    SHA1

    10ed63cfe754cab44322bd33d65265348661b1e2

    SHA256

    1774047aa51fbbe7742eab4595b7ef8ff4b7b5a5e2e4c1a1bbaa092edc4cea0b

    SHA512

    6b80506b29846c12d916101d4cedf6138d411f4c63bb631fa696dfdeb18a32058d87b473fdef82a8ce9da20a59be0d3fe6fa9042c7110cf74d5adf84a3a0d059

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    134d6ceca91acc56cbecfc4aa4020f4f

    SHA1

    93f6dcd82e248b87f2608e30a8b2a616af397425

    SHA256

    8dda29027dc585ec9055f94203b63e96f8eec1172a7442fdf71c1f4aa70c57d9

    SHA512

    7dee54d19fc6d48bae0cb133dcccceaa168825c144da7d52fe1c47572ef0381ff611e0ae7d707b1a512df10c86f0da6fca4ea41dcb5f1fa6676f5a646032de6c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    de51b8b0d2d20c912932c8b960b5aa06

    SHA1

    52950c9bfa16c4f9e0811f8c9d0361aaa7c874b7

    SHA256

    344615cec0571e2498a12c1c0b8113e15164a19c62ac6b7cb3e3777113e758b2

    SHA512

    7db0bc5daabae4adba7693631f24b277c7b478f80601a63279204f23d23ef290c422cacc76f3df4940d740bef7b23da274ed0a840d9ba5d4049819afb54c23c7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0619d3fb4e3ebafe5caf656fd0190730

    SHA1

    ba5bf8f95ad192031c8edb4c1fa83d9da8e6dc7e

    SHA256

    71b3febbdf41625fff08ccc216e0625623ef6dc69d779debcc8e8fa128adfb7d

    SHA512

    ef95b5d7c136f2c67c944903e134819980063902257db2f22d82aef88b234168b3fb3c454d65da5126887e2b2b10276e9a024643b2fc0a16413153c313d09ee1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    644a4dd1be161837ccf85b3749a02d85

    SHA1

    f203f915104c818f1189a7fda7692d40aa5eb20d

    SHA256

    bf74de98df12676ab5d40e941880d9d0cb56d86847ff360578fdb96fa9e5259d

    SHA512

    aa26f17ce910c49ac1c9c88b1bd322a20a9b6bea5b8cbe435adaa036ca20f992e0d4bcb8c915548e71ff86b5f04231cffaaacd5cb046f0f33fa83fc0abcfcfb5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    522527c02021fee1251cb421993e905a

    SHA1

    1a71b121deac9db677687cd396dcfacb2c19ea2b

    SHA256

    eedb14f4d01d1c96070b993173191356c69d07e1f3931bec14e7e5ad96b17e32

    SHA512

    3962cddcbe8233883e1abe31b2a508a02c3dfdfd31ec488d5823fc4fcb9289b41eb9aebc77899e334d81659db5591c38dc60d7f4c32b6bd80c595fa2b3dff5d0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4eca1fc1834ee09545f54659aff39d36

    SHA1

    6c6fd98839f61808777f083cce033e3c7d18bae7

    SHA256

    72f565282ef48bccabd18ee439409cb7c965e7a2ac6454cc1690b032e33956d1

    SHA512

    72407f91e8b55a08ef23e73b852007dcb474eadf6517ec220b5e8cb844b067202b41d8665f00d5cb1b7871cba0f77a42a8bc574ecdfede9341f72806ddef0e3a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    28e33aa0f317f4102602e8fde166ba2a

    SHA1

    b26199e90f86ffe1e7b46a7112abaf747b9342ae

    SHA256

    478a76ba293f73ba89542b1745b3eb4233759e4e90a2e8f50ca45d2251414a86

    SHA512

    162118c0cafde87a61263ab7293fd173a5fd84c9f8f9929c788f1a7b6996aace82acce3799cd4128297ac44e3d6fd84c1939a75bd32cd5a87447aff92b37f341

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    12cd30dccc61fe41587caf0ae633a09c

    SHA1

    48ce6621366b1a2613673170cc949f58683dd282

    SHA256

    4e698fb24c97fa2a3374f9feb4c41d0a05b216a7bf33d72f2b845ffb983fe385

    SHA512

    45aa6edd2f46013be8bb3a24e0f762fa65e30395efef6edbe91abfa4fac2d85f41ca8a3d1fb9f9b2302c804d31b2678a4da608415d4e069934e0e4752555ef90

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    09cec15ff1d482e1c62f775e73ff7987

    SHA1

    82b6b1be2fd41d45558517420d52ac0682458c38

    SHA256

    5298d1b854a36855633fe47de39e799f27da856d7494ea5c70bf5aae1c7eee9d

    SHA512

    a413bfcba6a0cfe8c77ebd6b741aba50b8a4cb2168829c625c39fcacaf543bf2af3fc4517031fd711d88ca946fdb324c21d43fc33cb81291e828e2127e33ecf0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f1765b7a57003ff0833f0d9fec0a0a34

    SHA1

    77f949211e404e32310d54c126ced0e580b91313

    SHA256

    845896d4c060f457e9e3d309f548262efed423dc81bc2a8547cff37266644bdc

    SHA512

    37ad1f11863c97cb6bc6d8d172c1a67f4c02c68ce10cc2e27bc199b53ce9efdbec1c0b0045745f6a5379bea1d57a085aef78c2a498a4f899912d38a530c09a7f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    6d16b956925f509f3f0dd6c46a97cd36

    SHA1

    ccebc042f51accf86d44ee8b4aa9eb52b070adcf

    SHA256

    7e6ea2a0ead73f71be9b0c5f9d8d9ac5c0a6bd43f1c180449b95f87ac551103e

    SHA512

    c0e13224c2d7fc9fe77577545d2c61a2d26deafac2cdc37a367588ee0d8a1297d600641cd835f896c47f009632274fa6c1b514db410675131d061f3e9f32867d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bb5d1383801c4fccd377c6efa41ba150

    SHA1

    5fededa1a836cb25599f5b7044eeeabf73210186

    SHA256

    7c47a7f83c09a23a573abe007c37cea6f2df680e9aba00944ab0315b516504cf

    SHA512

    2c2ca2b73df4870401abef4d7639b84e37b7e8ef31cb0e785ed3dfbca78d50de68f56281ea030fa55874d472ae952f9a6c3ddb30833c6c9f2434a29f12ed3946

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c7e50c2560d4c622b8297fb1ed248f46

    SHA1

    4b2416f6ac618549308b59d4d846edcae96ed6e7

    SHA256

    f08d1a69964efdf505e16962fb4a64e18df8d3f46f010266c0334ddaeed3f109

    SHA512

    a028bc1e68ab84ff29dd1f9a6be5fd73fb97252532a5c7853e7f48352e1740dc2a9878d5d18a1071df1c19ab0e5456ca0e653e265704f051ded0899ac41ef047

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    ceb292ca075aaeb21ef76d4586576f0f

    SHA1

    2ed1c1add41d562a6c7d34544b33e904f65ba207

    SHA256

    a4394973f901686a9100f1999c7a8ad34f3de3f0372b7e960429c0718459fd4f

    SHA512

    9f2671526dac26bb07a9aa71280917c67e5c7746e91be145a5e1622a7f34c97f661696ba518d3965cb9d5e25dac16450349ba97926e940c1d02cf66d8aacb469

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    3e94d256f7a9666637b7031d9445c228

    SHA1

    9e2f839f8568053402644bdf19ed763f0e540101

    SHA256

    31cfcc8f2e3b019fa307d4fe95413c75c1845453eac220b52af0f4a3fcede966

    SHA512

    03f2eb9dab940850c460bf0427ac4a84492693dcae08d14816fc18476a8a38136017b10757363ac5f1ad79a3cc9794742f2b5e5eb3d0b927e2616891e107c262

  • C:\Users\Admin\AppData\Local\Temp\Cab33DE.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar34AD.tmp

    Filesize

    171KB

    MD5

    9c0c641c06238516f27941aa1166d427

    SHA1

    64cd549fb8cf014fcd9312aa7a5b023847b6c977

    SHA256

    4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

    SHA512

    936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

  • memory/2364-1-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2364-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB