Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    92s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/01/2024, 15:45

General

  • Target

    7d5e096cc914cfdb84b8ed6e4df10ceb.exe

  • Size

    165KB

  • MD5

    7d5e096cc914cfdb84b8ed6e4df10ceb

  • SHA1

    bc87f3c769e4b9a7d87146d2e61ec6bfb22793f3

  • SHA256

    1395d70cf9785445d82091f8415b56e29ba9d5be89563dff4aadc0dafc6be808

  • SHA512

    d0752221f7a218078550843179cc8d9ca8ba107eb236a40614e54f6c2dc51e64c162b83feab219e3a6366b4fde3eb74e0a80ae239cce6ed77afc99745ad24e51

  • SSDEEP

    3072:o5BuYAVrgUCPnNl5WMixBBJUtgHggM0BoEAQsDRP600F+219V7gg:o50gUCRWM4BUWuZhDRPRG+a9Vt

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 13 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d5e096cc914cfdb84b8ed6e4df10ceb.exe
    "C:\Users\Admin\AppData\Local\Temp\7d5e096cc914cfdb84b8ed6e4df10ceb.exe"
    1⤵
    • Loads dropped DLL
    PID:4784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nss5B5F.tmp\extra.dll

    Filesize

    32KB

    MD5

    ab83fde15027576dd5cdcf98e51e16a4

    SHA1

    7ff782eac9ef49875e7b922f5aedcbaf796b808f

    SHA256

    cb6be9cbec2d166d3625ed511408ae0264581e03a9c8e0d1e895002025f6a9f3

    SHA512

    74317a5149b3f81e5e592a9bb4633a1ddeea49340c4996dda5d3487b1317b8e4623b0421215b02992b0e775c0f39b5f63a4c36602c3deb0155f80a7bd0282420

  • C:\Users\Admin\AppData\Local\Temp\nss5B5F.tmp\inetc.dll

    Filesize

    55KB

    MD5

    44c61e6da6cc91ca3435010640fd4e04

    SHA1

    2165fb1209a9ee7d8f11a416e08d78e022962d3c

    SHA256

    2ee5f911ba4d1aac8af16f7eef7dc69b7382e7c1998d06f1d5590785a42e5a93

    SHA512

    18e838d7f095eb5d8dc62f5d75486926dd4b254d03afef05e1e3bce6808fae73b7a46afbf1a1dd14dcf52f1883db6c4c7a9b5d5dbafdfa3c12dd9562b3ef5bcb

  • C:\Users\Admin\AppData\Local\Temp\nss5B5F.tmp\nsJSON.dll

    Filesize

    7KB

    MD5

    78b913fcd04259634a5e901c616e6074

    SHA1

    ad5e1c651851a1125bcad79b01ccdcfa45df4799

    SHA256

    e3ce60666bb88c2412615ef9f432ec24e219532dee5cc1c7aebc65ed9ec94d59

    SHA512

    cbe07179dd93011f3d9a8f83541961ff34fb83d96658ac82a433ef0aa3399b183eaec3e6a49ec1c1e478d1eada2d3ebc78ffb1ae0574984ae66a7a9cab5d59e5

  • C:\Users\Admin\AppData\Local\Temp\nss5B5F.tmp\sign.dll

    Filesize

    32KB

    MD5

    d30b6c8d2f38e6abbb2f39bac0808bc0

    SHA1

    f1bca6416ae0f4c52e5b076381c72b18472954d8

    SHA256

    1f2b4549129c1b98c5674fe363a0267376dfd623323c5815216043dfa7fe1f2a

    SHA512

    3bf03d839ffa04c1d5eeb89a6405820ab2eea3548050e730255df7e84dfc729157c0d5c7eceeead5e8e1f4aa23777fe78a5582f0772c85bf0f793dd245a887e8

  • memory/4784-61-0x0000000074BE0000-0x0000000074BF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-60-0x0000000074BE0000-0x0000000074BF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-59-0x0000000074BE0000-0x0000000074BF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-58-0x0000000074BE0000-0x0000000074BF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-54-0x0000000074DF0000-0x0000000074DFA000-memory.dmp

    Filesize

    40KB

  • memory/4784-51-0x0000000074DE0000-0x0000000074DF7000-memory.dmp

    Filesize

    92KB

  • memory/4784-42-0x0000000074DE0000-0x0000000074DF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-63-0x0000000074BE0000-0x0000000074BF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-16-0x0000000074DE0000-0x0000000074DF7000-memory.dmp

    Filesize

    92KB

  • memory/4784-15-0x0000000074DE0000-0x0000000074DF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-5-0x0000000074DE0000-0x0000000074DF8000-memory.dmp

    Filesize

    96KB

  • memory/4784-77-0x0000000074DE0000-0x0000000074DE8000-memory.dmp

    Filesize

    32KB