Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

7f62eacbed...e6.exe

windows7-x64

7

7f62eacbed...e6.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    29/01/2024, 08:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7f62eacbed03b316b54ff9517cc6a6e6.exe

  • Size

    387KB

  • MD5

    7f62eacbed03b316b54ff9517cc6a6e6

  • SHA1

    83e4d9ca2f106f1f041356471d61d9c65471524b

  • SHA256

    1669808ca521ef56f7e6330e6659d39527549fc159c2759013d071d312739f7e

  • SHA512

    840e282303389ca21b8d6986ff0cb5a3f3161d07f2765ed74cb61fad9a28a829ef7ca4e2a15f4fde694c756f7ff6d947d17e223cdbd5b3dad69d28c0d5fa9b44

  • SSDEEP

    6144:gjvcZxfcc6Nwt9sU2gck8F9CusGnmuP+CQLkFte4xkCX0tVtMZ2pIaWjTG:gbcPfc7/ZOQ9pnmuSLAQ4mCX0xBInu

Score
7/10
persistenceupx

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7f62eacbed03b316b54ff9517cc6a6e6.exe
    "C:\Users\Admin\AppData\Local\Temp\7f62eacbed03b316b54ff9517cc6a6e6.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1212
    • C:\ProgramData\mM01803MoJlP01803\mM01803MoJlP01803.exe
      "C:\ProgramData\mM01803MoJlP01803\mM01803MoJlP01803.exe" "C:\Users\Admin\AppData\Local\Temp\7f62eacbed03b316b54ff9517cc6a6e6.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies Internet Explorer settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2692

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mM01803MoJlP01803\mM01803MoJlP01803
    Filesize

    192B

    MD5

    8b1998e5c5174632d531eac30d782f04

    SHA1

    aca759611d6864ceb2ac9a256614ce8e1ccf0b3e

    SHA256

    19207480a25c981469e422afe988d1d0d1f57cc0d940523a5d9c204ce419941b

    SHA512

    1628d8a91e9c7b234a8d3ee299388f08b284896f461a133e2d87c90333f9ac801dd47790f127ab7be0520f26f31e7e488021672b7f1a2d1a4433cd078d894c4a

    Download Submit

  • C:\ProgramData\mM01803MoJlP01803\mM01803MoJlP01803.exe
    Filesize

    285KB

    MD5

    cc567c32edaf9e4a72bf3dcdce1711a8

    SHA1

    801c71caa213cd2111be82bb66ce05fb3f9e696b

    SHA256

    2572c684f914a40595b2d5a87287da9bb1f07a9c5f51883c5e092d0b242142b3

    SHA512

    7e1d36b4a1ea9684075837fb707f170de748b8e64fd07815d9f08f43a2cc07378f6798550b908d064c818dbe1fd2f62abd0d9ef9b517f9b918fce7ca937e1959

    Download Submit

  • \ProgramData\mM01803MoJlP01803\mM01803MoJlP01803.exe
    Filesize

    387KB

    MD5

    7fd352d049e161c5a9b992d8f44e791d

    SHA1

    697c302e053366e029060309964d3bd55e0a9c84

    SHA256

    ff79ae76799ca1e140c1a2ea3c7756d55c1fa2531b60fe0c889b0446e9b2651f

    SHA512

    00be9c477933ced3b766d160b4d17222ffcef28b347218c2d849e44a5600665cc6f1a1e8900b9afd295dbcde29f4b32ddcffbe80ee6675394cbc40eeb50da5e0

    Download Submit

  • memory/1212-0-0x00000000001C0000-0x00000000001C3000-memory.dmp

    Filesize

    12KB

    Download

  • memory/1212-1-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download

  • memory/1212-16-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download

  • memory/2692-23-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download

  • memory/2692-27-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download

  • memory/2692-36-0x0000000000400000-0x00000000004C0000-memory.dmp

    Filesize

    768KB

    Download