Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    04/02/2024, 07:49

General

  • Target

    8e9b394b01d854a10be29b8262b77a35.exe

  • Size

    115KB

  • MD5

    8e9b394b01d854a10be29b8262b77a35

  • SHA1

    976fa59b63013990c320a004c565205ea72aef8c

  • SHA256

    27c4650d8cec72981916ee82a3750c37bbb9b9fcbad29ce8f178cabe19511c33

  • SHA512

    34d031e4371bc3405dd73bd6d39ec2c85ad16aadf605326f603ae8caef76dc7406d8435824efbac0b93a7499c057106aa4560ac55408c58131551ef451e9be32

  • SSDEEP

    3072:cACwB+eDGHq91uu2WaAKFw4NynxtJDukdzEz4:cACwj989wlxtJCI

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e9b394b01d854a10be29b8262b77a35.exe
    "C:\Users\Admin\AppData\Local\Temp\8e9b394b01d854a10be29b8262b77a35.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1720
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://netcard.com.br/
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2836
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2836 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2000
    • C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\mrxboa.tmp, Setup
      2⤵
        PID:1812

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      914B

      MD5

      e4a68ac854ac5242460afd72481b2a44

      SHA1

      df3c24f9bfd666761b268073fe06d1cc8d4f82a4

      SHA256

      cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

      SHA512

      5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

      Filesize

      252B

      MD5

      4a76041f6eb0884b492a28ba0424ec91

      SHA1

      611697ae07c42bd6e464029d83e42e7bd00adb76

      SHA256

      ca8086daebb5f4077f0285fa7d6c40d229e698efb14d214d442431b1fe42e1ad

      SHA512

      11d0b80001dbf5c666d0628e3a019f3147701e4ea3687ff977640344dacf401614aa7475ec38e1793895fca2a586f04e645e2d8b2ded518bbd8027b6b6c5f2eb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      10523cb9dea604f8f70552c48e3ddb19

      SHA1

      a3b281c23b82df84a3258c2a3c8244151afc3f90

      SHA256

      1e20023dae733ae485bb83b6e9175edf9166550b374e5333c58326b03ff2b349

      SHA512

      c9db8859a59ff47b6beb6b442000d57727b8267dd06b0f297073fc08101493d3221e168066062fa43fe20f292f6ca33ba2b01c7a3360fd9d59051901b1988128

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a15944b3b8559c6f82f86227541edb87

      SHA1

      428fc783689bed45ec6861de9db8c27c58de34bb

      SHA256

      f1bc494b53a37abc37dcb23b435afc368bd2b0a2f4f38558ebf92ce1f8ad8909

      SHA512

      3ffca9d33965ba78776444d8988f780cd0a477603e95ce5dad0abf48bc93821b366fd214e7c2d06ac89df884fb5d9b2af73e3b8bf41433a7ea64f555a31c4928

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b97bf206b457a34923de89e8043f8e2c

      SHA1

      5af64a03768c573ff22a72444e5305be7c203d69

      SHA256

      b5ae7ebbf40e817bde5fb3d93c0ce597d4582c25fd76e897856716dbb3adf744

      SHA512

      57d031c14b0ca5133a60b0877fd28b6431a9ac7bd08a11800cbe6e55ae868f1ff0ca305351e288e6610c032baec28a5d9dcd18a049503680277bce3ecc48e76e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9b84cd3cc05e8d46b53e540fa6968204

      SHA1

      dfca3381a806c7e6647598aa0759907f1d743333

      SHA256

      5a720c08af77e6601c57a50046825b271459955731585205e8c68af851d8c8e6

      SHA512

      11434daf0c2ddb41618dac02432607b3242393c672cc139a73dbc659d12b61a7f23a6cdae282808b06fb122d64953258d05bf3b066eabf282ba46b8fa909ac8a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      9f5d84c17d39323d148eb147dcdf9585

      SHA1

      0aa1ee3fd5b2276225f25b7d3446dd95cc351ec1

      SHA256

      e2b2889ff3f34b62f59b435f4c433b10a95b60fa328d3dbe182ba809ab4aa61b

      SHA512

      ca9dbeda2efc5491371422dc2cad7d97a8b409f5e22da435f7aa07887e89e8c12fd5db6b835984ed3f9b72751b8169a7b45225bbcf0ebc5d9e3c4072a7d889fa

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b25e9ca26299fe636efb34cff1175f14

      SHA1

      a39027a1e12ecf4d3c65ded64359133fbf898f9a

      SHA256

      cb91ba31fa7752681e1c12f425e6806aa7458c48b3dfd65fa988275fc2792c2c

      SHA512

      01094c2823a43089c1c465b73e8e41a1db0c86849de66f773834e10d57849a648289fc8caab13656ac253856e8813a85ddcf6a7d2a114af52efd53c2fe51ecaf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      a153cd0d82871c37232ef330b232c653

      SHA1

      b6197c0936f6191abde73d30d9e955094ae6a61e

      SHA256

      bea39d943bd43c48ea4e54d5c8db810ac3161968ab094ded37fd7d813a7f0227

      SHA512

      05c3a17a5cd2d39fc91180525d3bf4f7d89b1f0fd77ab9bfc86eaf1c38b3a0494a72efc2fce6a12b3badf12874c747839da6b08e995b87d25fadade8e26fe58d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      224e2ba45ec84c6e0b238ca2430154ee

      SHA1

      dbb4087e851b732388f0a6d412b112a5663e301a

      SHA256

      5f36e31bdac8e9ba7c41e59271765e9518fec15e8def1f94685f8ab203eb818c

      SHA512

      6d8ffa4cd8876d02b27ebfb3a7dc82f2a5964b58c7ac047785a42a5412b6ef02aa343d8b80d2b310e62451778ddc7bfe84ca95c42c8ce775f24c8b90e125c8ef

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      5fb56586ab8a63bbb0a81e4b523697cf

      SHA1

      0618539640a14764b21ac3ba2a2187c84484eea7

      SHA256

      a68af81a8b7666b69a8ef0c131179cc98425e2586e9bc5306d84cfc789989403

      SHA512

      9d94b095f35fd5215d221182a95397c8838b604793a497a43b94d897894038a2c8b144412ec42682da40a41644417df077936d839efe448c3e7a5bec2ef342b7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      15dd6671e63c5dcadaf0c6bf93ece9c3

      SHA1

      a86c8fe81283c2baef577a803668c1a18c348c98

      SHA256

      877aab85f00db0021b788cbd6bc9ed4aca90b52ae9f7f445c169b7e0c182e81c

      SHA512

      392342777894a4c86889e2410df270e8bee5103fa10052bd187d8270ea58d6ec40f138426655b6019acb13a045800587d524d3f3119e0b519dd695f3636bf50b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      659fdd354a7bcb913b1abd88e03d0baf

      SHA1

      d881268dacd152c9d551adecba2ba768c0324927

      SHA256

      95dff2ed8a16867947e19a69c7ff0bf664c457d47435728d0ee1a6317bf46c1c

      SHA512

      2d55a0c707b2c9bd244ed64ca74b553ed8a4946d47a667e585fc3e474093816b7235c6888ea02701ad8f363bedfa121d6cbb365265efee4f5f395b94516cb938

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      c9596d5b2e013115baf9b9fe5d63a386

      SHA1

      ddab133dc0ff2675322e052e171680c7694c7ca1

      SHA256

      3cb95ac15759529b0809fa6d6890f41ab2b9d0bdb11b5a3551cacde6e64f50a5

      SHA512

      0a7c8c83dd9e5e5fa0d978faa01237b2949f031cdb9f548c8001ab11a859793477339e92ec0bcf861e8c3436e754e58605de3a911f2f6a471c25d27bb981a7d9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      e70b856170371e5bccabed4724fdad8e

      SHA1

      81762f764b889f73ed22d1738931c180c59af5eb

      SHA256

      338cd709f9bc5ed4410b7c790f079a2981b29cfb1af702606c9e7675af5fed81

      SHA512

      b8ad232c2e0b72fbba5a70b4e36fc1eaa0077bdb31b2c960a01eab15cfd399e9583d03f2192f261c648c688e78bc0b2277bff90d5f651b0104728a7cbda4e191

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      068ad0769d1373cd98a6ee445bfd0095

      SHA1

      821b30b0fecd644b8ab3b5e8c16725c46795d01a

      SHA256

      eaeb3bae2f8501ad80bf6ba84b8cb57ab91097812bc49f9f5bb027cc5d978aa1

      SHA512

      e562d97b9d98a157b25f316e80a2a1db265893ae736fa179efce0de40f9945e330bb68c53f7d527a5b8977fbedecece828ef29a2777d953f042e8fbba46481ec

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      b9bbaf1031723e45ed7035d396c2bfdd

      SHA1

      81e720561b99d41d783ab2ca5d16a37b9e267234

      SHA256

      ac8199a061a7c92159776ac469a03333beeb01a1b2c971e8928945b1360d86ec

      SHA512

      57eb7218f67e734b4982c72cbc437157e209b18cc26eebe64db5f7b2733e570c7348010319ccf6f41de830c7cad17f68c3b20877ef099166d1ec9945e0bc61b9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      56b13ddde4c9ee9eed4f9db8ada9b4fc

      SHA1

      333b6a5cd12a8e8037e5ce0fb40b34ce08918fc5

      SHA256

      2a4b55e139d77d5e3a434ed3302280770b293bdc1a48d34c0eb462c46ad5a6f8

      SHA512

      15d5daadf5b05ea4a27edfb0f8fd4eeb11eb1acf7fa4a6b529a11c9cf9d1e2a3787481bf22a6c31e62d412eb1d12cfe5569983fef7b30499d7ad5baad703378e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      05a715d6114642e309552398325769aa

      SHA1

      137325e1748a93309d88e4a8210817a518f78a75

      SHA256

      d3378c43b43c193679d8c1e4b2482499cc73e265dfa911265cc9a5c3aa2e73e3

      SHA512

      96de78a631d6cb4df649c79bdc0719b9fc8e7fd70d025319a2976ddfc6dbe2b6ea2a2a542b7c00e160aac5570a59075b37e54e0e472751adf8643b19a76c86cb

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      1e66f4a5329a5cbebc1abb8eadaa445f

      SHA1

      859481582ba3eec1815c86cd07752edbc7bfa478

      SHA256

      59f93b8949aa419ba6c1d80f5c3715adf1e28e969d471fbae0881a5710dec6f3

      SHA512

      ba4b11405f73eb1052156bbf3a62025291c930fc1c1c7c97f07512586af7654a4543a5b1f04926867e8e8499a2ea7b416432298b9b11cd1f4c767177130592b9

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      874f941d5a5cc1bad501d8fcf4c514e9

      SHA1

      bd52232a3d8f2a54cfad932fe678e565bcc8f750

      SHA256

      4ac38cf3f3aef7b7ecac6070d76fae19c2b4025e0cf1b72b407ad4d4385e826d

      SHA512

      b1f35409c2d4e01695d208a608c4766754162d335485ead32765d3a4a3a35d65b49469d3f1e33e49f8653b8c828243a38fe4a8f4b73bfe97d52b7652852c4234

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      33a21c289098862669810c1a9150ac2e

      SHA1

      142e95420a02a46ec398fb34795c54c98c00fb02

      SHA256

      5f27a895b418b37049c649695d272123c713be4982cbb0829b852361c0e0e19f

      SHA512

      1c5738cd9429f3f10789fb0b1f176da2b07d1d76b326c2416d0c2c99380b45ce5224c48d9a10a0b6f59219e2130f70855804ee50d43a7dbb84a269aad9280d53

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      344B

      MD5

      21e9a879cfac4f4aa9503d06152a0eb7

      SHA1

      b55b7364a761595899b3f6456ec3d764f1676529

      SHA256

      493e8ebb1515d20d534bb3327917944ee46c235c93b602a75da8c3e1d099240c

      SHA512

      7f56e31945891761cc147f33da05ea49282e26b99a703d681d33a13c39f4220786824bd8190063f461c7cf67ff27773d97aba320bb9535dbc250a0775094951e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA

      Filesize

      392B

      MD5

      d1960407b6b56db0f8c52fcd00293ea0

      SHA1

      2f695db31774aed1d02551a1b67e75b8d4c4734b

      SHA256

      347868d3acaae49b02a214f5603594d4d1da713c39b3af0cd430d01ba4ac0d2e

      SHA512

      dfc8b125fc3136d5aa47b166b35d0746073e4c48dd70c521e9ceab82d9c07572f8a7b42bb361d93169b157d5d6f2ecbc8d3a581085011274bcd5b19a2a0c1067

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      27576e8920dac4c896aad1ceb5f9f1f0

      SHA1

      4103c0c6e2123ebb31a6216200fe99647d5f86c4

      SHA256

      608ce13dfd2d1093725af193b55ecc6ac2ba3ec02bdd509773810e90a649b474

      SHA512

      339259404d007e8bc61f6580fc0412d79c1093f6c09ebf3c9b50649ded36d029fcd1bbce022718854aef60b3250d17e3098014ee1a525bf26870b18fa04e9343

    • C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\0ptx2pp\imagestore.dat

      Filesize

      15KB

      MD5

      d44c6819613d31a2ad5bc18dd67666c1

      SHA1

      02e78d46c5d1158956fa04929df6b3734491210e

      SHA256

      da7ca59e6dd2e928dc19e099eca0e6cf7adc5aedf42316f9e6390f42c36eab3f

      SHA512

      6b4cbdc65871b2f83aa8a06f610d1bc8a52559af81d81081804e86d0b7722de235535feb22022c88c64cb7137beb475cf121a16c296489b34eada928b5219b05

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\W79VKSP8\sedo_logo[1].png

      Filesize

      14KB

      MD5

      def00c11b1596db4efee6a9fbe64fc27

      SHA1

      bd298981e6d8d7e4ffa18abcf687041f4246672d

      SHA256

      95c427fa3143b1896faf42a6406686ce7602cb39052081bb32d12b51c9e047e4

      SHA512

      c056e95dbfa1aab3a50dff18c6d577dbffea72c93316ffc53b6b7aa41dcc7707a810d563894589a7305de0b76610f88150b2034670de368773b2b356f14ad30f

    • C:\Users\Admin\AppData\Local\Temp\CabBDB7.tmp

      Filesize

      65KB

      MD5

      ac05d27423a85adc1622c714f2cb6184

      SHA1

      b0fe2b1abddb97837ea0195be70ab2ff14d43198

      SHA256

      c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

      SHA512

      6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

    • C:\Users\Admin\AppData\Local\Temp\TarBDB8.tmp

      Filesize

      171KB

      MD5

      9c0c641c06238516f27941aa1166d427

      SHA1

      64cd549fb8cf014fcd9312aa7a5b023847b6c977

      SHA256

      4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

      SHA512

      936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

    • memory/1720-478-0x0000000000400000-0x000000000045D000-memory.dmp

      Filesize

      372KB

    • memory/1720-506-0x0000000000400000-0x000000000045D000-memory.dmp

      Filesize

      372KB

    • memory/1720-0-0x0000000000400000-0x000000000045D000-memory.dmp

      Filesize

      372KB