Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
84s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
-
submitted
21/02/2024, 21:33
General
-
Target
monkey.exe
-
Size
16.9MB
-
MD5
6fca5c6084425f00c88e9d0abf0bf0ca
-
SHA1
7a63d3323872089fa7c9f544fe3b1eb5f5278eeb
-
SHA256
5ac9050c83e87f128b29e9011b31936dd0acb6cef03d13ad581f42982541b8ff
-
SHA512
d98412467be4b4d0222541d9e1389ec8a796aa5d50170994db9530ed012dd9d11e68daec4c53af81a2c357606161d160ac804f84b28dd85406e9e1085597626a
-
SSDEEP
393216:DKc9WLFn7bvJ2QaFqyYgsIFVXGNeoH/xrwOI:Gc9QFh2QR9IS
Malware Config
Signatures
-
Loads dropped DLL 49 IoCs
-
UPX packed file 64 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Drops file in Windows directory 2 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 46 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\monkey.exe"C:\Users\Admin\AppData\Local\Temp\monkey.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\monkey.exe"C:\Users\Admin\AppData\Local\Temp\monkey.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Windows\System32\wbem\WMIC.exe csproduct get uuid"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe csproduct get uuid4⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
10KB
MD5d343cae0269ecd709fa7ad23c90d0891
SHA13d402944188e64955f98619f7ceb6e53f858d9ad
SHA256883b54e6209abf1fae0eb812d6f19a2a78bbd070702e4edab864917216c3a9f9
SHA5125529c986e548603b81d630dea2e83be3664459bd2e430c369048e78ce2b9b59f1d2d83877de5529399931b4baaf8738b4f331c79ef80afed5b70a050fd431c30
-
Filesize
9KB
MD511bd78bc617bb406686e85725ddf84ac
SHA1f405c870f0440ff5b26a04443e73355c90d493a1
SHA2562ebb4de7e133bac78d965375293044f49210a539893b9442b6bf8617ef2c13e6
SHA512876021bb05784918c11881ac5c1aae8a3bfdf41472fcf83275a34013371181c8104b1115e9c7751ce0ce52270bee5321b007bfe5add76127b3e9cbcf7c2ed4bd
-
Filesize
10KB
MD53866639044b422600e624892d42b7371
SHA1ebbef629f729c802eca5a0edd568c1a2dc1dcb24
SHA256e7d1dadbc0943bca5001fe8cac6f08927298b819ee8027ebea41c1c3e1daba5c
SHA512de149d06b0462b3515cde74ec3ffb56e08ef817a60ed17aaf50df2baf7ea65ee65207556350e48518689b3eff20f213b93d375698a53c4f3376af673bd366076
-
Filesize
106KB
MD5870fea4e961e2fbd00110d3783e529be
SHA1a948e65c6f73d7da4ffde4e8533c098a00cc7311
SHA25676fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644
SHA5120b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88
-
Filesize
48KB
MD5bba9680bc310d8d25e97b12463196c92
SHA19a480c0cf9d377a4caedd4ea60e90fa79001f03a
SHA256e0b66601cc28ecb171c3d4b7ac690c667f47da6b6183bff80604c84c00d265ab
SHA5121575c786ac3324b17057255488da5f0bc13ad943ac9383656baf98db64d4ec6e453230de4cd26b535ce7e8b7d41a9f2d3f569a0eff5a84aeb1c2f9d6e3429739
-
Filesize
46KB
MD513f9af35bc2ca51e1a0d9f912280832b
SHA13b94ed1baa8c1dd1cc9ba73800127367f28177e6
SHA2565cfa3e2d465614a5f7bdbfe8bbbae012d075bbe83d9561da3f93f4c19f9b94b3
SHA5120234136e9944963d672bb45abb76540a3ca82dcbc16d6f6185195316f2280253f02173840ccee8db7601f08b08c753b4d46a206e5d2ffbaa40b62e7599e1c3d7
-
Filesize
71KB
MD5cb71f6df80ff33ecb79df69a3efed164
SHA124034a149db4cca2605086fc7c204f6b6e58b6a0
SHA256a60ef195d76f44fc5636b5cd4538e8643e3af450037d8288c140a84ebad83c70
SHA5126c40e1a97b1596f703d04aac1c8d4e1c244f0d16b02d28ed4a96b6b55378f34da84e9a1fe55973150f64939f6475ff0b2bf590af8d90e97ff7a77d21436ad7df
-
Filesize
56KB
MD534bc30cb64fb692589e6df7cf62f14af
SHA1e42884b73090ee37ead7743f161491f04500cdb7
SHA2565d5c80b2e8a1cf081aa41c35c48f73df384cf526f358e91f80ba2ad48b6e52f7
SHA51269a6bb5689f33bfa13e5ef9532632a82cd26983d73e2d9ad920588840d7636c86f224553d3cc988e7500bbee9d67d15deb3382af03675e97043cd59707924c2f
-
Filesize
33KB
MD547552c83d1890ff91037eecd02b730a2
SHA1e9ab5c304f0a2817eba6fdc758722600615c30be
SHA256c3024b95f7f1757d9496c8171eaca5f8b9bb8c7cd7f6077077b5aaa1302b0ca4
SHA512d9d42b253fddca0eff99ff47ef5ff05a8ef53966c79e040ebe22757b31d478f71709460a36c8dbde67a43bd992983d3e4ae7775e9d687295763ffd283d0746d4
-
Filesize
84KB
MD573eb1d56265f92ceef7948c5b74a11c1
SHA1a1d60de9930fd9ed9be920c4d650d42fe07ebc22
SHA256ee390c28c14e0c33a5601f12eb5d04bdff0ecfb334ce402f4380b8e0ebf7d4de
SHA512ebc9bc622ad7ef27b16b85db2be7b1f68f2b5de9de5eb2684b5fb3a02e9e851a939f63459cc2eb911263e799ff2c4a918ae98141f61132eb3d110828741f833f
-
Filesize
41KB
MD526a6147d9ffd545fd80c9ed664d66d06
SHA1b17b5ec05c012210adb7f0408273d0a40ae4f755
SHA25635f18dd2452642cefb6f883afc74d560e22aa71bdb6b26e63b076d7ea4246d38
SHA512447c72662de5fcffa07da8682e4d08f8ced791bfba9a742529766527e5d41ccfef5fa694c8a88bb8798c53c9fc48c33f57dd6c74b5dc49e8f8b15832593e155c
-
Filesize
48KB
MD5c528dc5f5e7d87c63f09f31d8e2e8b7a
SHA16d09a5c9266876d8e466059fa3c0ef6f71f59a74
SHA2562ea4fe9500ee3669ac29a7451ee775b3bc7e2104fe9e840af563499e23867a46
SHA512358fb50590b958dca4138b12f31f5b053b5c2a251958b68662390ddd761f02185b283f23801a2cc0a15f12dc0f7ec9a4213228af27e9988889ccb7d3727b9c6a
-
Filesize
60KB
MD5d3b40bb8131722d77dab6fd9bd135fca
SHA1170143f91ebf1f1a41da05725f3d659d070e969e
SHA256e33e96ee3e4135b92cbdb987337d3cf8e438f1cca96c87dec682b586b6807ce9
SHA512b48730d8dd5c0dd43b300b3fc997b6a083d9d4c45816bbcf15428cd2ee8664b49bbfd9e645d9e27d707b243bfe061d12822accbe466822ba723fc23c13e41f69
-
Filesize
812KB
MD5fbd6be906ac7cd45f1d98f5cb05f8275
SHA15d563877a549f493da805b4d049641604a6a0408
SHA256ae35709e6b8538827e3999e61a0345680c5167962296ac7bef62d6b813227fb0
SHA5121547b02875f3e547c4f5e15c964719c93d7088c7f4fd044f6561bebd29658a54ef044211f9d5cfb4570ca49ed0f17b08011d27fe85914e8c3ea12024c8071e8a
-
Filesize
9KB
MD5b0d9f057445509aff2a322b7e2d676e6
SHA16773c897c71d9f31171ca04ee0feb0dfc61ffc0d
SHA256c133d34db96deb5fdbad4bf5236b85fca1989058e94d932f359d178f343e9563
SHA51250c77d9f52119213fc03f618d8c78f77449adb211da3db2926b2b04417db5b6caf2c5494f505882ea1ac112d5f4e007815d0eda124c9bb952ce47be162b3bb14
-
Filesize
1.1MB
MD5c702b01b9d16f58ad711bf53c0c73203
SHA1dc6bb8e20c3e243cc342bbbd6605d3ae2ae8ae5b
SHA25649363cba6a25b49a29c6add58258e9feb1c9531460f2716d463ab364d15120e1
SHA512603d710eb21e2844739edcc9b6d2b0d7193cdbc9b9efe87c748c17fdc88fa66bc3fdae2dca83a42a17d91c4fdf571f93f5cc7cd15004f7cb0695d0130813aa7e
-
Filesize
23KB
MD5ce7d4f152de90a24b0069e3c95fa2b58
SHA198e921d9dd396b86ae785d9f8d66f1dc612111c2
SHA25685ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7
SHA5127b0a1bd9fb5666fe5388cabcef11e2e4038bbdb62bdca46f6e618555c90eb2e466cb5becd7773f1136ee929f10f74c35357b65b038f51967de5c2b62f7045b1f
-
Filesize
203KB
MD5eed3b4ac7fca65d8681cf703c71ea8de
SHA1d50358d55cd49623bf4267dbee154b0cdb796931
SHA25645c7be6f6958db81d9c0dacf2b63a2c4345d178a367cd33bbbb8f72ac765e73f
SHA512df85605bc9f535bd736cafc7be236895f0a3a99cf1b45c1f2961c855d161bcb530961073d0360a5e9f1e72f7f6a632ce58760b0a4111c74408e3fcc7bfa41edd
-
Filesize
34KB
MD57454e05b8b7b276bacbca3577f36a866
SHA13157ce432e7c2052fef149e5d6f94646814d8b02
SHA256c4cccc0793f5b294752b8820b627c7d22b5bb9dfa82a1a5de9ada38a7596d059
SHA512346a91d29a6e0b02c61aab4c43486091d9638126fb7f074c1c26457524fe7cb784efc6a5883822f07c20d006c93ceca24f4613b02e23a889cfd5565e66889810
-
Filesize
86KB
MD5bca9783990260b2bc48475fb919c036b
SHA15e1d9c5250724906bfe92821544ddafcd11cdbd8
SHA2566266dc31c5774e2ea835092cf3f5f80c06afb423cc18ef372c7cfec1596bda55
SHA5125bb3c5fa7e4f8ff5fde2511dde40b45a7ce8dff38ad8a02e541bd2ac2e712f65635b0ce44643cc5d4c316874af47759da31c25dead5282ae3f370f3f57a498c8
-
Filesize
63KB
MD5c17b7a4b853827f538576f4c3521c653
SHA16115047d02fbbad4ff32afb4ebd439f5d529485a
SHA256d21e60f3dfbf2bab0cc8a06656721fa3347f026df10297674fc635ebf9559a68
SHA5128e08e702d69df6840781d174c4565e14a28022b40f650fda88d60172be2d4ffd96a3e9426d20718c54072ca0da27e0455cc0394c098b75e062a27559234a3df7
-
Filesize
193KB
MD563c2e16fcd14f54b8c6165fef49d74e0
SHA13d00e9e6f2224c5808b5c2108234657d3bb42272
SHA256a436ef349278d1efb223e86a4aee5332185363c0ac33468247a5dd8e6a4a61f1
SHA512fdff546eb940a2c2bec00332d48aee8be06bcda11aee596d65d387462b8c3759ec174fdb5b11aaa18979ca59b7ac4f4aa98dff418b3e52629c92683c11e29b7b
-
Filesize
62KB
MD551a19a965e387d0ceb64708a47149c9d
SHA1f047a81b69c42f269f923c5f741a44613cbcb1d5
SHA256b00a1a46c425ca266ea0080e5216bf00862dd3064e8c5ebd5fd3b6845b62f363
SHA5125feab90c7f5c7156a7bf2bc41888d18cdf34c303d24402ae2e4c0a067c7fca1ff6d277df6b7533a3fd8bf158548badd34e99bdb948e129c5d3f7bacfb712300b
-
Filesize
24KB
MD5a3837dc2e2a80fd286c2b07f839738a2
SHA1b80a20896de81beab905439013adb9e9421f1d2f
SHA256eee7c64ef7de30dbda1d826bb3b1c3282602d9ef86e5e999a0cd6551287f29d8
SHA512b14922e30b138401d7b301365644174c3a4b32872fc5688b22ffe759fdfd906f2fa91029f8f6ea235428f07519875aaeb2c4cdb786ca676d4f3ee9d81cddc96d
-
Filesize
608KB
MD5b23329381855b6520ff86cf42838f84e
SHA179667fd09bc8b3a1a13658fbb5b6237725426d08
SHA2562a1d451b5c7003200e3314bd195b48d1093c7583a667a25b1b6473c6d50efa74
SHA51235f2fb242b5381ebc2267301a6efbc3331dfb0d479d61275386c73195344377f784534cc330d6b5d9456fc8d398161ae0b21506a8a311608220efaf4d5707fe8
-
Filesize
987KB
MD519df5f270ce38be3d8a4a1d57c247b7c
SHA1f9defdee2fd28005190445afdcfc6d5d1a39c8a5
SHA256ed33c08950483c2197a1d804621e5c4cef8ac3bd5b23be09c475364a21c89f28
SHA512f91747efba38dd2d0455af29cc199934df7cf0d5e2c2aa6db52366487761babeaa690dee307dea64a263a67fc5e79c0c4886c1f785bcc7b03febeb0c5cd2dbec
-
Filesize
256KB
MD57ffce2504fba5823ef44b2209ed6102e
SHA1bf0eae141b7a2b49190fea7167bec8f3b3af6045
SHA25681f3b14fa569d64cb86ff2cbd1953bd9b3d3b4b0eb6ba6c28f605aea24f1056b
SHA51211c1e734b7cf065e5d6c9ca2e7cec1a9a2d86483d9fccfd3b9d22df4c8e3f9085a9556c7cd9f5053941e03ddd50b5d6511998dd047bded2a47b8fbf2efefd501
-
Filesize
48KB
MD529532841da8544665cb1ad1a127e4296
SHA1b8852f095cbd0029480dfdfc04702cd6dd409001
SHA256f611b06669774e42bda967a11d4ec2990c327492d5bc0f8afb555c8501214c77
SHA5122b4059b38fe5314798e7b7de6065f6f5f9746bc59937e8c8842d293588c6cabb8979736d7b4693753301997a4b283020c7dc5bec0d8a70627b92510e3d1ddd6c
-
Filesize
10KB
MD5dec82c76e28c8d51d0e5edb763abba0b
SHA1564846af78caa62816c8d0399974b4fa77d40049
SHA256c3c1190de8d3528efc594c628230cf99623c5e92f81ee2330e733049084b9226
SHA512249901d5a59e26ba6efc87fc0ade827966dae6f1bc44678cbabd27940b365c03e08579e1dcced396f23de917349f47918905e8c4a3fe31a3c61858fcc19f7dfc
-
Filesize
42KB
MD569ff042099a0fc9d0d0408f031f91efe
SHA126ce6e4bec2daed42b42e02753f6a2dffd5cd486
SHA2560dc4765ca2ae13fa794e77c63d15a53cc0914165f71bc3b4aa5a7f647faf2a07
SHA512be0902f46c69ec7f47fcf0a0df1c3d2aea8f6475ff29080beb9698837c9447705366afe6dec956aac0fc06dbd58a29c1c3d51bd736b4057f80cb3a3298f8d588
-
Filesize
24KB
MD5d301ac14f79443990a227ec0aee1788c
SHA1e6ba16b0ec6ac2ed63e3c2424bf92d4fe66405f9
SHA256890d3522062a81f970a2c91acea9c68b91c9d77013afc34d5a950269b9e994b6
SHA5122c2a3dda038309590965a6a2cb1ff86b6ba8a2fe9e97511c1e2a2cc63fda96ac7782b5eedfcf61479838249a064482b11657c0f4a6c3ed1f6338ebe0e0171ec1
-
Filesize
39KB
MD57e9cf82724596467af2ebcf2cf3c2f36
SHA18fe14237cee9574fe517e58bdf9c2b790efd6e54
SHA25660ce38202c60ac8f5a7e49980fbe25f441d872e8870a12e6b0b9861fa60814ef
SHA512787b2a4e5fdf4f4d72cd4934fe87b8068e97e454ca10e74c00769b0dc2e7b4a7224d4d783e82cad1094761fd01c18ca8dceac4a9c07846cba3a2997071e1690d
-
Filesize
1.4MB
MD5bbcb74867bd3f8a691b1f0a394336908
SHA1aea4b231b9f09bedcd5ce02e1962911edd4b35ad
SHA256800b5e9a08c3a0f95a2c6f4a3355df8bbbc416e716f95bd6d42b6f0d6fb92f41
SHA51200745ddd468504b3652bdda757d42ebe756e419d6432ceb029ed3ccde3b99c8ae21b4fc004938bb0babaa169768db385374b29ac121608c5630047e55c40f481
-
Filesize
192KB
MD57414ab457621471942886bb8ae8eae80
SHA138ec50518a3d012bfc069cefbf1de86c33c9f8fe
SHA2561ac5800e6e63306c093545ca15ca662be6bd9243b4ddcd3481b80e054d1f2363
SHA5121cbcb69c21f4d7c0cb74e4e90ef580c6bc6dae8c024ef8952f2a405f22ebbe0c23443997e0eba5694a16aabf6cf253ee6a0d95ad8797ad98be768453e3becf79
-
Filesize
4.4MB
-
Filesize
48KB
-
Filesize
124KB
-
Filesize
1.4MB
-
Filesize
112KB
-
Filesize
184KB
-
Filesize
172KB
-
Filesize
100KB
-
Filesize
144KB
-
Filesize
3.5MB
-
Filesize
752KB
-
Filesize
184KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
80KB
-
Filesize
100KB
-
Filesize
208KB
-
Filesize
180KB
-
Filesize
100KB
-
Filesize
60KB
-
Filesize
144KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
152KB
-
Filesize
4.4MB
-
Filesize
44KB
-
Filesize
736KB
-
Filesize
3.5MB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
48KB
-
Filesize
180KB
-
Filesize
48KB
-
Filesize
48KB
-
Filesize
52KB
-
Filesize
48KB
-
Filesize
72KB
-
Filesize
1.1MB
-
Filesize
224KB
-
Filesize
2.3MB
-
Filesize
40KB
-
Filesize
164KB
-
Filesize
4.4MB
-
Filesize
60KB
-
Filesize
100KB
-
Filesize
144KB
-
Filesize
180KB
-
Filesize
100KB
-
Filesize
52KB
-
Filesize
184KB
-
Filesize
52KB
-
Filesize
208KB
-
Filesize
752KB
-
Filesize
172KB
-
Filesize
124KB
-
Filesize
1.4MB
-
Filesize
112KB
-
Filesize
184KB
-
Filesize
736KB
-
Filesize
3.5MB
-
Filesize
80KB
-
Filesize
152KB
-
Filesize
44KB
-
Filesize
1.1MB
-
Filesize
224KB
-
Filesize
2.3MB
-
Filesize
164KB
-
Filesize
40KB