Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    134s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    25/02/2024, 06:05

General

  • Target

    emule.exe

  • Size

    5.5MB

  • MD5

    f3f709c2d49dd6636f4ede5c2cae5448

  • SHA1

    8e0ea03e4c38199e10a2bc12db8b2df70484111d

  • SHA256

    06cdf814387f627a4bd05a0c68211f715bfa952423e8e8a462e1f47c11a4d20e

  • SHA512

    7a0df912b5ddc149d770260a2e1a3f55e58ac2e9ef02883e8baa08e79261075b82955bc8e57641bb2c16983abcada2581850fafc11b92a133605127bda80513e

  • SSDEEP

    49152:/BGoXbyOj8LePLHcPPLRCAnyOTxP9DzE4GEATLHYiipKXePi9Wxmw7b4ZC1VTWS3:rEWLHcPFCv745ATLHY1kO6g0w7b0XiG

Score
1/10

Malware Config

Signatures

  • Modifies registry class 9 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\emule.exe
    "C:\Users\Admin\AppData\Local\Temp\emule.exe"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:1008

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\eMule\config\preferences.ini

    Filesize

    26B

    MD5

    ec0280f3f439c6febb6b49883c5c100e

    SHA1

    642fe5a3945184440c48368e92c0d6be4c195326

    SHA256

    f124bff0c7833f05418d9980d994152346329d8ca56d080840859aca3a78f151

    SHA512

    cb5e24ed70c9228eeb0028be1ed1cd69c1bc7961f203290a6fa9b0f55780167ca4d989ce09a2f654504da5bcc9e4ce79ea4f5121680a62fb65bcf929f109f5fc

  • C:\Users\Admin\AppData\Local\eMule\config\statistics.ini

    Filesize

    1KB

    MD5

    afe956af5228b39834d30ad922cbc537

    SHA1

    e986a9df240f873fd46ade7e90975bde52f57843

    SHA256

    e5710e78459b481fb1fd3f12b2e1cc9dc6a249af1177693f9584ef338c152fd3

    SHA512

    c69cd734c4c598629fba537f5ae7c581dcae5b738763f2d407faead898ff9d1fadf2969996bf392ec4fe4292f022fbd9ff1f9326897a852fb253fa2976b4a217