Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/02/2024, 01:14

General

  • Target

    ad52e72f5696c8c5deb3d5df2b609780.exe

  • Size

    13KB

  • MD5

    ad52e72f5696c8c5deb3d5df2b609780

  • SHA1

    3d9b46f2e20f97bdf6643f40305fc9a4ea850298

  • SHA256

    6eb7f70af838c0c3445e152458e75b7849b755ce9e042b1be0e3d66f5e0b45c9

  • SHA512

    c14ca482d3158096c10e5571f0b34135b92d3d2b39af31ca5e173ff7f908f18b21948f629104a54af8c6c277ca7d6d30af0f517da3d58b8aa9298945f8f523c0

  • SSDEEP

    192:OS4gbgkAN4SJj+bfrJsUwv7E6BdnJyPCr9ZCspE+TMwrRmK+vhOrdgTOQ:OS4uI44aJ+7NBBJUeM4mb3

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad52e72f5696c8c5deb3d5df2b609780.exe
    "C:\Users\Admin\AppData\Local\Temp\ad52e72f5696c8c5deb3d5df2b609780.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2020
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://ads.eorezo.com/cgi-bin/advert/getads?did=43
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:1276

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    420661efca83a4420be38306ab356c6d

    SHA1

    a21c8ce152c35ab63faefefb0cac541493408cc4

    SHA256

    a38de253676a8147879fb3724a2744441d2ba4c66d892b4b3abaaaf82352f55f

    SHA512

    2acc75dbc51dc149ea57d536e3223be2de0aa18579857b5adb6615886a6178d436282bb30685eb6b4456dc73a2451fe5bae0073bd774350e8f9aa6587c318fac

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c35cccb3748cc811540fa23b2d730147

    SHA1

    8e3f29ca296bfd770aee2a54d869922e5cbb5768

    SHA256

    49c8a1a73977aacff0809f84b8fecd0d9535d680ce98d31eef08d4ac8b0d3690

    SHA512

    2e588dd99a0f6845fb13025988081e06e990cca143aca93c4c12f05bba7c1a2560e1bc335cb5a5bc4e01b3a15d26b749b10f1cd017cec6b5eeb5a751b0871fe6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    183d5880374e0f3375a5e5efb1e857f8

    SHA1

    1e2f58ed4bef4e8880368ac19f753417e71d68fd

    SHA256

    91fba3bbdfc81f4e6c2686783fccee645eabaea60187f92cf29dae8737f940cd

    SHA512

    12a94a601d4eeeb5297a97ad782c83a0704e97b1cbaf4c4b1b66bd3228ac45dacc58654271b41322267082be5f66213fd1a3cfd1512c84d179924ac550bd07e2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fbf13feea0de1f1e292f42243df59584

    SHA1

    b578ab2ad471fa3065f267edde6f5a772b2b6945

    SHA256

    c38fa03234402848559d0a0456ba124ff711530b39a792309c96802e068dac6b

    SHA512

    4017bf53a000d286125a9442d13998b524dac650239e07847db796b6d9cea627da5eff7f5fbed81a8c1ef77b33b3909412d76566e4630516989025d377dd30f5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bafdb14b1f2a2c9ead7d87097e110b02

    SHA1

    f43d63c39040e69afdb3f5732220ea8807874c0f

    SHA256

    56d5e9702dc25323687f00f9e30a24f2251d08f790b46224596e483473529551

    SHA512

    085855d5b57e1b7aa7928164012156404f6b88b3154531bf0ccc637570c3c20477f81b46c0be005791442b3ddf3faf62a89b34defda498e37d49b28b0ecf6578

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    bd8c7530a98c85c795c4468ff2fba34a

    SHA1

    67af76f6f4da000b08ad173a55de6f7aaf736139

    SHA256

    082aa66dd51a762590d3c30a76bdc32d83bcffd14504da0274e1718e36dcaa92

    SHA512

    87d5a3870a24666b8fb057e0062b6bf159d7f184c5fdc71ec2b4a9ca092552e6cb6b21308e76c3b13bd6cf79f6bc7820382713b622c1ec272db1dda04e65bc09

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    7029f9d12bbe7f76007f2b6ebcdd43a6

    SHA1

    96dad9b5d0e0a02fc923dc73065c70a9eaecff34

    SHA256

    71991e76a518c7dd1d25d5aab2176bfad073b0664482f284953337925bd44102

    SHA512

    717d9eed4c0a4a2ef2e8864bd66135a261c440977e913876bf3410661a40c35e1ac18d35e567234d56f7f21bc894ca98d6d1712e073b000f46c9b82c895214ea

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b0266b99a30975515b5b9ba3ad343cab

    SHA1

    61db2951bb4eb80a906a3783ab4f854e142ea667

    SHA256

    e4d410dec186b463de164f4c6959bf2ef4d92656c444cd4ba0f91e0f08f75acf

    SHA512

    76a4dc47b624e24f1fc8f50229aeb456bdda967fff8031a2def64e8782f36a608231b407446eb2ffbe2578c46d47a60201e13427330de0c5ca5c438dfc308ff2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    4a18f6a4105bdbe1ff5f5e31c81a0958

    SHA1

    6fd1dc59e2564c0cd088ebf3cd2a50ac65c0e9e1

    SHA256

    6564ea9fb5d60089cef19125ef8f6cee8c3edbbac2e432916db6e70a7fe8b809

    SHA512

    985caf50f08f7c98ff2339330eacecd30ea12a466b0f461be8e8eb72ea058650c6802fde6da3a4c391847b5e7511d87270c6037506ce64944074d5a74ec2634b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    1c4b79876d922269db50b6faf8b5fe71

    SHA1

    9972feb82522452c5feebec4f4d9e9cd709b04a4

    SHA256

    ad49b7c14f09f3bfd6ccf7c4fb2302952213f7201416877567915a0dd0f9a137

    SHA512

    bbe89ca81263ca404eff2da421cd63ae267a315e35ea12cfa073b2365f59b5266b8f219442c908de5bd5b2067a563f77f5538d67f158a7213f6f92371ab36855

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c4d5c5cd25ddc8be1b7a0a067a9a3ce4

    SHA1

    c454695114d98cbaa9603a529d8de35d523a7781

    SHA256

    dc9bb0ec6f358ed0c2dcb751d54d51fd31027c414f562039cbabcae9034060e4

    SHA512

    ec1086dcd5c3ec0d378018acc9b169c9b93c485872925f211ab8e9c9a4da27a5a9ef8b99382f26f533efac30a282dbd5dfb5062bae9fe2a73f3e43c6e58551da

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    8a578cf6f86c5a084baa78b6865e14c9

    SHA1

    5a53412562417f19866634dbc7b0f7d6ce1d143d

    SHA256

    024911f5f5955be0aba7e0e0e905535975c3b2f08c33f70a07bb85a885cdd579

    SHA512

    e17712e278d6a14668bcca316ff8becaac60abb397c8abc9efd6809183af5406429b6ad671b85f8956197aaec5e6bd0d1eb874096fc0faf4a41997b2f2ebe0a0

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    da1093f687099fd0c926a85e49fc8014

    SHA1

    11079604fa58a7ebb4cc7033c249a42b402ebb92

    SHA256

    7f7dca802c7164f4e76604b6a00070d1933c1a1f270cff1034750af25b82990a

    SHA512

    0a580569ed11b4fea26e6952c657228b7f64bfd7ebf9471c80640486576ad842a89a99d097d68a53cfcfb948dca9ea94330b5ff08afc27e27901737dca3897a7

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c15b9389d5a326a953c01149129b2a87

    SHA1

    ed4810c6abf9b9495381660c5f0ee57b64ce95f4

    SHA256

    866d4bbe285135edc4b1c6f0ec64e2eb9dd1d53b5c8aa4f9aeb34384bcfd9387

    SHA512

    13bfb491d33533517a113dae3f6a1daf22e23bf1feced2123324d8b18f417092cec94497199849f89b5b73f3648232e06dbeaef38a6092f034d789fd9776b6a2

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    d4cf15a94e67c673a93f18a59d7c4e60

    SHA1

    52914b34eddde207bdbbd300d3d7a6bc39e182db

    SHA256

    5a88b76625701b9bd64ee502bac89fd2ec618a023bab78a8bc9e9d0e17599ab6

    SHA512

    0e8b53941cbc652950754cce1f27019d0fbcb60509eef9561c8ca3b2cec5742d868cfb737dd88052d06b61b1c4b863962c3a31dd911e2edcaa99539eaf648929

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    e3e0449462455592b0f1c6ba7335c567

    SHA1

    5be631d26eae11c659187c86391bc19daf45ac11

    SHA256

    43d9f3535a23858d39dbd38e4646ced347e31e9bd573fd1d07ac510d78949735

    SHA512

    c95b9c3fa5f1ab73da5f8affb0ea9fc839175f9a5d14e03f63c439e1edf75cdfb06d2ae0e54616984e39f3459a42415c8faff3214d7bd8fc69d60754dde01df6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    f766bc876dac2d74a9f702e97d78c653

    SHA1

    6610c35647e19ef090645f1be331407833ec8906

    SHA256

    c1ab3c17c20a983560a69ea942700e547b4cdc939c38547de76c679cdbcca116

    SHA512

    52449bc94570a8fd40b79e13dbb280d2c0ff7480e2007d93f5bfc522690041217d140fe331cdb9d24ba2e77c390d6da9ef94a987a813d48f2457216e78cb891d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9779e69abd4ca11d613d667df302c49e

    SHA1

    1954e1f65e950ecc9053102bf164fe7d9101a112

    SHA256

    3cf3c19dd347bc2bced7b37acda8fcc75fbffd4e7e59b282e5b3b9476c534389

    SHA512

    8c92f93086f651c8ed58b2b4c47883ad4c7a540cbc6fe62d17188a42da4d9a4cb6b63fbca05be66ffab9246a7c053af337f3344cb19cdbef096e3d32a8bb49d9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    db4bdbc59b3afd058d8cf8664ff97593

    SHA1

    f5fa97058d615a8e0de20d16d05f7e7dc011b1fe

    SHA256

    23b7480a469ec346cb44f6344c76e8e1e9afa3162336b96c2ec3f524e8d4f315

    SHA512

    976134e55f15f5f088454be41331fe7987042d056cfb68c7d8301eb57cf36e5e121144c0c875b7c2688c46e6afa40f88a1e1aff871c719fbd65769e25b0cfae5

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    33fc7b4ca71340d8b352b4bd5c7a587c

    SHA1

    09be2ff0acc11ecdb013a343e2e31d2d8a0f24b9

    SHA256

    1e6028146952fd31a59af3fe5ad8b99c04fe58dfd9053540bc6e124298d07a4d

    SHA512

    41508eb5c87b468ab2e9386d51a42561157d2b57bab8f03c0b863f0c4ab5a5a65bfef7f08d45eab80dd72dc0b620d7ee51e77fb3441c91910d9305fc5baf1b3a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0aa456c12ab5b8bf7c331eeeec862ab0

    SHA1

    e73d5868d14ebb295ff1a4ded38cbb896af0d3e8

    SHA256

    0c01c1ebe51fde34282ed4c428d1eaedce534d72c390517a363271d0a23354cb

    SHA512

    8333216b785e04b3a3bba145e9b971e965d562d041f0a3dfe7b1aa0f2ab11a6bf4694774cfdc08b35b72a082fa39665493600b6fad5a7397d96c5b28f353dee1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    9c8f07d109fe78310e27d83d34ab9c92

    SHA1

    15610a353d373986c54c05a2cac7340e42a324c5

    SHA256

    daa8641a9d21c27b867ae3e824eeeecb57f3bac05240b3d3e92fcf944904b6c9

    SHA512

    f541b974354eeccfb7a3c207bbd2ca0b5493d6171765439a3ddff2adf3b16dd78dd7f1bb981ec01addb84b60cd9c9778eca3a44c030d0044fc5a46abd28b7989

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    98189b470e8688d7b042b43782dd52ea

    SHA1

    01303c4cae01c2e0eb1dec32922b84515a04dd35

    SHA256

    0200eb2dfa5ff276fa2ba1d088a6515469e4751f12bb7d6153d404ba3775edd1

    SHA512

    33582ad950d60e5bb375ca827224b79be78777a897c6aa569e960883c6ae38672dbffaadc7137473c0cd01d5a129a5b9fc091971ff5c05c1ec553c066d3d7bb1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b1c1d1e562f83d9176c78475faa7db5a

    SHA1

    99026aa4074c1707ffd45cc0d24e4ebb8c158db8

    SHA256

    b1a2af344609ebdc1e7fc8c7a890bfa0ef21a198145cdabf831fe3a370ef602b

    SHA512

    18da3d7f6cbce6bda8958cba8092242e0c9a12a23f36c85cdf4b7b8dc10197b4db4be3641658b7138adfd6f95cf349a3fe0500ef4083b34fe8567f0b03c5392f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b78bc9fa227a28d208e0994b24a5033b

    SHA1

    eaab6dd37008fef12692697b806e0264ec84a93a

    SHA256

    79b34eb0c4c9c5a1379d2dfa1c2948d4b4a8fb87ec43f6f357afa7728d7a741c

    SHA512

    d8937379790d7017ec7378fec27c7275d2edb9957f4757135cc7860371c554c5e4c21d2f8c97ec1b0d85940a0d152eb08659ba0df04ab4d511f4fc4dfd506f10

  • C:\Users\Admin\AppData\Local\Temp\Cab5997.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Cab5A47.tmp

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\Local\Temp\Tar5A6A.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • memory/2020-0-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB

  • memory/2020-1-0x0000000000400000-0x0000000000408000-memory.dmp

    Filesize

    32KB