Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11/03/2024, 23:32
Static task
static1
Behavioral task
behavioral1
Sample
c1e357cf51dae54058b6fc7f8b8fcd97.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c1e357cf51dae54058b6fc7f8b8fcd97.exe
Resource
win10v2004-20240226-en
General
-
Target
c1e357cf51dae54058b6fc7f8b8fcd97.exe
-
Size
7.0MB
-
MD5
c1e357cf51dae54058b6fc7f8b8fcd97
-
SHA1
55b0247260ffd1eb52da6857dd37dfe7904a5efd
-
SHA256
d2eee750f68c55d40b64066baa606fce6e38df0d98e902c09cb2db634fbcb072
-
SHA512
d18e5c1fde2f85dc06a1239434d33bcd145b2ba8bb86e127118c2749b1c5f91779255effe74206e9221cf6ebb6e0ede7cc63ef71bdcbde9e8d3029ea0b1f5ce4
-
SSDEEP
196608:rBm/DzMl056Ge2k9Ik7Rg+bMxXNaDghpkaEH:mDzE0YGe2k9Ik72+WUDkkaEH
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp 2424 ARPRecoveryToolboxLauncher.exe -
Loads dropped DLL 1 IoCs
pid Process 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 34 IoCs
description ioc Process File created C:\Program Files (x86)\ARP Recovery Toolbox\is-2UBUP.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-5DJJM.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-8PUDR.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-JD1UC.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-KAK7C.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-DTVHO.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-IGB51.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-UD5HI.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-O39JQ.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-4L9L5.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-3K00H.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\cc3260.dll c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-L9I53.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-QF6UK.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-EEG0G.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-CFT1J.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-8UA5A.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\prRarRecoveryToolboxLib5.dll c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-2EDJ9.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-JN11J.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-9J5AL.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-CH0CV.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-3JPN7.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\unins000.dat c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\ARPRecoveryToolboxLauncher.exe c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\unins000.dat c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-47GPB.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-UVGPJ.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-HLTOI.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File created C:\Program Files (x86)\ARP Recovery Toolbox\is-S4U63.tmp c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\prRarRecoveryToolboxLib.dll c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\libeay32.dll c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\RAR Recovery Toolbox.chm c1e357cf51dae54058b6fc7f8b8fcd97.tmp File opened for modification C:\Program Files (x86)\ARP Recovery Toolbox\ssleay32.dll c1e357cf51dae54058b6fc7f8b8fcd97.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 220 wrote to memory of 1348 220 c1e357cf51dae54058b6fc7f8b8fcd97.exe 88 PID 220 wrote to memory of 1348 220 c1e357cf51dae54058b6fc7f8b8fcd97.exe 88 PID 220 wrote to memory of 1348 220 c1e357cf51dae54058b6fc7f8b8fcd97.exe 88 PID 1348 wrote to memory of 2424 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp 91 PID 1348 wrote to memory of 2424 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp 91 PID 1348 wrote to memory of 2424 1348 c1e357cf51dae54058b6fc7f8b8fcd97.tmp 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\c1e357cf51dae54058b6fc7f8b8fcd97.exe"C:\Users\Admin\AppData\Local\Temp\c1e357cf51dae54058b6fc7f8b8fcd97.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\is-N7FB9.tmp\c1e357cf51dae54058b6fc7f8b8fcd97.tmp"C:\Users\Admin\AppData\Local\Temp\is-N7FB9.tmp\c1e357cf51dae54058b6fc7f8b8fcd97.tmp" /SL5="$40230,6616859,1072640,C:\Users\Admin\AppData\Local\Temp\c1e357cf51dae54058b6fc7f8b8fcd97.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Program Files (x86)\ARP Recovery Toolbox\ARPRecoveryToolboxLauncher.exe"C:\Program Files (x86)\ARP Recovery Toolbox\ARPRecoveryToolboxLauncher.exe" c1e357cf51dae54058b6fc7f8b8fcd97.exe3⤵
- Executes dropped EXE
PID:2424
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.1MB
MD5e90e37a4e67cad83f05c19853443788e
SHA15764e93ba9a38dc5b33009124e6f6bcd3435c24e
SHA2569f18e653301a41fb8baae96c33d03fae35b979dd9648d09509cd462270fe8256
SHA51269ad3d6c5c60fe58cf94886c9a4f8294742dab4f91198430ed1a54dfc2eb6b7ffa07d860ba4753eb51d9578eaeadf68f3bece45d9a1de782ec7cb9d891f9f126
-
Filesize
2.8MB
MD5d29ce8253581f4e5834248d382d702ce
SHA13a4df8a10258222d2b0dae93e0a7c6f6c2c1cc94
SHA2560a10d9196da130f1bc1693f1f0cf31b84b9a5d35be7e298afc66ecb5d2a622be
SHA512647b6ea5487f99a16e2841eb6827b39b8ca2f038cc03ba6467394c1d2c2eb3019a2d3cfef3c0d631b6c42ce2bfb22bc588feff35b90489c0b1dc61db52b72267
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63