Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11/03/2024, 14:58
General
-
Target
2296a778914a3272886066a2fa11fd6366fd44c56251b577036fc3d228b0a89f.exe
-
Size
2.4MB
-
MD5
226f182d10ae6165ce779e45f9eecda7
-
SHA1
f151622152a09bf4304200a0ad6bdd055364c6af
-
SHA256
2296a778914a3272886066a2fa11fd6366fd44c56251b577036fc3d228b0a89f
-
SHA512
157f3d3fb8f2c8e6f52492211c02b1321b7a8f6585aa0ba4be1aad374f1177ff8b2530f10301bc3346888a33efd1f40746a1d09692be449af3cbebfe42f421e4
-
SSDEEP
49152:WxuVOF3MeXMIs817dtZMk60gO5KIF5tFb8LoB4QsSt:ouVOJxXM9817yCLKO7yL44Qs4
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 9 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Maps connected drives based on registry 3 TTPs 6 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Drops file in System32 directory 12 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Program crash 1 IoCs
-
Modifies registry class 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2296a778914a3272886066a2fa11fd6366fd44c56251b577036fc3d228b0a89f.exe"C:\Users\Admin\AppData\Local\Temp\2296a778914a3272886066a2fa11fd6366fd44c56251b577036fc3d228b0a89f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ctfmen.exectfmen.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\smnss.exeC:\Windows\system32\smnss.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 8284⤵
- Loads dropped DLL
- Program crash
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
MD5ab0374cab3030c7d10ba3125d2b295a4
SHA1128acf8819a411c54d996182672d72b513dccc8d
SHA256c1764cc94534ba4e9224ee4cf56157a7fff69e8066aacb86dd9f4ba912c547ec
SHA512c6da4ae5f8f33cbc32a3bb7390895c243f49896e689a98c5f834ab9a072ec99f9c74821aacbaea33ba46304ea250d27439dfadc1c1f41ca5bc81181ab5091d9c
-
Filesize
183B
MD51b288612f52dbdb6cebc12b34da03156
SHA1d98c7665a101cfe273db15be3af73729362cf519
SHA2566d90142a04e40c80654c88927ff61bf0546449836f6943b63d6195062728a945
SHA512a4e1695459d074522bc544cf87efd58181403b1568e78809cbe442ae373de596c21b57307fec40e4b9c18e5841bc75c9463d3988c6074a232a19355cdf5251c8
-
Filesize
1.6MB
MD53c936a33ff3ecceff098c4df06f2e0be
SHA12f9cec3bc8bf66abc7ba32f3b97dffdd703873a2
SHA256eb00e0a46c10f5699b6a98eb2dfa75faece562293f5f8bb30ac0a16762d06851
SHA5122ea8a8aacd72933d473541f2639d3fd27dbd35aa0163ae88a85053db432585620b04e1247cf069fb83e5a35346fde04f18950f98799aa49a01573d85008d2c8c
-
Filesize
1.8MB
MD52050df12baa0bb0d3436659b15d85240
SHA19e86f37549babdc8a57a39a7bab71834492dfeac
SHA25635991c6f56b02d72c56dabcf0d9b12c0c2ddd4cbe54f094311a971926078bfb3
SHA512ae173545278c46740f38931bd2e3fbd606b89557e4bb11e914c3298e57f58ad75daf3f998d2ae2fa3ea4994a29d8e492d6037879829054acceb232f4b51c6b23
-
Filesize
4KB
MD507a20dfa5408fbbd1554e5b689623a90
SHA1ca10f63b37b167debae0223acae4d9d5dcdbaf66
SHA256668a57f06dece26bd210414ea9f67edde21b657fcc913bdee33068dcb0d264e0
SHA512b5bb97e5cbee80b0c7bf01bb046ccec4e6326c9cccf4215ee695241990137eeaf31ccbe4a68c7444f67be90143844f13233478ba5afe004cb4b3d0ada63efe64
-
Filesize
8KB
MD559abcca6f07f63887cb40e1baf75f86c
SHA19702e17ebcef003ff49a37f4e32bced9e6894968
SHA25613a6f2c5d7f51a72689718ceb6b5afd9a012c4feb44484c58dcfb5cce60b21e1
SHA512a4f2ea80bfc3efba13f6dd915d75c931d2fc040f22975d28a4f95b7381af53d3a5dbab183762cc73037a44bb31a8cee0d17a10e2c3bb874d2c22bdebb6913df0
-
Filesize
1.6MB
MD5294a5470b475251a405110783cb174c7
SHA14f9624cb17e06fb0024de2ea0badb90d2703a3e0
SHA25622a39df32ee31c30c11015dc8cf9f3fdab0741e439e46225f6b42cbdb05d9bd7
SHA51222e5d56184fc860a1f3856b58507cbd6ea0af3f5291fd2c7d39d0c709c8921c376e852884a3ed95937025dac40fe2e94d7184f7822ab37654c2d02fd108f711b
-
Filesize
1.7MB
MD50d07546abc4c104f64c8cd9e79f80116
SHA117371d2473e93942e59077a4fa2e04d2ec67c879
SHA2561cd03eae4f1f1c66ef19b083c7249c26c109298613129abbc9e966f0e6b87a76
SHA512d2534ac13bf6f69cdadd19c87db5436da33da7c3ddee273d64cc5d38283ae2e5b766076dad16a96cc86d6a75a730cd078de2ba9e5e336e75f1638240829d4406
-
Filesize
2.4MB
MD5f84c1abd04e7e1233a921e89be81c497
SHA1fd0b1d6918b132e80041f70827f44b1ae23caa3c
SHA256a893f75927a8262547791ed4e56112937102f5aa4e75f2050f6c0f0f198c108f
SHA5128829a1dccd6e33c5c7445deb6a03e2079417465528500a9b324105cf16e1daddae4fac299b0c4ed8ec6c0e6b907a3cd40744a4f43b73d0ac5650f9f6be86517f
-
Filesize
52KB
-
Filesize
3.8MB
-
Filesize
9.8MB
-
Filesize
52KB
-
Filesize
36KB
-
Filesize
3.8MB
-
Filesize
9.8MB
-
Filesize
9.8MB
-
Filesize
52KB
-
Filesize
3.8MB
-
Filesize
9.8MB
-
Filesize
3.8MB
-
Filesize
9.8MB
-
Filesize
36KB