Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    134s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19/03/2024, 23:27 UTC

General

  • Target

    d757c8f286baaf93380e560c986b6222.exe

  • Size

    614KB

  • MD5

    d757c8f286baaf93380e560c986b6222

  • SHA1

    8c6bf2a37004c382c18e6b23ab0b8e5be1569e5d

  • SHA256

    830bf8ebb7a9f6b44f657836c6dad8d1cebab16350f402dbf599d4f38e019ed0

  • SHA512

    1f69ecc47e5dad5788db34e2def9a4991345a4fac2ef322cd80451ead1f65e6d5af00785f56663055796c3bb7b935f5d74895b31a3075adc1cffb1cb9f666700

  • SSDEEP

    12288:P5v8WAA12+eawYcPxrg+v8EUVhF3Z4mxxlSWUcOeTHfkzz+:Px0tzY8xD1AQmXzUcrTHcf+

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies data under HKEY_USERS 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d757c8f286baaf93380e560c986b6222.exe
    "C:\Users\Admin\AppData\Local\Temp\d757c8f286baaf93380e560c986b6222.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2228
  • C:\Windows\Hacker.com.cn.exe
    C:\Windows\Hacker.com.cn.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Program Files\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
      2⤵
        PID:2676

    Network

    • flag-us
      DNS
      iloveu123.sphosting.com
      Hacker.com.cn.exe
      Remote address:
      8.8.8.8:53
      Request
      iloveu123.sphosting.com
      IN A
      Response
    • flag-us
      DNS
      iloveu123.sphosting.com
      Hacker.com.cn.exe
      Remote address:
      8.8.8.8:53
      Request
      iloveu123.sphosting.com
      IN A
    No results found
    • 8.8.8.8:53
      iloveu123.sphosting.com
      dns
      Hacker.com.cn.exe
      138 B
      123 B
      2
      1

      DNS Request

      iloveu123.sphosting.com

      DNS Request

      iloveu123.sphosting.com

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\Hacker.com.cn.exe

      Filesize

      614KB

      MD5

      d757c8f286baaf93380e560c986b6222

      SHA1

      8c6bf2a37004c382c18e6b23ab0b8e5be1569e5d

      SHA256

      830bf8ebb7a9f6b44f657836c6dad8d1cebab16350f402dbf599d4f38e019ed0

      SHA512

      1f69ecc47e5dad5788db34e2def9a4991345a4fac2ef322cd80451ead1f65e6d5af00785f56663055796c3bb7b935f5d74895b31a3075adc1cffb1cb9f666700

    • memory/2228-0-0x0000000000400000-0x000000000055D000-memory.dmp

      Filesize

      1.4MB

    • memory/2228-1-0x0000000000300000-0x0000000000354000-memory.dmp

      Filesize

      336KB

    • memory/2228-3-0x0000000000560000-0x0000000000561000-memory.dmp

      Filesize

      4KB

    • memory/2228-2-0x0000000000580000-0x0000000000581000-memory.dmp

      Filesize

      4KB

    • memory/2228-5-0x00000000003E0000-0x00000000003E1000-memory.dmp

      Filesize

      4KB

    • memory/2228-4-0x00000000005B0000-0x00000000005B1000-memory.dmp

      Filesize

      4KB

    • memory/2228-7-0x00000000005A0000-0x00000000005A1000-memory.dmp

      Filesize

      4KB

    • memory/2228-6-0x00000000003D0000-0x00000000003D1000-memory.dmp

      Filesize

      4KB

    • memory/2228-9-0x00000000005C0000-0x00000000005C1000-memory.dmp

      Filesize

      4KB

    • memory/2228-8-0x0000000000590000-0x0000000000591000-memory.dmp

      Filesize

      4KB

    • memory/2228-10-0x00000000003F0000-0x00000000003F1000-memory.dmp

      Filesize

      4KB

    • memory/2228-11-0x0000000003270000-0x000000000331F000-memory.dmp

      Filesize

      700KB

    • memory/2228-12-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-13-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-14-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-17-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-18-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-19-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-20-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-21-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-22-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-23-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-24-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-25-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-26-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-27-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-28-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-29-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-30-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-31-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-32-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-33-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-34-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-35-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-36-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-37-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-38-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-39-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-40-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-41-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-42-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-45-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-46-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-43-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-47-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-49-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-50-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-51-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-52-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-53-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-54-0x0000000003270000-0x0000000003370000-memory.dmp

      Filesize

      1024KB

    • memory/2228-55-0x00000000003C0000-0x00000000003C1000-memory.dmp

      Filesize

      4KB

    • memory/2228-56-0x00000000005D0000-0x00000000005D2000-memory.dmp

      Filesize

      8KB

    • memory/2228-143-0x0000000000400000-0x000000000055D000-memory.dmp

      Filesize

      1.4MB

    • memory/2648-57-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-59-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-58-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-60-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-61-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-62-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-63-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-64-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-65-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-66-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-67-0x0000000003150000-0x0000000003250000-memory.dmp

      Filesize

      1024KB

    • memory/2648-145-0x0000000000400000-0x000000000055D000-memory.dmp

      Filesize

      1.4MB

    • memory/2648-174-0x0000000000400000-0x000000000055D000-memory.dmp

      Filesize

      1.4MB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.