Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    20/03/2024, 01:10

General

  • Target

    d78aae49719adefaa582cfab46b68924.exe

  • Size

    114KB

  • MD5

    d78aae49719adefaa582cfab46b68924

  • SHA1

    5853a26306c7b60c3ae68d81f3d02b9e4111ea0d

  • SHA256

    04e0af587e57411b9f9ad631c96d1db0bc67d9a70b496eddcf5a21a2a3fe5c03

  • SHA512

    f586e59d217aaf9a939f9de34d6440581791c20b6bb80e9fe351b07e3b16971e6b46dfe65bbf4317031ad9111a2802c332f743beffbb9fd2a211848d27f7dba1

  • SSDEEP

    3072:mX7DItrfaocyTgfsqQOlJcGZPnzhR7SGcnvyf8I8qU:msaocyLC1nzUvEKqU

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 36 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d78aae49719adefaa582cfab46b68924.exe
    "C:\Users\Admin\AppData\Local\Temp\d78aae49719adefaa582cfab46b68924.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2464
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://torrent3.ru/uploads/torrent/Mount-and-Blade-Warband.torrent
      2⤵
      • Modifies Internet Explorer Phishing Filter
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2916
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2916 CREDAT:275457 /prefetch:2
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2620

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

    Filesize

    67KB

    MD5

    753df6889fd7410a2e9fe333da83a429

    SHA1

    3c425f16e8267186061dd48ac1c77c122962456e

    SHA256

    b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

    SHA512

    9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2ac55f2ae74f94789ea4a4ea3184f6ca

    SHA1

    253612983df0241582de9ecb62ec0939d3d6d159

    SHA256

    3bf594390340dce21aa54d266ddfd321b6f52dad700c1a67445795d34e5efc12

    SHA512

    62f61002995ebdec0b2abac88666f1d3a99e428f44c4b0e710afb30424449c8a046d8ced74bf057dd45b87bc644c51a89bae4e7113f8744d273285b8c9f42a3b

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    def550386c43d29b25844080ccbde101

    SHA1

    4e1ff554e72a88b2342057afebe74c73b52f21bf

    SHA256

    322684bf53d079b9ab7d62f5cfd688cd066efd2658af89d668481744ce069f73

    SHA512

    ed2a4f97c5ac4e1d97f589c88eb22ea3f4a2d0594ff8168c8ea9feba678058c3a051acb7bdc2412b1bed777b90c36ab552d722261336eaf5ab72d5fab4385b00

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0b76abb2bdf94e5505417e9d2f6c2032

    SHA1

    1ced6b6b5ba9b0271eabbf55ad4fd62d5879db9d

    SHA256

    0e090ee077a3d9df7e06f737d9edcbcfe10b30686d1bd9933b6122790158b439

    SHA512

    4c31880567a7c7c7170ec011cdf432ffa5e124a930147c853fe8da125ad3574c934dd03f662a344fb77675c59ca38d14574c1543d1b54ce4bbc44c26662fcb8e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fac29764d5f01d16da4f572cf5f1c8e5

    SHA1

    bbf606c6a684001e27c3281eb5f961e9444c80f4

    SHA256

    5f751330c9ff808b7ea5453ea832a503f298cc3600ece2903ee8e111f5d4f6f8

    SHA512

    4eac33add54bfaebbd06057d5c145920876d57fe07637401773cf228a878140ac1ae49d04d83885f149fdfe5527c134594a659909d1360ae020327b319b3f90a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    05ec64033b36d345494ed759a526fe28

    SHA1

    a02201e7d505d0900942478adea9df789d8796f5

    SHA256

    1f314921026a7cf80b413aec234b85ff2eb8e326699c1b5a919ad9a3edefb2bf

    SHA512

    0a7a0fd355992fd1faabdaea4f8a23b07b16ada3890e9e76e0b8103a2824162d04c88f0e8219e2866c6030c786adbd889f957a33cef38b601ce374124ab5ebb9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5ae8c1cc20833f46e1dfaa43eeb0c9e5

    SHA1

    6b7b45a752163784ea13540c975f4209db3b5926

    SHA256

    3df135d331662c5cbcc8ffb0aae05254d4bd4bac83afc5012392768915f2db26

    SHA512

    286299a78a441602528a2e6d16b55336ac8a119a01e84178e5a54fcf82ba3fa48754c03a2359991690af69df6352c8ea3a3084b21a8fd90f3d9eb1f6932dc91d

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    19f4bac0883d845085932c9ccaa47301

    SHA1

    e59fd9005dbdaa24f1e6f79020f203b9b58720c5

    SHA256

    a5562e38aff1f0d8d252f312ac43104c1999dc07276373bfbceb276c8e216a61

    SHA512

    f12a468a9591bc047ac3e043ab7abc9fe9e041d573378fd358da15f06db4c2bf6e930c6f9a4aaba4cb6d44bdbf1ce590beefad0b28d7517646327d3aa0c0ac32

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    5970ecea670f165a7f4b86d70f720a5c

    SHA1

    ece0e382975f533113c29fb721e59f5006b41a64

    SHA256

    b3af36c6ea5df6aadbdc96ccbe70a74e19a658777d57ce49dd7dcdce436dd28d

    SHA512

    e67a8e43e4d53571ebe76a97c959fa8c27132c801cc682529123a1cdf6759b03e1581946c4697b3cd6050f3bef2f4a53ea7be660fa01a125ceb072eee46a4cb8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    018c7813ff5cadde8d34966d4de3fc8a

    SHA1

    c602008dce96992e47030ba9222b810833edc376

    SHA256

    a4bace42c733be5f6c8e846aa24e7fb953be9df2df6242c4d096d833db85cdca

    SHA512

    613fd7b6e81c6d9f34ca24bba16370bdb41af39c1a41d8ebbce43cab15edfeaa75df8acc331cd43d9f64e4408b105dc12e0566bec25200f4884204cff2c7bf93

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    0a69be0b9b34a046d90eb539ee91528d

    SHA1

    049d1992f4b119c52df05dd14159510b2f463c6d

    SHA256

    8f6ecd4a48b66e27027a53b7459b64bb8c94b48ac8a1c373f05c9e88ac5017b7

    SHA512

    216e288f4b1fcc50b42d1cb403dda6902f81c69578d6dda7693338bff0af59c357237c0dd98e0bdb71889b33c17383bddce77e5156804761e8aac17a0323cc19

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    2824c03acfc122290baf44aa00b1239a

    SHA1

    dc76afa1e577c4da2d05185cbd7b16f132c7cb0f

    SHA256

    90e9b41a96f4c08b72faa046c4b24674e2eccc5d2e63554a33c7aab6db3d051e

    SHA512

    23c5feae425762247d71e26eeec5610b7fed135cffe23a2ccc2699b4c85c0b5c4a95fede483eb4238f355fafaecd5da570c1942eedc84a6f750a9855bf1e74ee

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b6e4c0080da3e2d1d49bba45b99a5829

    SHA1

    f74f0bd94fd58fe2fbe4d15698fc590ace59eb7c

    SHA256

    ec91de94324e4b5fe3dc24c03bf4245d8945eaf8fe891a605d40c348228e6a8e

    SHA512

    58d00260f7a34baea0a7fa5c7744f4a2acf4eee7a512146832601a8d89788194066f3e84d98ec4f34592688611a8c72805dd0b194ee950d9bce83ad89c1c0536

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    b6d7832ab901396f6d7c1f5a8cff7aab

    SHA1

    3f045638d4978d796bd7dd815726fffa1ff903ac

    SHA256

    a840f1bc1b150f04b05de37b6c286aee40c8b0295022eacfd62658c8dd7165bd

    SHA512

    220f1a20adbc810232f70ac0c731ed82e9eab37bbf9d5835e3c9efbd270791128d1d2358cf2c24a57e75e65ccfdf5793def90f2e99d611a499d899397c3d4fd1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    18ee8b12d9bd8df238042d8db01ff315

    SHA1

    2e9f84c198cb69085789a66138988c33ff632315

    SHA256

    058a8404ab3be1108b1ce805e5658c661cc512ed6e398d05aea7326e4406c9be

    SHA512

    924e0f9d50cd37aca74b76a172b9a467317d0485d0fe6d676dd15487e91e49b4dd0f2f9f7a90560d5f59f0331212376995e44ebb14221a4a61d228956485d1f3

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    412ae4cf7004501b7199ccad59a9157a

    SHA1

    7b1caabbbd71340d9ce960ba2ab71ae18473a807

    SHA256

    f420ef7582a252995d920a78014b22d2b85ad6d8e375502b5442d5efa29df641

    SHA512

    ac85bef67b864355883834ec938c36ab92ef6d7dfd86ad3811ed502e7f92cf9c69a8346e2c2711a5b3e89ae5f07c2709a2173a9f010ce7459312be03eba5bd1f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    fd13443f555f6031e91cfe765b92e743

    SHA1

    b7e2c08c895a42bdfa05fd7a17e9e818e9ae53b2

    SHA256

    26f077f7cfcb8cefa9d8c032d90b2d588118c580e29a94ba8c5a5be230455e3d

    SHA512

    68a446172e13d87d282b5911a25e19a74fe770ee2c934e548240233eca9b905c3aca92597ceedb575b278fd6953322ea6d42feeb61cba391c172fb8de9811d87

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    33ded5d919e7ec4eb2d06b30388698f2

    SHA1

    5e641d0153e03cdb57c9d5b17a4dc7cfd00edd78

    SHA256

    6502b11e3a0848595dd80c955f799b77034bebe20e109493536fd0841616f4a5

    SHA512

    92a25580f45716adf7b2e532f638e3f820bdb26794789b8c439139796fa570dbd67ead0943e22ed035f3e392828f890b9d676d92abd94b5fcbbe16293fd90140

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    344B

    MD5

    c6dfeb049ae9248513997e3a49b55031

    SHA1

    315ba9b79d2fab0b7788372ba901274765591136

    SHA256

    f63627e71f4c9a5b9ca4d377feefe54999f77185334680d199486c59be18da47

    SHA512

    e59e0e84f12a7c2c2dec0abdc69e42b9e9bcdd01269f57d90be6f2909fa55e62401fbd5018bf45a63f9d6afb5f5edfb398d200799c27d8b60251961a30172d33

  • C:\Users\Admin\AppData\Local\Temp\Cab2A6C.tmp

    Filesize

    65KB

    MD5

    ac05d27423a85adc1622c714f2cb6184

    SHA1

    b0fe2b1abddb97837ea0195be70ab2ff14d43198

    SHA256

    c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

    SHA512

    6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

  • C:\Users\Admin\AppData\Local\Temp\Tar2C0A.tmp

    Filesize

    175KB

    MD5

    dd73cead4b93366cf3465c8cd32e2796

    SHA1

    74546226dfe9ceb8184651e920d1dbfb432b314e

    SHA256

    a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

    SHA512

    ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

  • \Users\Admin\AppData\Local\Temp\nsd124B.tmp\System.dll

    Filesize

    23KB

    MD5

    125aebb055446fb52aa5956cf99e8a9a

    SHA1

    6b58fd08a8ff2763219cc6b0dcdb875f9970f850

    SHA256

    2e1b11ee20e5061ea86dc6b01e3efc659e887540afcab7317cdfd6a8eff87ec3

    SHA512

    5f85e48bd3ae2fd2be0595b93cbf74674e0281210688dcc73691178b295a702e8d43898afb6e5d8b7e82de98b4ee28194c9838ddf8279cde85f7fe48d34dc8b7

  • \Users\Admin\AppData\Local\Temp\nsd124B.tmp\nsDialogs.dll

    Filesize

    11KB

    MD5

    790d227d847f7571c8d58a79057a469e

    SHA1

    75c347b1441383c61166b615dfd6e7e65b04629f

    SHA256

    37e99ab9db0045870e31db147438cf0c69b6fcdec4f3737a9743c447cbc0c3c0

    SHA512

    5821605bfb3e57ddfcc1a74829968814aae92b13cb713ef3628913d9112d493117e8aa9cc437770facdcd2d4bd1e53a271d491e6b4d3e4cff53bd027f4b07f4c

  • memory/2464-10-0x0000000000400000-0x0000000000464000-memory.dmp

    Filesize

    400KB

  • memory/2464-11-0x000000006E3C0000-0x000000006E3CD000-memory.dmp

    Filesize

    52KB

  • memory/2464-12-0x000000006E940000-0x000000006E94A000-memory.dmp

    Filesize

    40KB