Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240319-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/03/2024, 12:14

General

  • Target

    CCleaner.v4.04.4197.exe

  • Size

    3.0MB

  • MD5

    641290aa3e40d617e7e7967b84c167f5

  • SHA1

    6364021d3b3efaac7112cb33f1baae05a9f498a7

  • SHA256

    a6a0cf55d8736aa6210c1d2c8616c748323c7bd53a9c5dd7cdd228403ee988e7

  • SHA512

    01c303291b337c57c253313899ec06a92be1c0e9536c944f599a0d9867dd44466db667cb13192382eee802636deba068b5faa08dbef980f295bb6bedc465e196

  • SSDEEP

    49152:BWK488vAzCjUg+ioa/B78g+pYLIvSM9s3SyzbGsP+JOll4CjFCgHZSzZk7YP/Y7/:LnzCjU7i/ugMcIqws3Pblm4llbFCNZkX

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 2 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Users\Admin\AppData\Local\Temp\CCleaner.v4.04.4197.exe
    "C:\Users\Admin\AppData\Local\Temp\CCleaner.v4.04.4197.exe"
    1⤵
    • Loads dropped DLL
    PID:3968
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2232,i,3915538061666887171,15629965885515244134,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1072

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsh7FFF.tmp\Aero.dll

      Filesize

      6KB

      MD5

      869c5949a10b32d3a31966cc5291301b

      SHA1

      329080c974d593ecdefd02afa38dd663a10331c4

      SHA256

      b19961de6ca07e08704d6372718542f70dbbb203e59bf9bbe3a58f6e069a625c

      SHA512

      3b9dde16e9ca803b1048243dbf29c717ac0472dffa764542c234318a960828834aa650b1dfb8bba66c4e7a9ce3aaf453829afc57dfb33dc8c311d203150d4fca

    • C:\Users\Admin\AppData\Local\Temp\nsh7FFF.tmp\nsDialogs.dll

      Filesize

      9KB

      MD5

      4ccc4a742d4423f2f0ed744fd9c81f63

      SHA1

      704f00a1acc327fd879cf75fc90d0b8f927c36bc

      SHA256

      416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6

      SHA512

      790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb

    • memory/3968-7-0x0000000074A70000-0x0000000074A79000-memory.dmp

      Filesize

      36KB

    • memory/3968-16-0x0000000074A70000-0x0000000074A79000-memory.dmp

      Filesize

      36KB