Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

7

669163c950...4e.exe

windows7-x64

7

669163c950...4e.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    91s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/04/2024, 22:44

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    669163c950d22460542d4cfce2489c4e.exe

  • Size

    244KB

  • MD5

    669163c950d22460542d4cfce2489c4e

  • SHA1

    75dd0ad534f687b1ac0a7e8b52022739d99a97b6

  • SHA256

    0c873f499e3fe5d412d7dc61ebaa17fcacf71031ff1521c329b509adb2de236c

  • SHA512

    6e233719db3dbeedc40ea0b025968c1758a89642c4847ada333411c3abe40359e324a00caa6d3be84785b0583bf232fb805b9a4c3a0afb34a25dacc7eb0847db

  • SSDEEP

    6144:X42FMaP+6+tT/JBnjBE3XwfSZ4sXyzQI6F:IKbGlJBjBEnwxEI6

Score
7/10
persistenceupx

Malware Config

Signatures

  • Executes dropped EXE 26 IoCs
  • UPX packed file 42 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Adds Run key to start application 2 TTPs 26 IoCs
    persistence
  • Modifies registry class 54 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\669163c950d22460542d4cfce2489c4e.exe
    "C:\Users\Admin\AppData\Local\Temp\669163c950d22460542d4cfce2489c4e.exe"
    1⤵
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4892
    • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202.exe
      c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:3372
      • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202a.exe
        c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202a.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:3104
        • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202b.exe
          c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202b.exe
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:1032
          • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202c.exe
            c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202c.exe
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4504
            • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202d.exe
              c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202d.exe
              6⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:2888
              • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202e.exe
                c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202e.exe
                7⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:5080
                • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202f.exe
                  c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202f.exe
                  8⤵
                  • Executes dropped EXE
                  • Adds Run key to start application
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:4068
                  • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202g.exe
                    c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202g.exe
                    9⤵
                    • Executes dropped EXE
                    • Adds Run key to start application
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:5048
                    • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202h.exe
                      c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202h.exe
                      10⤵
                      • Executes dropped EXE
                      • Adds Run key to start application
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:696
                      • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202i.exe
                        c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202i.exe
                        11⤵
                        • Executes dropped EXE
                        • Adds Run key to start application
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:764
                        • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202j.exe
                          c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202j.exe
                          12⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:3872
                          • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202k.exe
                            c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202k.exe
                            13⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:2972
                            • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202l.exe
                              c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202l.exe
                              14⤵
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:3828
                              • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202m.exe
                                c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202m.exe
                                15⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:4112
                                • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202n.exe
                                  c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202n.exe
                                  16⤵
                                  • Executes dropped EXE
                                  • Adds Run key to start application
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:5112
                                  • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202o.exe
                                    c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202o.exe
                                    17⤵
                                    • Executes dropped EXE
                                    • Adds Run key to start application
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:2492
                                    • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202p.exe
                                      c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202p.exe
                                      18⤵
                                      • Executes dropped EXE
                                      • Adds Run key to start application
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:2980
                                      • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202q.exe
                                        c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202q.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • Adds Run key to start application
                                        • Modifies registry class
                                        • Suspicious use of WriteProcessMemory
                                        PID:5008
                                        • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202r.exe
                                          c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202r.exe
                                          20⤵
                                          • Executes dropped EXE
                                          • Adds Run key to start application
                                          • Modifies registry class
                                          • Suspicious use of WriteProcessMemory
                                          PID:948
                                          • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202s.exe
                                            c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202s.exe
                                            21⤵
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Modifies registry class
                                            • Suspicious use of WriteProcessMemory
                                            PID:2628
                                            • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202t.exe
                                              c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202t.exe
                                              22⤵
                                              • Executes dropped EXE
                                              • Adds Run key to start application
                                              • Modifies registry class
                                              • Suspicious use of WriteProcessMemory
                                              PID:4984
                                              • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202u.exe
                                                c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202u.exe
                                                23⤵
                                                • Executes dropped EXE
                                                • Adds Run key to start application
                                                • Modifies registry class
                                                PID:3568
                                                • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202v.exe
                                                  c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202v.exe
                                                  24⤵
                                                  • Executes dropped EXE
                                                  • Adds Run key to start application
                                                  • Modifies registry class
                                                  PID:4032
                                                  • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202w.exe
                                                    c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202w.exe
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Adds Run key to start application
                                                    • Modifies registry class
                                                    PID:3852
                                                    • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202x.exe
                                                      c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202x.exe
                                                      26⤵
                                                      • Executes dropped EXE
                                                      • Adds Run key to start application
                                                      • Modifies registry class
                                                      PID:1908
                                                      • \??\c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202y.exe
                                                        c:\users\admin\appdata\local\temp\669163c950d22460542d4cfce2489c4e_3202y.exe
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Modifies registry class
                                                        PID:1924

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\669163c950d22460542d4cfce2489c4e_3202.exe
    Filesize

    244KB

    MD5

    b1f7a77025ec8bd77fdd81103b91f344

    SHA1

    d96274a6fcc340bd85384a50914666cabd3b6f9d

    SHA256

    876dfebd7f7cd4c622ce8d9bfb153764bf2e8299e6cb7d07842c328255fec2fc

    SHA512

    4119a70cfb52f724a87f4255c500bbb49a50d8dc8a7b861a52847eb03d292a0f05c88ce1437156fea4e432d76ef7d29bca376e1b28e100f3d2c6a4aa6c97baf2

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\669163c950d22460542d4cfce2489c4e_3202k.exe
    Filesize

    244KB

    MD5

    3b09da6a70913c84b87abd7a7a7620d0

    SHA1

    63e66199bcf19883b3d4e9d7cd98817df4e01166

    SHA256

    9f304741c912abfbae74e650f0efbee94ca1ccf9fa95b8ab0358c0275ce6a143

    SHA512

    c7565d8508ea6dce323d5cae5ec961989ec35ce9f383131f9ba628ad229851f0e14db85bc20e199d4dfe227f6c732b56ff38a34675a69c8c4ab2a0ed31164ec4

    Download Submit

  • memory/696-92-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/696-187-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/764-101-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/948-189-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1032-36-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1032-128-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1908-244-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1908-252-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/1924-248-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2492-160-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2492-157-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2628-199-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2888-48-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2888-63-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2972-121-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2972-118-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2980-170-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/2980-168-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3104-19-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3104-29-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3372-15-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3372-25-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3568-217-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3828-130-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3852-238-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3872-206-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/3872-109-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4032-251-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4032-225-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4068-73-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4068-167-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4112-132-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4112-142-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4504-39-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4504-57-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4892-0-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4892-9-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4984-208-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/4984-250-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5008-178-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5008-249-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5048-85-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5080-66-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5112-234-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download

  • memory/5112-149-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

    Download