Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

18/04/2024, 05:22

240418-f2z8nscc74 10

18/04/2024, 05:22

240418-f2njwade8w 10

18/04/2024, 05:21

240418-f2gfkade8s 7

18/04/2024, 05:21

240418-f2csdacc53 10

18/04/2024, 05:21

240418-f2b6vade7x 7

Analysis

  • max time kernel
    291s
  • max time network
    296s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/04/2024, 05:21

General

  • Target

    d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe

  • Size

    371KB

  • MD5

    bb8cd5df2be7e8bcc5be439675b3d0a2

  • SHA1

    627ac60f64974d5caaf81c2de8ca0977c91f4219

  • SHA256

    d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a

  • SHA512

    57031eb7d7b2c27d7ecacdc085d07065ced46a742128f9818f62c9fe6633c31aa8eb20ffc52c8415613787946060f5a6b5adf8b977d5ca4fed9656233ebd9cfa

  • SSDEEP

    6144:tnzQnu/cmM1oSigOQT2F8U92Iu7DMVQZhWLvLRXdYX9ji+uhi2PsrhY:hzQnkM1oSiBGI8bxn5m6i+uo20tY

Score
7/10

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 3 IoCs

    Detects file using ACProtect software.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses Tor communications 1 TTPs

    Malware can proxy its traffic through Tor for more anonymity.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe
    "C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2756
    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.rtf" /o ""
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of SetWindowsHookEx
      PID:3676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD9F83.tmp\sist02.xsl

    Filesize

    245KB

    MD5

    f883b260a8d67082ea895c14bf56dd56

    SHA1

    7954565c1f243d46ad3b1e2f1baf3281451fc14b

    SHA256

    ef4835db41a485b56c2ef0ff7094bc2350460573a686182bc45fd6613480e353

    SHA512

    d95924a499f32d9b4d9a7d298502181f9e9048c21dbe0496fa3c3279b263d6f7d594b859111a99b1a53bd248ee69b867d7b1768c42e1e40934e0b990f0ce051e

  • C:\Users\Admin\AppData\Local\Temp\d351ac17dc0d9476ef029484a165f99e258f546bba2d619b1c6485cb8875ac7a.rtf

    Filesize

    4KB

    MD5

    2d5020c82de674b48cfd17cc20fcbba2

    SHA1

    4e317eaeebd839ee5f6eb3925a9fbee819c5349c

    SHA256

    120becd55248f4a2ccbbc99ba9d3c2932223264a95cd72e9ae7568be61277e9a

    SHA512

    ffbbdda009237d6825f6cd6f751a41f4f9d716186901ffdbeed56c2d1410245771decd07f591cf56cafdd4bbebd4e4c74f009ff15736d5321635e34ff17d0d8d

  • memory/2756-531-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

  • memory/2756-53-0x0000000003A70000-0x0000000003A98000-memory.dmp

    Filesize

    160KB

  • memory/2756-4-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

  • memory/2756-6-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

  • memory/2756-11-0x0000000000400000-0x0000000000461000-memory.dmp

    Filesize

    388KB

  • memory/2756-596-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-587-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-48-0x0000000003A60000-0x0000000003A68000-memory.dmp

    Filesize

    32KB

  • memory/2756-545-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-542-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-541-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-0-0x0000000002B50000-0x0000000002BA8000-memory.dmp

    Filesize

    352KB

  • memory/2756-1-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

    Filesize

    4KB

  • memory/2756-51-0x0000000003A60000-0x0000000003A68000-memory.dmp

    Filesize

    32KB

  • memory/2756-22-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

    Filesize

    4KB

  • memory/2756-60-0x0000000003A70000-0x0000000003A98000-memory.dmp

    Filesize

    160KB

  • memory/2756-58-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-57-0x0000000003A70000-0x0000000003A98000-memory.dmp

    Filesize

    160KB

  • memory/2756-56-0x0000000003A70000-0x0000000003A98000-memory.dmp

    Filesize

    160KB

  • memory/2756-2-0x0000000002B50000-0x0000000002BA8000-memory.dmp

    Filesize

    352KB

  • memory/2756-43-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-47-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-46-0x0000000010000000-0x0000000010012000-memory.dmp

    Filesize

    72KB

  • memory/2756-52-0x0000000003A60000-0x0000000003A68000-memory.dmp

    Filesize

    32KB

  • memory/2756-3-0x0000000002FE0000-0x0000000002FE1000-memory.dmp

    Filesize

    4KB

  • memory/3676-21-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-576-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-26-0x00007FF7C7BC0000-0x00007FF7C7BD0000-memory.dmp

    Filesize

    64KB

  • memory/3676-25-0x00007FF7C7BC0000-0x00007FF7C7BD0000-memory.dmp

    Filesize

    64KB

  • memory/3676-24-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-59-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-23-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-405-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-512-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-20-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-19-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-17-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-18-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-16-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-573-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-574-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-15-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-575-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-577-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-578-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-579-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-580-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB

  • memory/3676-13-0x00007FF7CA250000-0x00007FF7CA260000-memory.dmp

    Filesize

    64KB

  • memory/3676-14-0x00007FF80A1D0000-0x00007FF80A3C5000-memory.dmp

    Filesize

    2.0MB