Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
37383bd44fc...22.exe
windows7-x64
77383bd44fc...22.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3Analysis
-
max time kernel
114s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240215-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240412-en
General
-
Target
7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
-
Size
35.0MB
-
MD5
af7abbbc2a5949f8b21c8efaaf68ee0c
-
SHA1
65860db5f44133770a8340d537dd9af6755cd955
-
SHA256
7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22
-
SHA512
632e3e7a59fa8e3e4dd784472ad2db1e52686d6a570d8b75fb072a088d91065757ba25d59a9970cabea51593c17402d6c5a6d635bcb4f7246cff86fb53663455
-
SSDEEP
786432:OI2HW0tLW3Xz4eEgs3aA5Mx0K7a8o1NP/0oNEsNnk7KL4WOZn0ztJHhhpVz:p6reEgs3aA5Mx6NVNEsNnkoSZ0zrP/z
Malware Config
Signatures
-
Loads dropped DLL 32 IoCs
pid Process 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe 680 7383bd44fc30ed8f7e07c387e3dcbef554269a4121401ee5b726dac25ea4ce22.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54c2048fab3e88d65b1186de260751d1b
SHA1a586394a689652f1f803c40e564af459140f530a
SHA256b08d6797848ee8eef5393391a7318e10720d55d03c910a2127c03b074c4966af
SHA512cfc39b9a96f0df06e50d7560557b8fd86ce22860a4d7a7e9562abdbd2503c33fed8595e04ce55f45181f2b7c4d1a421713cfeeee3c6d8b56be4d0aec7fd81777
-
Filesize
5KB
MD5a1cd3f159ef78d9ace162f067b544fd9
SHA172671fdf4bfeeb99b392685bf01081b4a0b3ae66
SHA25647b9e251c9c90f43e3524965aecc07bd53c8e09c5b9f9862b44c306667e2b0b6
SHA512ccc70166c7d7746cd42cd0cec322b2adf4a478ff67c35d465f0f0f5b2b369c996a95557b678c09cb21b8311d8a91eed4196ddc218ea7d510f81464669b911362
-
Filesize
7KB
MD5bd393029cc49b415b6c9aeb8a4936516
SHA1c67fd92fffd18941bed41bfd6ac4f3b04fd123df
SHA256227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
SHA5123bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
180KB
MD511214a108121ebee3ad5ec75bf1e330f
SHA1cd6a32938abd8b82c579fbfec337aa8bbecef6ed
SHA256da6c8d8a28ba2d7f09b1b357464fb6e8f405d78b71bb34cade83b131711bb94c
SHA512497eefff3ab90db02f63bed5d0a8a3510b872839a4137005e01a296445ad0d7fb2d560320948cf77953b64d45491f99b1c302947e3cb26d21cbfb18122c96301
-
Filesize
23KB
MD57760daf1b6a7f13f06b25b5a09137ca1
SHA1cc5a98ea3aa582de5428c819731e1faeccfcf33a
SHA2565233110ed8e95a4a1042f57d9b2dc72bc253e8cb5282437637a51e4e9fcb9079
SHA512d038bea292ffa2f2f44c85305350645d504be5c45a9d1b30db6d9708bfac27e2ff1e41a76c844d9231d465f31d502a5313dfded6309326d6dfbe30e51a76fdb5
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
4KB
MD5f0438a894f3a7e01a4aae8d1b5dd0289
SHA1b058e3fcfb7b550041da16bf10d8837024c38bf6
SHA25630c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11
SHA512f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7
-
Filesize
169KB
MD5567103638bb0c81cf9bd86f727ea12ac
SHA1ddc03ea66412f11b5975092f92067a85d29d17b1
SHA25637dd96230521a91dc7eba0d0a4fe8726b4405562b1a96363a01e28334bde94fd
SHA5121d64a197489ea45e21a89ec535ca0282eed47ade40589dee31de865870ddb91ffc0921a5eacea89ddf9bc1d9b93bb7edf6f6c3148a18a9611df87be0fc369fa4
-
Filesize
6KB
MD5725a694a4711245e8ec2beafbbb60d2a
SHA1f7b548df9469faac87c68ac020b32985c62d4e0f
SHA256ee9da9fad0ae660326395e1d5c293838253389f4939d6216aab945e0228fecab
SHA51288cd491084fdc23eb604422931d0285aa015f52f877d53099211edc3c4905b59a33fecdd9efb41b77b396aa84e59638479333692bf1ac2f93936a0ffac75d49d