Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/05/2024, 12:28
240507-pnhadaac95 1007/05/2024, 12:28
240507-pnd8qaff8s 1007/05/2024, 12:28
240507-pnc1naff7z 1007/05/2024, 12:28
240507-pnbgtsac85 1007/05/2024, 12:28
240507-pnawasff7w 1025/04/2024, 13:10
240425-qegsxsba4s 10Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 12:28
Behavioral task
behavioral1
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral2
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win7-20240419-en
Behavioral task
behavioral3
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral5
Sample
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
Resource
win11-20240419-en
General
-
Target
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe
-
Size
7.8MB
-
MD5
feb61ffde2dd829e738ea35dc8ee6208
-
SHA1
659e17fe8390c0494e1363c2ebd11333638fd56e
-
SHA256
a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449
-
SHA512
609d2a7950643bea16e353d73157429f304cd1807808becb6fd2c5bbeeb07c6583a98f0e76b7e051390771502cabc7bbda4360f53388867ab863c6f564fbd959
-
SSDEEP
196608:oIRcbH4jSteTGv1xwhzav1yo31CPwDv3uFZjeg2EeJUO9WLQkDxtw3iFFrS6XOf:odHsfu1xwZ6v1CPwDv3uFteg2EeJUO9E
Malware Config
Extracted
bitrat
1.38
n7dua2r7ev3r6fsisszycs7fvy4a36epnfje5s7lz5eiduoxetqg55ad.onion:1235
-
communication_password
99754106633f94d350db34d548d6091a
-
install_dir
temp
-
install_file
test1
-
tor_process
test2
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral4/files/0x000d000000023a7a-18.dat acprotect behavioral4/files/0x000c000000023aac-21.dat acprotect behavioral4/files/0x000c000000023adf-24.dat acprotect behavioral4/files/0x0011000000023aab-31.dat acprotect behavioral4/files/0x000c000000023ab4-29.dat acprotect behavioral4/files/0x0011000000023a7b-25.dat acprotect behavioral4/files/0x000c000000023ab2-23.dat acprotect -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\Control Panel\International\Geo\Nation a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Executes dropped EXE 3 IoCs
pid Process 632 test2.exe 4264 test2.exe 2704 test2.exe -
Loads dropped DLL 22 IoCs
pid Process 632 test2.exe 632 test2.exe 632 test2.exe 632 test2.exe 632 test2.exe 632 test2.exe 632 test2.exe 632 test2.exe 4264 test2.exe 4264 test2.exe 4264 test2.exe 4264 test2.exe 4264 test2.exe 4264 test2.exe 4264 test2.exe 2704 test2.exe 2704 test2.exe 2704 test2.exe 2704 test2.exe 2704 test2.exe 2704 test2.exe 2704 test2.exe -
resource yara_rule behavioral4/files/0x000c000000023ab7-14.dat upx behavioral4/memory/632-19-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/files/0x000d000000023a7a-18.dat upx behavioral4/files/0x000c000000023aac-21.dat upx behavioral4/files/0x000c000000023adf-24.dat upx behavioral4/files/0x0011000000023aab-31.dat upx behavioral4/files/0x000c000000023ab4-29.dat upx behavioral4/files/0x0011000000023a7b-25.dat upx behavioral4/files/0x000c000000023ab2-23.dat upx behavioral4/memory/632-37-0x0000000073E40000-0x0000000073E89000-memory.dmp upx behavioral4/memory/632-38-0x0000000073D70000-0x0000000073E38000-memory.dmp upx behavioral4/memory/632-42-0x0000000073AD0000-0x0000000073BDA000-memory.dmp upx behavioral4/memory/632-41-0x0000000073BE0000-0x0000000073C04000-memory.dmp upx behavioral4/memory/632-40-0x0000000073C10000-0x0000000073C98000-memory.dmp upx behavioral4/memory/632-39-0x0000000073CA0000-0x0000000073D6E000-memory.dmp upx behavioral4/memory/632-44-0x0000000073800000-0x0000000073ACF000-memory.dmp upx behavioral4/memory/632-47-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-80-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-88-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-90-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-105-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-115-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-124-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-133-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/632-159-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/4264-168-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/4264-174-0x0000000073890000-0x000000007399A000-memory.dmp upx behavioral4/memory/4264-175-0x0000000073800000-0x0000000073888000-memory.dmp upx behavioral4/memory/4264-173-0x00000000739A0000-0x00000000739C4000-memory.dmp upx behavioral4/memory/4264-172-0x00000000739D0000-0x0000000073A19000-memory.dmp upx behavioral4/memory/4264-171-0x0000000073A20000-0x0000000073AEE000-memory.dmp upx behavioral4/memory/4264-170-0x0000000073AF0000-0x0000000073BB8000-memory.dmp upx behavioral4/memory/4264-169-0x0000000073BC0000-0x0000000073E8F000-memory.dmp upx behavioral4/memory/4264-206-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/4264-207-0x0000000073BC0000-0x0000000073E8F000-memory.dmp upx behavioral4/memory/4264-208-0x0000000073AF0000-0x0000000073BB8000-memory.dmp upx behavioral4/memory/4264-209-0x0000000073A20000-0x0000000073AEE000-memory.dmp upx behavioral4/memory/4264-247-0x0000000000CB0000-0x00000000010B4000-memory.dmp upx behavioral4/memory/2704-262-0x0000000073800000-0x0000000073824000-memory.dmp upx behavioral4/memory/2704-261-0x0000000073830000-0x00000000738B8000-memory.dmp upx behavioral4/memory/2704-260-0x00000000738C0000-0x00000000739CA000-memory.dmp upx behavioral4/memory/2704-259-0x00000000739D0000-0x0000000073A19000-memory.dmp upx behavioral4/memory/2704-258-0x0000000073A20000-0x0000000073AEE000-memory.dmp upx behavioral4/memory/2704-257-0x0000000073AF0000-0x0000000073BB8000-memory.dmp upx behavioral4/memory/2704-256-0x0000000073BC0000-0x0000000073E8F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\test1 = "C:\\Users\\Admin\\AppData\\Local\\temp\\test1" a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 58 myexternalip.com 59 myexternalip.com 100 myexternalip.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
pid Process 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: RenamesItself 28 IoCs
pid Process 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1132 wrote to memory of 632 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 91 PID 1132 wrote to memory of 632 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 91 PID 1132 wrote to memory of 632 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 91 PID 1132 wrote to memory of 4264 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 106 PID 1132 wrote to memory of 4264 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 106 PID 1132 wrote to memory of 4264 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 106 PID 1132 wrote to memory of 2704 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 1132 wrote to memory of 2704 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116 PID 1132 wrote to memory of 2704 1132 a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe"C:\Users\Admin\AppData\Local\Temp\a4c959944542c7c2606d38cca52cfb4f37312144513089a7bafa533276872449.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:632
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4264
-
-
C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe"C:\Users\Admin\AppData\Local\d46500b0\tor\test2.exe" -f torrc2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
20KB
MD521f6b2a7ddbfc05964c12b75b973d1ee
SHA1dc9a8eed49c0592d58a3f6a3d7ec7c41d0f8bbcc
SHA2560ff1cd725ff7563eb48af796cd568bf800598aee049dd89b132a667d9b8dc3d0
SHA512097d2bbd1c295ca5da7bf564fa3e8a3d14bfb7d57ad2411b2bf9a950e4d0a5e9fc3e4e6510460188358aef38f840215cd948bf6c720e32d6be8f850caa4800b6
-
Filesize
2.4MB
MD50ce4530144899e61e7151afe7810919f
SHA1f300561ff8bbd2b426926aced1e576bd2b91d001
SHA25659f1410ba288f348e46546682bc8ae589accfdb2abc49b0b59fed35ed9de32e5
SHA512595a94b645837f8627b703920cec6eda3e6103ae964c91c383679f00b712343b7f8d4656db6efdaceabe8c641cf45d6461ff77cc9fafa263880bc1a0763a83e6
-
Filesize
17.7MB
MD533a75ee9c268d52617d651608bd87549
SHA13466eda6347e73845be732f748a8cb814b0ba083
SHA2562ce3419666cf4656b019455b05c24f79a0d1b0bebc2025319d28b0a67f68299b
SHA512ef39e065ba74c001dd812745ef821cbdda3dc9a868fbde744bb010c6f6000dd71e75a33ad8b28cb5a273534549ef69bc73541af2e7ec12ab14df1f417b4d2c39
-
Filesize
17.7MB
MD5353d5d4866bbe0a58954bd22ee049208
SHA16bc2f9870051e86fda9642542d29d763c90846c4
SHA2561a696e16262f7ccadf934a2a20f3818ab82366b56c4c9b9f01198940397b810e
SHA51211b2807d2bfe85b6d5da527daeed9e04f7c53c7793ab9355ad62eb43d4291360f23bf79384786eadb1ea30efb998f9b8cf173ce24347316019e11a32626350f6
-
Filesize
9.0MB
MD580ccc45b4a290d0707b8a57f0bb5fcad
SHA13d06dc63f241fddb04ceeab90a1ec5a28aa51877
SHA256d21bb1ff393e87cc97ca5c26e7ef7e77eec828b89555c59fc1d446249fc3038a
SHA51212fe4089f33bf31541877ec932f4e9417a6f011d5e1b92f9e745d5cd6bfa31d6fe6fb2bc8fbadc0fa20452eecabf7e3b12c2cd6d5548ecc202e7a46f42fb3391
-
Filesize
17KB
MD587c702bce0c1961c03b02297952801fa
SHA15e26c2a800e467f83ca6379eb81f3a9fcdf42250
SHA2565c99a92f9619a8c44477629c7d0f5dee04e7fd706a00b2167e19de7c4c1334dc
SHA512c9b3ee64c242085b7be2341d4da795eabbbdc7483f26a5714aa23190362fa2be43d939861ffee2b98a14727f45cdc711f601e89ce7cf9e5bc06a40d627acbc5b
-
Filesize
232B
MD55c1762600cce241bfc93fd92628e0c22
SHA11a6cc241b07197f3fa3fb150bc7d99d7c63f8059
SHA25675f6a5312b23c8a172111054a66fb49c125f051d2410cd958f342ae1522a20bf
SHA51292dc043082edd20b083b2327657aeacf1ca07c582b11d0a343f72abc20ec1e59f420bd0a71dba59e734f3e6f8bc2a5dbfa1ba6b41637a81ebd732bee76b3ea8e
-
Filesize
3KB
MD53bc8fa90b6f5fdb0cf3f565b3f433a9c
SHA1910dcf9e0ed9c21c07aa17c408e88f50b39812ae
SHA2569408e4abfbceff87a78d493f489d77ce439c4487a62afaf0eb74ff73e310e6db
SHA5123997a30851011d03dc74a3d9444cddf013e69f165652d46c625c99fb5a06e27ab6db33263c5e291be5571b9a65e702616d5bc3cd05f779f27097d09d2c4785dc
-
Filesize
1.7MB
MD52384a02c4a1f7ec481adde3a020607d3
SHA17e848d35a10bf9296c8fa41956a3daa777f86365
SHA256c8db0ff0f7047ed91b057005e86ad3a23eae616253313aa047c560d9eb398369
SHA5121ac74dd2d863acd7415ef8b9490a5342865462fbabdad0645da22424b0d56f5e9c389a3d7c41386f2414d6c4715c79a6ddecb6e6cff29e98319e1fd1060f4503
-
Filesize
366KB
MD5099983c13bade9554a3c17484e5481f1
SHA1a84e69ad9722f999252d59d0ed9a99901a60e564
SHA256b65f9aa0c7912af64bd9b05e9322e994339a11b0c8907e6a6166d7b814bda838
SHA51289f1a963de77873296395662d4150e3eff7a2d297fb9ec54ec06aa2e40d41e5f4fc4611e9bc34126d760c9134f2907fea3bebdf2fbbd7eaddad99f8e4be1f5e2
-
Filesize
286KB
MD5b0d98f7157d972190fe0759d4368d320
SHA15715a533621a2b642aad9616e603c6907d80efc4
SHA2562922193133dabab5b82088d4e87484e2fac75e9e0c765dacaf22eb5f4f18b0c5
SHA51241ce56c428158533bf8b8ffe0a71875b5a3abc549b88d7d3e69acc6080653abea344d6d66fff39c04bf019fcaa295768d620377d85a933ddaf17f3d90df29496
-
Filesize
439KB
MD5c88826ac4bb879622e43ead5bdb95aeb
SHA187d29853649a86f0463bfd9ad887b85eedc21723
SHA256c4d898b1a4285a45153af9ed88d79aa2a073dcb7225961b6b276b532b4d18b6f
SHA512f733041ef35b9b8058fbcf98faa0d1fea5c0858fea941ecebbe9f083cd73e3e66323afffd8d734097fcdd5e6e59db4d94f51fca5874edbcd2a382d9ba6cd97b3
-
Filesize
88KB
MD52c916456f503075f746c6ea649cf9539
SHA1fa1afc1f3d728c89b2e90e14ca7d88b599580a9d
SHA256cbb5236d923d4f4baf2f0d2797c72a2cbae42ef7ac0acce786daf5fdc5b456e6
SHA5121c1995e1aa7c33c597c64122395275861d9219e46d45277d4f1768a2e06227b353d5d77d6b7cb655082dc6fb9736ad6f7cfcc0c90e02776e27d50857e792e3fd
-
Filesize
188KB
MD5d407cc6d79a08039a6f4b50539e560b8
SHA121171adbc176dc19aaa5e595cd2cd4bd1dfd0c71
SHA25692cfd0277c8781a15a0f17b7aee6cff69631b9606a001101631f04b3381efc4e
SHA512378a10fed915591445d97c6d04e82d28008d8ea65e0e40c142b8ee59867035d561d4e103495c8f0d9c19b51597706ce0b450c25516aa0f1744579ffcd097ae0c
-
Filesize
973KB
MD55cfe61ff895c7daa889708665ef05d7b
SHA15e58efe30406243fbd58d4968b0492ddeef145f2
SHA256f9c1d18b50ce7484bf212cb61a9035602cfb90ebdfe66a077b9f6df73196a9f5
SHA51243b6f10391a863a21f70e05cee41900729c7543750e118ff5d74c0cac3d1383f10bcb73eade2a28b555a393cada4795e204246129b01ad9177d1167827dd68da
-
Filesize
157B
MD5439cd73927f46fde28540391feee8477
SHA1ee7fb2aeb7708378abda293b03f5c9ffb6dbc742
SHA256d1604e8bdb1a544638a97aa210b3e1eb12f1f159323d6b5942e03e11eafe9f75
SHA512c11ad07964e190696f500468d52c61d8af5f075e7828ef00d525f06937f4205ca58eb3eabe5fd9cc8fa88c1d191de919429b6bbf3cdbb2dda6eed7d1b9ca7319
-
Filesize
52KB
MD5add33041af894b67fe34e1dc819b7eb6
SHA16db46eb021855a587c95479422adcc774a272eeb
SHA2568688bd7ca55dcc0c23c429762776a0a43fe5b0332dfd5b79ef74e55d4bbc1183
SHA512bafc441198d03f0e7fe804bab89283c389d38884d0f87d81b11950a9b79fcbf7b32be4bb16f4fcd9179b66f865c563c172a46b4514a6087ef0af64425a4b2cfa