Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/05/2024, 12:38

General

  • Target

    安装程序.exe

  • Size

    475KB

  • MD5

    58860f344ef256d89bdb2da87956e1df

  • SHA1

    29dd02d0189427f01bf06061fa2cb1cce52d5420

  • SHA256

    80eb3ae83a4677c885ec10b0d9c0b6c99f71fcc2ee313c5783e3b4d741531672

  • SHA512

    a40988a7a8d0e6cb5c9a28148aa0b153be8dcd1f2c4cc843dc29187bb17c6ea9e3006c42badeb65bfbf08a48436e8dbd497ba09cbccc9b100ae23d3c6693940d

  • SSDEEP

    12288:BidNsyc5AeVjDe+NImEULEUm0DE9nCWpcHvmX//XZ4Nzdd:BENwAeIuzLE3owCa2eXXZ4Nzdd

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\安装程序.exe
    "C:\Users\Admin\AppData\Local\Temp\安装程序.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:392

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\BH2002\Fichas\Options\Video03.tga

    Filesize

    192KB

    MD5

    4d1cd5a570ddd8b79f3d605dc4992e1f

    SHA1

    f22c35045123ce9af7cfe94920676bc2af268df0

    SHA256

    88cf636b8050e308804559dc9bf6b2d6e504275e928896bc81c733125b87fdb5

    SHA512

    df064a587b76e97702c37900cd17a6c03ccdd3d4f43ea9aede8a511c3fb979ec32b5d4eb0255d8776519ffab0471c499c5707315d7d4070869644a71432438ae

  • C:\BH2002\Fichas\Texmenu\menu1 file.tga

    Filesize

    256KB

    MD5

    d8d9c4487d50f761fa5d67293f34b9c6

    SHA1

    16e925ceeb674240ebef6194fcfcdf40d6f27eaf

    SHA256

    f9f04ac9d24a0a66baefb7f10ce3012ca069c2993dfc8f1eae58b709c25d894b

    SHA512

    dda65325db90f42dedd019566e2e794b1e12a3246108c3505c04d10b16725005ace738965fb586224b1f5d5f7ed3d00093856a3469efc0b4c1592790f9254fb7

  • C:\BH2002\Fichas\creditos\credE03.tga

    Filesize

    96KB

    MD5

    37ffc547dd151b44186ae3bb7963eaec

    SHA1

    d6b45691f6c11535fe07aeca50dbb62e6900a85a

    SHA256

    3a48ab5e024902907e074494c2c79190fa86052e5ad79b19cd07f3cdca3d1b1c

    SHA512

    496f0f5b1ad3053a8d7a47048ee5a22f9d90ffadf21d656ead6cec1c8f3f567ad3c555f7581c20e37768495f4bf0c88777dc94e0cafc1d50a6810b190efca70d

  • C:\BH2002\Fichas\creditos\credE04.tga

    Filesize

    96KB

    MD5

    38a83a9dede09a5c7405f847a3942505

    SHA1

    6965c6b005c7ad1008eda710c121e3793bd6fc50

    SHA256

    0af5c14a6fd20157bd9986048656ed72f0fe12026955fabcfca31730ce49e002

    SHA512

    ee8c8ae8f1f4803f192cf97611495b04ecaee5fff244dc4bc9734470cd78e503e8d57c036a885e8a95bd072bd3fe7aa4768aa700d2b476dc8f365601255ac34d

  • C:\BH2002\Fichas\data\APC103.tga

    Filesize

    96KB

    MD5

    954128cdb3b7d54a032cac323df07c36

    SHA1

    522e06ce4ae75ad3b7a36f31040d781d91546c91

    SHA256

    19e6ff911bbf9fbf711088424fa1d7ec8463938f073c14752e76abcf6f107a30

    SHA512

    eff7650d539ae340a4c4f697ce9131ff51d2cd75803dd18a66e0d037373fdf68f135fbad2bb6fe4b43a62a81a5106f89ebac53a97f4cfbfb5de11c998a5f5d97

  • C:\BH2002\Fichas\data\APC104.tga

    Filesize

    96KB

    MD5

    cf0b986ee1a87211469d4dc7ee7cb091

    SHA1

    335cf09097cc50cbd11407ce5a9bfd79c91b09e9

    SHA256

    a7e4760700fb79cf7023b04eec4e8a6f477101eb77702f0db45538d5c230bca2

    SHA512

    660aca847da7f32910f742b68dd75a576a49ecec4a8bba7a1db2b8f64416c6c46c1ab39fcd75152a0636e3916978fc3b98703d33d1acbd281ff6bf6c55c5dd44

  • C:\BH2002\Fichas\data\C13001.tga

    Filesize

    192KB

    MD5

    6dce83fa4ab6162e860ceaf28a7588a1

    SHA1

    b468f0a3e9d4c7fa95412859795ea522c526c2d0

    SHA256

    7757887d55aefa7b07e81be85489e57b59f27ff051ebc0157b180593e7c7175b

    SHA512

    e2ce04c3c043e9fb3f5349ff5489ecb37c272a90e7d6b92963923a44d11c7f9bc0c6b3bbbf23a23a7d9668db53849a601323d035148efc6b08b247179498cfb3

  • C:\BH2002\Fichas\data\C13002.tga

    Filesize

    192KB

    MD5

    0268652e66817c76ec0afd9287abb73e

    SHA1

    822f0002371541318d103e3dc43a1d89981bbdf9

    SHA256

    b1d8a16dae51fd4d583fa499a97a88c735f70253e8eafbbc170da0e664eb8d5f

    SHA512

    84a78e9892252a6950b2916d009e0fbee39446e8e17dcb72a6716f50da7ec677a504488f943e6d3b46582f29100b16768e212e6daa95a9d9e30dded0ace795c4

  • memory/392-0-0x0000000000FD0000-0x00000000010CF000-memory.dmp

    Filesize

    1020KB

  • memory/392-418-0x0000000000FD0000-0x00000000010CF000-memory.dmp

    Filesize

    1020KB