Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22/05/2024, 04:20

General

  • Target

    474e0928a17dd102987246718257e0e493937f5f59082cf5ac6c5737855c03cd.exe

  • Size

    4.8MB

  • MD5

    c92ca1432dbe3b0a8b7613fe44f638bb

  • SHA1

    74a128996b28c0600079931df56a3573f5e9b78d

  • SHA256

    474e0928a17dd102987246718257e0e493937f5f59082cf5ac6c5737855c03cd

  • SHA512

    6e29cfe9f2a1aabecf930257621ce89dabbcb009bba4e960d2138156659d648bfb1e71e95cf945990594bc85bd49ffdccb50ebac0c6c907e82eea696634c439f

  • SSDEEP

    49152:e4hYhBMH+pQyoONgSl17ENZJrDCpC9fzs0k:tCh6+rqSl1qr+yXk

Score
7/10
upx

Malware Config

Signatures

  • ACProtect 1.3x - 1.4x DLL software 1 IoCs

    Detects file using ACProtect software.

  • Loads dropped DLL 1 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\474e0928a17dd102987246718257e0e493937f5f59082cf5ac6c5737855c03cd.exe
    "C:\Users\Admin\AppData\Local\Temp\474e0928a17dd102987246718257e0e493937f5f59082cf5ac6c5737855c03cd.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    PID:1724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\SkinH_EL.dll

    Filesize

    92KB

    MD5

    fdf0873098c1b52cff37b44ab3c912bc

    SHA1

    6b7356db03b02df6c71bfd1b7e23ecd7ccf3e599

    SHA256

    27c9ae6df55d2063d99224e43206ed9f5b69d8b9e36377f190d62d22f611e94b

    SHA512

    d6be32f1294951298bfe81a9c5d516bcdb52337789924ab88738362ef491557e566e11b01c4a87dcb9f88a3591db916d2a1ba39e5997f843e53af72817a63f75

  • memory/1724-512-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-504-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-508-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-510-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-514-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-516-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-520-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-524-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-526-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-536-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-538-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-534-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-532-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-530-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-528-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-522-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-0-0x0000000000400000-0x00000000008D4000-memory.dmp

    Filesize

    4.8MB

  • memory/1724-518-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-562-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-503-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-540-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-542-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-544-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-552-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-560-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-546-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-548-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-564-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-506-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-558-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-556-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-554-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-550-0x0000000002710000-0x0000000002821000-memory.dmp

    Filesize

    1.1MB

  • memory/1724-1-0x0000000076DC0000-0x0000000076E07000-memory.dmp

    Filesize

    284KB

  • memory/1724-7977-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB

  • memory/1724-8006-0x0000000010000000-0x000000001003D000-memory.dmp

    Filesize

    244KB