Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
24/06/2024, 00:17
General
-
Target
ta4073.exe
-
Size
25.8MB
-
MD5
15ecc8ba9811b8e5bd9d868b213a2182
-
SHA1
b221004e3ac301e686a02f9c7667cf2c85276c65
-
SHA256
87bc71b36b242a954f6dac19f466de0944becce465b37825552c1ba9703a19a8
-
SHA512
88d1518444f53b1a555ab52b97821ac594a2b6f3c78acb8c04798e26d1c5b3eb84af86e5707f45cfc61bf147de05a7e9eab9bc7e406c79290bb4692174012fd5
-
SSDEEP
786432:xkCG+BZo4femcZvQEqe1aecl5OzvUme1g6fJ3t:xk+BZo4fexQyvcl5OzAfh9
Malware Config
Signatures
-
ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
-
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Executes dropped EXE 12 IoCs
-
Loads dropped DLL 46 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 24 IoCs
-
Modifies registry class 64 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 48 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 51 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 4 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ta4073.exe"C:\Users\Admin\AppData\Local\Temp\ta4073.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TextAloud\NextUpTA4Installer.exe"C:\Users\Admin\AppData\Local\Temp\TextAloud\NextUpTA4Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HD3SK.tmp\NextUpTA4Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-HD3SK.tmp\NextUpTA4Installer.tmp" /SL5="$80124,24417821,57856,C:\Users\Admin\AppData\Local\Temp\TextAloud\NextUpTA4Installer.exe"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe"C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe" /classname TForm1 /windowname TextAloud4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe"C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe" /classname TTA3Form /exename TextAloudMP3.exe /msg WM_NEXTUP_CLOSE4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe"C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe" /classname TTA4Form /exename TextAloudMP3.exe4⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe"C:\Users\Admin\AppData\Local\Temp\is-28COU.tmp\AppCloser1.exe" /classname TTAForOE /windowname "TAForOE Loader"4⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM ieuser.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM textaloudmp3.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\TAForOutlook.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\TAForOutlook64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TextAloud\TAForOutlook64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\TAForWord.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\TAForWord64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TextAloud\TAForWord64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\sapi5audio.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\TAForIE.dll"4⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\TAForIE64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TextAloud\TAForIE64.dll"5⤵
- Loads dropped DLL
- Modifies Internet Explorer settings
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TextAloud\TAContextMenu64.dll"4⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TextAloud\TAContextMenu64.dll"5⤵
- Loads dropped DLL
-
-
-
C:\Program Files (x86)\TextAloud\TextAloudMP3.exe"C:\Program Files (x86)\TextAloud\TextAloudMP3.exe" /regserver4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\TextAloud\TAChromeMsgHost.exe"C:\Program Files (x86)\TextAloud\TAChromeMsgHost.exe" /install /s /id obcnimnkkpdkbfnnoagjogdollcfnidj /manifest TAChromeManifest.json4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\TextAloud\TAChromeMsgHost.exe"C:\Program Files (x86)\TextAloud\TAChromeMsgHost.exe" /install /s /id {5e1bc830-4746-11e5-b970-0800200c9a66} /manifest TAFirefoxManifest.json4⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\TextAloud\TAForIEBroker.exe"C:\Program Files (x86)\TextAloud\TAForIEBroker.exe" /regserver4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Program Files (x86)\TextAloud\TextAloudPocketAuthorization.exe"C:\Program Files (x86)\TextAloud\TextAloudPocketAuthorization" /register4⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\TextAloud\TextAloudMP3.exe"C:\Program Files (x86)\TextAloud\TextAloudMP3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948KB
MD5034ccadc1c073e4216e9466b720f9849
SHA1f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA25686e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
SHA5125f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
-
Filesize
3.8MB
MD5176ea60d33132f891a4a2e32f418459b
SHA1c0aca45209fac654f381df97f70154ae4697f0a9
SHA256a2353f8f4f3839f3fa6d903179eeeac70460ad7ba8f9703f0ced2bc21bc86486
SHA512188976097420247f65106344f937ff1f4367b178eedf1b04e8b14f5774ddbf2d5c489f6eb45906490270fa7bfde4550b64e848e1088194b068c696664f9ab6f5
-
Filesize
4.4MB
MD55815766e9878084956ddc0004c0c8186
SHA1d7302408582a1525cf8696930ed689fc0a0072cb
SHA256af6e386f3511fc9ca2175c7f5a819d95dd5018b28fa0b6b5c5e2621dee4cc201
SHA5122eb7de0ff07aa9a5bb9e6e31bb9b2061e325b5d67b6014274d853409ddfb9a6ca9a40acb58d92d72ac4b677d2311da21d03d22a1a23abbacf5624a3dffc8486d
-
Filesize
4.6MB
MD53df36bbf7d80bfc5afbaa66a70f17246
SHA1dc80b88b68ac4afd87c0e3e18bf0b89c64fd2f0e
SHA256582169dc436b3d05f0c3cefdb4607dd9aeb6129d6fe3af56260d674c45b18dc5
SHA5126870d4a400309de653dbebae137c76d72d929abe6887f7870386dcd1d862d74a36adf273ebc50df79db42f0049284f0a944d6c48851277291d641bc8c59dfaf9
-
Filesize
7.8MB
MD5bd9f7dc8bcbb84d8c0f50f67ffbffb95
SHA11ada72c428f1ef9fea29e9fad26b5bb61e62ea71
SHA2562fdd4b807a713a26d45875aa3b7e04d51f28d8f572d9a34c7dd0ead41e378273
SHA512d0e04a5b9d947cf80fc4ce5665885c5922a02d3049232cbd8f490c7b6f0d85d70d98f15370d4755c61b0a75ecfcf59310bdcfdb3f723f51d8b2a7f100b00e487
-
Filesize
23.6MB
MD5b2b3d7a79ce92eea03c5a11a6f3a4c61
SHA12c7a1b65fb2f3f3f1710e26434af8cc6ecaa39de
SHA2565c61e6b04a94a8af724500f062b2615818f3a24eab983977e50484742c7f0f57
SHA512dea97e4b83128ea4bd4b84e0b5658d5b60b716521aad80927f505c15c16b402f684cd98d994ca96536f9817f2795949a73da4ec977cbf1358912a648be694535
-
Filesize
538KB
MD5724d6320fbc6977939c033efc857a7ab
SHA105549c3e3b8cf0af330055c639ac55b93c2b5635
SHA256804c918866de0bf93cfdaea35c3299292c889611b46acf39d80e8f9a7ade0ca2
SHA512b8ec52a342a3840f4124b134ce3e4be1b00f460b3f3fb96ab5fe4b521f227efaa7b6ea5f83cb6d05e5d8d17374a997067f14f68e442f0e5dd6b8f24f9bbf268c
-
Filesize
483KB
MD5563b98d6048e32cde756935f299bbeac
SHA1333d35ddcc26864e9d0021a85c86df0f09b9ddb7
SHA256ad5a40e3fa7527e9bad200c02feea3d1e6477bc0c2a6f656fd2d0f8e08b0f3cc
SHA51206235efba5be45c21013a81231320ba3f9cbbd10c9e1550f8a3c6bdfcb1f3ff6dbb06cd968ac82882fb812eb5566406f7e1f9f8ea8c24366ff5129a356d15488
-
Filesize
2.3MB
MD554f772624a0cc3079fbbacc735b83e3f
SHA1e985df99aa8233fa0efbd307aa9dea65ee417a54
SHA2565a2854b04effba1a341f023a84190a022bde187c6f79a8ac0d10e516d1063f08
SHA51225699a473f4e116619f4e3ffd529f55556852fd24cb492116fd75785dce4fcbd32da3b6a1199df2c5a4ad6d787ad02bdfbdbf0f850f4fee85801f3935a5211e6
-
Filesize
3.5MB
MD5147a28200d7482ea0d4beaad0be03120
SHA12cc16e645e7f9cc19751416de9707faa20c3badc
SHA256b4c7de7d06cf8f92c2c66a3de72d6b40a60cc146fc6370ecab012684831c7022
SHA51283e4894b5ef7cec4169e34bf43067728ac02d206e5d49d93869e7febdd7dbc09ec12e583ac426fdd66313bc17b887bab8f952c5eb407c2a44ddff0a067369e64
-
Filesize
2.4MB
MD5990e516a6a6b46193c9f15f68bf1102d
SHA11e6ccfab46700fd5a55d1069111c1ff9da0bee70
SHA25642f43d0aa526fbab294e51e3ceecf3e20142ca756a45b2df1f6e3887da47a626
SHA512d8d994fc81b31693781707cbcb1abc614366e910bebe2d796169a1adaef3578a5520716c25d1857efb9137f8afee09f36e3e6ebec901e0cdec8fab51237dd68a
-
Filesize
2.2MB
MD545496192bfa412defa64930eea4e9a41
SHA12e1095135345911caaded1370a48bdfd4a1511bc
SHA256dcd1239aa66ecd5f175b0f281bfb4f3d4a591952c1456868cbb6265af0d9cd6c
SHA51289977617d54bdd258c58364f5d43751a168cf62f9c2e7da79e281eb9b9fc96f28d1424cd78ee4cab533e00c803694cda2dcd9557c1a6a9c1c58973af6620fdae
-
Filesize
7.6MB
MD5cc453170729c388c099b5cb949a4045b
SHA119108b21a07dc4a619fbb8c9d1e671b74a3383fd
SHA25635d8e759b7a1bcf19cecafff715353c8040b39ccaa3c84aa7e330770ed2f28bb
SHA512dddc63559e276ed8234012e1cda465ef2912fee60416212428d629970809b4bf2b3b60a4eeaa6d1c88caa54840fca5adb019be253f1531f20a77093f5164dde8
-
Filesize
132KB
MD5b9beab6c21c278d5126b163b16ab79a4
SHA126a1c7e90f8e158c62623acf75454fd425a1dd7f
SHA25688948623ef301fc87bba61fffb95a4c6f13805df589358bb09c66407b78248d6
SHA51294eb8af888e1fb3acd2fef5d4b5b3493669a3fc451478b7b50ea2eb2febde32f2a8d2d5369f43c33d12e6476f400e21ce2b94c3ea0a7a725769ca70230da9af9
-
Filesize
11.0MB
MD53b770c9c698fcf8ff39fb80c2a56d1f6
SHA1ef7bae8c599b6304fd4dc4cb5ca8e07ee70ecc65
SHA2564aa41e364a59c3a958386c50ad09fe316e415c4037dc098b9c2d1b97c13d3109
SHA5128dd55daaaf90f12b49ff0d79e4be893f84b4ce79175a6b87ade8b69432212979881045cf3fc5300fe05a7d445c2adc32d31f66447c79c399191b915606ca47a9
-
Filesize
125KB
MD5c5b3059004e2c7631915ec044f4e6c63
SHA1dbcdc0aba1d9cf3396ba8ae00bb3671c85047fb2
SHA2563cd00f456f51829eda119e0e133acc1e45a5930d61fc335a2e9aa688a836a24d
SHA5123ed914fbfa4ff78fe98ade848e79c3e1e3b66eae83159b45725bf946f2b3cb9d4f805f719901928d9b52c20bc121b0552645fa6aba11ac0fcd5ade672f14f5ee
-
Filesize
19KB
MD5397ea39937b51405f34245fe0cda1388
SHA14d412bc305dc0757977b6b084aa7046c1b11159b
SHA2561d2ccc2e25e1b645f63dfe93d191aa9fe1b14fa0296f922ae467766c1c64d633
SHA51242feef0440530c9102cf476bada02afe1c7ecdb8a14733d11e8a8b40f96cb0eebb20244e8cee9b5c0df51ab60cc7e257e4105437c09a4c1e3bdc0e9d77f50a11
-
Filesize
148KB
MD50d71a82f3955433ccf1a1edb3a911f30
SHA1186572f10f77b04e1eb77d5addd092a0d5a59f61
SHA256dfee8783677d5661c873d1dd3b0fabb5ad6cc7c9638cb9390f728b0a4ac14574
SHA5128c111fb270a1131cd77665b00d4e544ca62ceb55ed021e01205f028222c9b9731536d8d5af38f636241b823e102aec975bdbca036852a23f8e1e400c09bd04db
-
Filesize
21KB
MD56cbd7a375e98420dc8cc2475b62c895b
SHA1ff4b3d66f4a8916acf36a7cc6e075dc25d468295
SHA256704bc9a084989871a567abc638aec57b3c6514ef1e31ceacd0fb347551a7aaf4
SHA512838895d1ff76bcc743c707c978029431e44433ae5b791891370b5ddb1509951b84d66eac257da7cf0851c73c9c82bdc9523eb99d79afc779c405e361811d480d
-
Filesize
17KB
MD5d2177355beccfdbc1e7b5c687dfba290
SHA10557f3883aa8eabefa6a110a08cf549117fd1901
SHA256a844247b7cdcac1a5f61c604e4db111b274616c0eb19a70cdfb073c8c2f3b375
SHA5127e5ce3047e4661969a3827b225f1b88f80bfea221549e37b406da52d1c51f60667340bb1a074f96a516d185979ab5e298fab76bf5789ce7ee34b399fd2bdfa3c
-
Filesize
76KB
MD5b9fbffdb1193cf78ae28da9ff96b8578
SHA144fe33a550d10a663d187f069ea46a3f4ac36142
SHA2567e089e32c80d0905b5c725c750d9112071095da94f3dda5590aa4cd9f4e07f74
SHA5122f81f66402371d3e3e3d1e89986abcbd995f5e0746f102f9eb49a9bc9f7fa59557b054ef752b5dbb4c9fbaf02b7863d0bb26f864f1c637904aad37b17e7a42af
-
Filesize
2.1MB
MD57dda15fd2de33dca341419cebb8e6206
SHA1db0b63317e7a582c5b88bb454c6a12358f52e871
SHA2567aaff19de5b7d21ee1785c54f46b18744f3518e87ad7a0b309ea87384ff4abe2
SHA5123516a5bcd2f8dce58d487e090d6211d062633204fa4e9c4404cd6ec8bfa5998b7fc1686ec2ee48dfc8a01e1128c839e01d5e7e9671bab4f3c8333bc0a5fab470
-
Filesize
2.1MB
MD5f79170750b22e2031592fbda6b16b3ca
SHA1d2e35403ed38111c09d3dbdd166459a954968ff9
SHA25676e86688b6d2bf3cbfb9bfe6661e9e93b4dd1aefe0c4d843081108648e66c962
SHA5122086c7197993b2978e3cd30cb0a2fd70e5b1346bb1bd58070bd7360afda605faa36528ed71d3f3486d7bdb4f0c50a8946e329d24ea5f79d5a2572d8dfd2b1d32
-
Filesize
216KB
MD58f995688085bced38ba7795f60a5e1d3
SHA15b1ad67a149c05c50d6e388527af5c8a0af4343a
SHA256203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006
SHA512043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35
-
Filesize
708KB
MD5ae5108fec9e1c3da26674d02ecc76153
SHA11ddf0c8de4032a6f649eb2d824ec2c9756806e53
SHA2561d3e6c985ffb65f507795dc35beab5006121374a1a176d73abe7abf4505f1dfe
SHA512ca7fae476ada3ab002e4d6826e704dfc0db7899789715fbcf3c9674394855d68b57260899e6fd792b8fc61a9e1fc22b0058335cac38a23c8f725c50d1baf9708
-
Filesize
4.5MB
-
Filesize
3.9MB
-
Filesize
7.8MB
-
Filesize
7.6MB
-
Filesize
2.4MB
-
Filesize
4.6MB
-
Filesize
984KB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
984KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
3.6MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
760KB
-
Filesize
760KB
-
Filesize
2.1MB
-
Filesize
760KB
-
Filesize
64KB
-
Filesize
23.6MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
348KB
-
Filesize
23.6MB
-
Filesize
172KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
23.6MB
-
Filesize
624KB
-
Filesize
52KB
-
Filesize
52KB
-
Filesize
44KB
-
Filesize
84KB
-
Filesize
84KB
-
Filesize
4KB
-
Filesize
25.9MB