Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 22:12
Behavioral task
behavioral1
Sample
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
Resource
win7-20240508-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
-
Size
6.1MB
-
MD5
7f2d736aa0bceadf56dd6dc94775fd45
-
SHA1
92fd856ea866c24051a7746093004da05e15ce89
-
SHA256
e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a
-
SHA512
aa2c6f97af7840ac69500efd545a6f5a3026515d18b1148274629aa450d9e9837bbdb2c742aede66ce6bdff5a5cc9025ca3310870a9a8d2b60f0b0cb76445085
-
SSDEEP
98304:lf38J8q4aW4CAHVgQhONQrbgNyYNWFpJhXk53++pLt/dWIxiCU/ouyGUkVNjPCeD:t38J6JNy6WhXk53Xthxo7mkNjP3yzh
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2580 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
resource yara_rule behavioral1/memory/2580-6-0x0000000140000000-0x0000000140629000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2580 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
Drops file in Windows directory 47 IoCs
description ioc Process File created C:\Windows\ysz9ta4b\x18cid5hy91.sys e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\bg.jpg e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\ComputerExamine.xml e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\Module\ControlWindow\hkthunk.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\toolbar_pushed.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\dv.dat e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\button_hover.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\search_bg.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\sys_dlg_max.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\tabbar_pushed.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\toolbar_hover.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\Module\ControlWindow\cwapi_32.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\cloud.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\examine_background.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\tabbar_normal.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\Module\ControlWindow\GLLA.exe e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\horizontal_border.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\Module\ControlWindow\remote.exe e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\sys_dlg_restore.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File opened for modification C:\Windows\dsn9u\AdhLog.txt e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\AdhUiRes.zip e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\firewall.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\firewall_ok.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\tabbar_hover.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\networkshield.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\skin.xml.bak e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\toolbar_normal.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\antivirus.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\Module\ControlWindow\ControlWindow.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\icon.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\navigationbar.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\vertical_border.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\button_normal.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\button_pushed.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\sys_dlg_menu.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\sys_dlg_min.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\softwaremanager.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\sys_dlg_close.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File opened for modification C:\Windows\ysz9ta4b\x18cid5hy91.sys e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\AdhRes.zip e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\Module\ControlWindow\ControlWindow.dll.__config.ini e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\scrollbar.bmp e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\skin.xml e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\commmon.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\NoNoNoUse.txt e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\Module\ControlWindow\hkthunk64.dll e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe File created C:\Windows\dsn9u\UI\preventnumber.png e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2580 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe 2580 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 472 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2580 e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe"C:\Users\Admin\AppData\Local\Temp\e82997a70e0b39ba4f33e9fcb3b862a50f0bda46f14cee70d497145bb751642a.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2580
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5b71452825eadd80e0b77f37e7607e125
SHA1db7c5b9539271e120a6a7a5e2a88c0dbf0478375
SHA256233464af9ad37f29cbe2bd1f1bf2c50b8a244b5cddfbcc2e50f7637745ae9d29
SHA512048c78ee165d5d758a49db5b46f3c68058287a255b108ea3a858b755ac651ef8e39bb27cd89adbab1991ad53ea0c61b62feda17ce6a78164c1c5fc829e508339
-
Filesize
949KB
MD5497d1af3a71c3af04d720abb4f96d9b2
SHA1d50d157c549b9db703fb6283d20d23dec0154596
SHA256b16405230e1be42383fe1eb1da6a9cead6d167706f57825cd283883b39f533c7
SHA5125364bae36bd6666d5d4af6996c6839ec3564b54a9f43cafc597d97d8ed8f0d4f39ed1b2f7c66461c95b1a369a8a9e1dbf6ba2e44b9aa428a208edfd7c6bfb977