Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    108s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 11:24

General

  • Target

    a6d96246ae2a93bcc1b9f1d4e9929ea0N.exe

  • Size

    419KB

  • MD5

    a6d96246ae2a93bcc1b9f1d4e9929ea0

  • SHA1

    2652f19343527d78cfe25244bfbda6e45da3bfeb

  • SHA256

    1c56ee8785061b0b903914edde4d9238f9054536d7bb08f14519544ea333c7e0

  • SHA512

    30ef5483aac23ea611abd9a4b6c8e99aa93916a6f074866a2d0dc9db3f208660e45a6cc5d4fd362d1d2e631d77a89cc94cbf7a76c7a4aac153f17354e21aa636

  • SSDEEP

    6144:xJuXtXxog5E+FWPNfrf6yGEssQxNpbMEmQ:j8XNE+FuNfrSyGEssQJ4Q

Score
6/10

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a6d96246ae2a93bcc1b9f1d4e9929ea0N.exe
    "C:\Users\Admin\AppData\Local\Temp\a6d96246ae2a93bcc1b9f1d4e9929ea0N.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    PID:3524

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files\7-Zip\7z.cab

    Filesize

    544KB

    MD5

    9a1dd1d96481d61934dcc2d568971d06

    SHA1

    f136ef9bf8bd2fc753292fb5b7cf173a22675fb3

    SHA256

    8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525

    SHA512

    7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa

  • C:\Program Files\7-Zip\7z.exe

    Filesize

    461KB

    MD5

    439a1ed369566aa6b0f095ab7b5d98f2

    SHA1

    de383945602ff1090d13cdef995135d62caeb37f

    SHA256

    c70915044314614ff797caa27bc93ce942f7a0ec852b62e401ed758727577e63

    SHA512

    065c2ee33a259ff210ed5de63ec8fdab61e4489be8daea31227ad83c5e2bc735c21d5cbc3be4c9e7e89314f3b30981a543ebc66bac66d2b55244d5c82dc7d0c1

  • C:\Program Files\7-Zip\7zFM.cab

    Filesize

    930KB

    MD5

    30ac0b832d75598fb3ec37b6f2a8c86a

    SHA1

    6f47dbfd6ff36df7ba581a4cef024da527dc3046

    SHA256

    1ea0839c8dc95ad2c060af7d042c40c0daed58ce8e4524c0fba12fd73e4afb74

    SHA512

    505870601a4389b7ed2c8fecf85835adfd2944cbc10801f74bc4e08f5a0d6ecc9a52052fc37e216304cd1655129021862294a698ed36b3b43d428698f7263057

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab

    Filesize

    281KB

    MD5

    3dc3594fb3b25c55081fe4b3226abbc2

    SHA1

    7eaddfd597fc76244f71f98877f7149c9e85dc9e

    SHA256

    6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e

    SHA512

    8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX8311.tmp

    Filesize

    174KB

    MD5

    8d9797194e3826b5ab1050f637275859

    SHA1

    e633cc82c5ae2f57aba7cf83738a592cff2a8fc9

    SHA256

    ed8e457251c983d7acdcd3dcbdf750d21509aa056e62fee6525034e1721941dd

    SHA512

    aaed0b4b27ecb5616d5967226c3d6e2b9aaaa432380747f8cc5c9b83659d1a72cc175fe0157359f3b622fba4e7b94bb4626726ed97150662d1f4ded0fbb1ab18

  • C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab

    Filesize

    2.1MB

    MD5

    b8d69fa2755c3ab1f12f8866a8e2a4f7

    SHA1

    8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d

    SHA256

    7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd

    SHA512

    5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18

  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\chrmstp.cab

    Filesize

    4.0MB

    MD5

    4000ac26cc2e8e051ce6dc97e6cf8f52

    SHA1

    ef0db6e513e66dd5b31a8630e40742b5548bb3ef

    SHA256

    662b4e23440de33edfb384572f7d3fc0caf9997f1b61b4e5900b329ed28f8fe0

    SHA512

    207af36ced03fbf8a816c0651b2bfc71b371cfb448c77a1cf31e0770c0cc1e41be1f062f75e0062be9c667f1aebb7b8f7a97ebbf0f250a943d8c0bf2b533f3fb

  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.cab

    Filesize

    1.3MB

    MD5

    6a6c1d6485aa2e9b293bffee8d9736f4

    SHA1

    68ab4ad79ccb7cf6686cc740370da78e6ca22486

    SHA256

    c930ccdc34a78a30dc33d39105bc98b3c6f0cfb0cea83bff898745e3167cb57e

    SHA512

    64bbc0fbda9f7b6e90495e51340b9af9c88b01316d1d47cb8bda860db46e0be0108b882eb8a5b7614ae3c43c8a55f98ce4bbdf8421c8624eaf98342ba0ba1968

  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.cab

    Filesize

    1.6MB

    MD5

    2c99645742665024db8e389c2870bcb9

    SHA1

    6e556ee19a2a1731ac56b69d0e83257e439a818f

    SHA256

    ab708ef464fa5e8222459d786512279840efa919b05e66b0f2c473d8db4becee

    SHA512

    25a7f8434e83341d9f8d68e2f8c7f088f2e84a707fc6db3f18bc1c098a2511380f92d8efde768f5113bc52734f640a08ba356f9a31d551da6ddf58d4884170a5

  • C:\Program Files\Google\Chrome\Application\chrome.cab

    Filesize

    2.6MB

    MD5

    c0e615c4c4f31cc9d9c8e1f7db1fd19e

    SHA1

    e561a25b4d70209d6f9a98fc6755b7bcbebbfad1

    SHA256

    bcbb6c63044144a41ced7051ddcd55e60439c72d2de9a230a4c5d5696ba5601d

    SHA512

    f345c22444c7e3e67fcf4d604b750a44a849881f173e1912ffc5526fc21c3ed9c03aa68a7f3f0c01f6793588fd183319824871fc9d118e4af03ee77a87ca2ae3

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    186KB

    MD5

    a7723760a18c2b77afab430a142437bd

    SHA1

    32f16189184d59ba62911d92f8825e2e985d261d

    SHA256

    bd9f85deb1da38e5545ca6db2dd200649a41b943f96eac86bd825672d2e15bd5

    SHA512

    9d56e581f52bbc17ef9969b9589711ee06a07834bbd2fa970de7a2114a2d50a584f88c84e7f81a403609b02c4f06221e0f6b996b6d1b3d9176922afeb2ef87a6

  • C:\Program Files\Google\Chrome\Application\chrome.exe

    Filesize

    1.5MB

    MD5

    3a6c98b39dbe168b4e636612b3851cf3

    SHA1

    c34c0a9d80d030c2c61bb6dd3799608c16802fc1

    SHA256

    09be5a54ec7bbc4e8e7bfe108a7f49825fa936151e859cbac54faeec00076ca5

    SHA512

    c52aa20b69537bf3d44e5aa915e72ad0d9e2dd1d786cc94c7325e40822ed8fc2ed2397768c6b1117363c43d087bbf7b6920e8e7e58e9a8c69e9f89ca4006c4ff

  • C:\Program Files\Google\Chrome\Application\chrome_proxy.cab

    Filesize

    1.0MB

    MD5

    7643d66f90df316989df9cd2a1aa08ed

    SHA1

    6e22393cb0a8f4e42c7da828b6d338361c1183bd

    SHA256

    29f9a076fc31d5f2439bde031884af8a5283c9ce70570432dd7c8e9469873b50

    SHA512

    680ca5e17375a0c3a9dd07b17c5b7b77b1ca2d44ae97a56ee381d6fc9822e2b6446aad57d171e0019acb7fe5bbb254bc675aaadfe7facdab2c9b3c3938953b0b

  • C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab

    Filesize

    23KB

    MD5

    f63d14c000dfcadf2394c737edaeaec9

    SHA1

    1c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8

    SHA256

    ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29

    SHA512

    4cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053

  • C:\Program Files\Java\jdk-1.8\bin\extcheck.cab

    Filesize

    23KB

    MD5

    952fc862806f000e37d22897243c2bc4

    SHA1

    2da507ba99d86deee0fed3238e5e9fb170a562d2

    SHA256

    955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee

    SHA512

    c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05

  • C:\Program Files\Java\jre-1.8\bin\jabswitch.cab

    Filesize

    44KB

    MD5

    f0f1575cb0a27c0815cd6a6ee694c7a1

    SHA1

    347aabf545b26e24293e7983a34a88fb1f132ed3

    SHA256

    7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae

    SHA512

    6713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a

  • C:\Program Files\Java\jre-1.8\bin\java-rmi.cab

    Filesize

    23KB

    MD5

    5aab08e129caf5c4595f21142e3c32bd

    SHA1

    1ee57e2d3e4939945939d4df180c1f9128fb2582

    SHA256

    ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf

    SHA512

    5b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d

  • C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab

    Filesize

    238KB

    MD5

    3f1c773a2e54f4d27b29c3fc1edd7d43

    SHA1

    ef9a5cefd1f3c76b0fa5c8ea4a261dc46e59d185

    SHA256

    ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254

    SHA512

    d6636ba0c800757d361212169f770d3799cc46583c79e0b9cc7cc49c565b86849e8965fe0783100bfb8039f12b717db88f95062e7b6b6f67a7f8bd38144a4297

  • C:\Program Files\Mozilla Firefox\crashreporter.cab

    Filesize

    250KB

    MD5

    aa9c1de3041eb75aeee90b85ff66c9dd

    SHA1

    83cba1e082732d95f278434fd25374104e25c668

    SHA256

    57b8145816b5d189842e350fc030e5a4def3a8990e489aa68dafec2b34e50171

    SHA512

    fa75c0de232e497540cce6f27dc0b0457860255a0822a6db297942ae91159dffaf4d35367aabcf9b2e235766a204210afee13e2e00cd0016403956a8a63a78a2

  • C:\Program Files\Mozilla Firefox\default-browser-agent.cab

    Filesize

    33KB

    MD5

    4c6887f8c8c66f0b2db5a8b347931b70

    SHA1

    1a71320873155f84de67bc16324c8ca0e503be04

    SHA256

    a080df509685780d81ee32d86eac7ab15b5831090678f63b5741b57fd8a9969c

    SHA512

    3e1cc423bcde71a24457b5f9756241c0bc0f9b1f434eafc84ec733f124bbcf6f9a1e104caf402ef2d60a96b895842a8e6b18cffc59936e6c4873a3be92cace8f

  • C:\Program Files\Mozilla Firefox\uninstall\helper.cab

    Filesize

    1.2MB

    MD5

    cbb81a903dc88f69ff9107f11bded306

    SHA1

    4466021a5d98b59b61c7d45a8f5dd695226b9056

    SHA256

    5719bb2ab3c985570662a12789a2dfd37acd6aa3bb743eb75fa271256455956f

    SHA512

    93e8e2e62b27686a2ca2dd4db7ae59349730e233f88ce83fd55969df1b16b9c382751987a76ba6b451bdda2dc080f7cf93a915e2517a783d16018813e3b27d13

  • C:\Program Files\dotnet\dotnet.cab

    Filesize

    143KB

    MD5

    33b4c87f18b4c49114d7a8980241657a

    SHA1

    254c67b915e45ad8584434a4af5e06ca730baa3b

    SHA256

    587296f3ff624295079471e529104385e5c30ddc46462096d343c76515e1d662

    SHA512

    42b48b4dcd76a8b2200cfafddc064c053a9d1a4b91b81dee9153322c0b2269e4d75f340c1bf7e7750351fb656445efaf1e1fe0f7e543497b247dd3f83f0c86f9

  • C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab

    Filesize

    56KB

    MD5

    8e4a401d4862a3ab07d4e7e17cbdfc78

    SHA1

    8ff6d2c100a2ba9b8159b9f733da011c8e448534

    SHA256

    6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2

    SHA512

    74477239112082429db839be011cbe3d7d8fa66c9b8089dc93b18c1392ae57c935f39446227049e6f7f29e86122d191fa4f2f8d59b87f1f7b6eba3ae4d61a579

  • memory/3524-0-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB

  • memory/3524-498-0x0000000000400000-0x0000000000470000-memory.dmp

    Filesize

    448KB