Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
19/08/2024, 18:17 UTC
General
-
Target
f958acf0f0faeae4236693f1970ee4d0N.exe
-
Size
435KB
-
MD5
f958acf0f0faeae4236693f1970ee4d0
-
SHA1
ae8c6f54ca37cea7041a14f459652fb11e107eaf
-
SHA256
43556d3374df88ae5f196f72d26a55aa86e8efbb1d66d581a1d55a8e5f5ff8a5
-
SHA512
e626293fa1dc0a3d5462779990245331748e99d27f2394ab39f6c6c5f22f5d708ba86b4ecf02cb4368c6312003e65cfb23c6f01f6bad58ab9e04f76918e3bb5e
-
SSDEEP
3072:Kae7OubpGGErCbuZM4EQrjo7vgHJJPPIgR4ZvyezcduPgzKy8sT:KacxGfTMfQrjoziJJHIjKezcdwgnT
Malware Config
Signatures
-
Executes dropped EXE 26 IoCs
-
Loads dropped DLL 52 IoCs
-
UPX packed file 58 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Adds Run key to start application 2 TTPs 26 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 27 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 54 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f958acf0f0faeae4236693f1970ee4d0N.exe"C:\Users\Admin\AppData\Local\Temp\f958acf0f0faeae4236693f1970ee4d0N.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202a.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202a.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202b.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202b.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202c.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202c.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202d.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202d.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202e.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202e.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202f.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202f.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202g.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202g.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202h.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202h.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202i.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202i.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202j.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202j.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202k.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202k.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202l.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202l.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202m.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202m.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202n.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202n.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202o.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202o.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202p.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202p.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202q.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202q.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202r.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202r.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202s.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202s.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202t.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202t.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202u.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202u.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202v.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202v.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202w.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202w.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202x.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202x.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
-
\??\c:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202y.exec:\users\admin\appdata\local\temp\f958acf0f0faeae4236693f1970ee4d0n_3202y.exe27⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
436KB
MD532b7e41e440a93e718e3126cdf1d04c4
SHA15ff4403190b113555096186ee0e732b6d3dff934
SHA256dbc167b930023d9d9e2f6fdf493f8a8161fef3d186c3573106e0ee164cbe69fe
SHA5125f712c82aaf2e74ebe0052e21ead97aa6879da87b9e07d5dfc60144f9b9694c67e9d7a84f4a73c96570e3b45e6bb28043bd45686b83703a638b4ac4fbacd80eb
-
Filesize
436KB
MD5e5bb833dbbf83744c1baef34f8d12569
SHA12937dd336b0b33237b2bb3ca42eea5627b771ccc
SHA2564d8dd9ffb46c12740b68c44bb535018a666912efe097afdcd27f94b017cc8611
SHA512460fac879f77bad776cd945acdef6db6130d3277b08363cd8be619fac03190f8bdaf2faa1387bbe5caf059ab9ad0f80af8a1ac3028d6a02c11bcf94d74fec14a
-
Filesize
437KB
MD5aeff2810865821f1dbad7c1d92a08ea8
SHA1cd61db1b0129ef876ec531cb1afd05ae5a3a1746
SHA2567e0b13396b431c29c6cb694af820aca2f0e5c765a97605fa54055a5c02c421aa
SHA5121688296200e63f6542184e1f30d21d9e622f00b5b63b8bd2be0aff1f8d2437854a46b049f1f39eeae7f397f2175482f736237030ee065673eee7981b2b52d96a
-
Filesize
438KB
MD5afa364134e811c8842c3aa54e7bf0dd9
SHA1df0d617c677cb24eafcf0e3f6147af5cda581e0c
SHA2560af439b1ae5085d220f0d87035b29ffadbe423211157499a028a6a167f93e04d
SHA5123f7a4929379ddea2ce18aa61ca87933cc405028cb812be544fe22e71ca049196785fb5a1934dc768ed6c1283fbed3ff321b9fdc98ec6cc532145e64123c1a580
-
Filesize
438KB
MD53ba0efd384e999be13483e1afa3897c9
SHA13cc8a5effd5fadbf0488167af40552b47e0c02dc
SHA2560b96ca511ed0d5740b804f76bbd8684bde0ecd6b92fb3daff06f7491f7e7a901
SHA5128ad15e4f6fff6136300590f752597b2a4653cf0813752663a2c005c39921feb20932c6fad1e585d2650fcd85e5a280683ebc491c19021983dac42b560834a8de
-
Filesize
438KB
MD56cbc402718d62e128905964108fb1217
SHA14c80eab964108d7ca75be8bdeb53b9b55c645949
SHA256f81ecdb1cb939617fb8cd0877c1234e9d5dc1d87b1034314df403bf5e0777fa4
SHA512d92584c1c27bcd6f2c283cba82509e5373c960455b5fed02861ced268976819e337224d1a8082aa97a141c7a3e4522c2f9887205a1b2be60a09f84553ea8b686
-
Filesize
438KB
MD5433f0b5fe3ea02ec7e6f0edb7b8df84c
SHA1173f69ed0c5ca16639144df01ca43207ede42425
SHA25634a6dbc0ccac4a6a447f7b84ec9f9f72420d77a4aa327bf06fe8f87819b8cd77
SHA5129ea9a3910d366406bf5a18180f5444b47bb80c842f5737ffa8f021e788f9be92e35ed2e1b2667d1c46da19d9cb488392c2d5d898033341b61384d0a19e8f5d4e
-
Filesize
439KB
MD5d6de0caa83b491aed7fffe37707ea6af
SHA12c9c883b69606e43dbd0eed433ea404f9005f937
SHA2566f267764e29a8b59553f5f72c29aca18ecabf48e71105c11941713133bc5efd9
SHA5125934b996795762c01babe7b263210c330cec8dea92ae94bcb79e27b45ef07b2efd078247d6ee84233e02c5b59c8bacd8a243b2abebff0482c2686140e78e1fd0
-
Filesize
439KB
MD55e5413a29126470138ffbc216a8faaa0
SHA16c73da82918cb15010b8f9bdee04ffbccb44d882
SHA256f1ee802058a028c1b21e5dad23b02aaa28406cb01bf7416db51d6e3008845473
SHA5122b2d961956653505474b78c948817356025565869c685194a4938fe53ec6b9ac08184544d8349b3dcde02cd833aec4a5f69a544bdd23b743f02d1e6c39a02bda
-
Filesize
439KB
MD510f56398b86c9af0e538d3c0f8ec30bf
SHA171f5d522dbb2a411bc70f7d0109bcae25cbe920e
SHA256ce3855e367b70956183796cd18146e4ab3c0a438c01f2f69ce929a4146fbaf58
SHA512917f04ea78efb2490dbb1dc6b09ccb70ccf5c8f16b0ee0aba715d083858a51a558fc5a71461730d4f12e3fe3b9076979cfdfee2c01d087273f024469aff271c1
-
Filesize
436KB
MD58875686d7fb404df76161f59d4a0ab70
SHA145f76e0e3b148645390a0d2cd34087bef9ad52df
SHA2569adf002405a35c388f3f5ffbaed42c0eb8efb872ca1b69dc2440522f80e95ccc
SHA5122e15bb03d05eb7686c6573cd144582ee9f0d857ab7cb81f8145a9468f7197db1ad5b28b3646f874d7e244706e50d5b1f9b3d81901856b8b228ef83f022d9a1d0
-
Filesize
436KB
MD5530c9bc41f2d995400c8699bddf57661
SHA1cac0883e4100c6dd46535b102a8e850da01b518e
SHA256ee809acd4ec72f1bb7a7d524ba82e128d95edbbc2a8934d29c793fd73d5a1c4e
SHA512930d624c63ee40537fc45aba0983ca2ad5bef3cf55074a555140d143fc2eb9c41640990141a49e7a0b246708889a2d8100d13ded6f59620051051ccffe313016
-
Filesize
436KB
MD5b35ff18ad69802b5ec452b29d5856ca6
SHA1e8cb614ad03c1d1262d8e7de7c8a5266070a26f1
SHA2563bcfc846530b52b3d13b8fef282611b78c92e4f0c0d123f9c293136e6be0a547
SHA512ccc6d2f32db0883961203c42e76de6b19e8adc16043deada837382bd5119050ca475a100bbad535dbbac322b17d455299696ae9d3f960f31934e3eb087688551
-
Filesize
437KB
MD586fd45f9e247a232016ad12f8df30ea4
SHA1fc8d27cb130dd9b20c0cffcbf38ad3962c73e3e8
SHA2566e8e5653a317bb4ec70b2d835878a91b5f9ab1a412d11f60e636c94f96c09ecf
SHA512244c2587ab0d83cf871c6829fffc4b5c07a24a35c789785498dc50c382bee8ff03c47c51c063750b5fe2647b848cddc999fc3442f690acef6af090cd2d722255
-
Filesize
437KB
MD5a1099ba891e0e74592d4b02bb6614c62
SHA1db974bdead31f00c3ea4a22d6d7c866b1f065acc
SHA256c88b5f6c88541f94b99711fb3d3fffd41290f997a5efc45a95d3563e2f756acd
SHA5123efd4d3fe0b9917c2b353aabcfd51a029c2c24af9bdb26aa5ae85964f029029d66eeb1cd4053ff25a9b35d097f44eedf19a6a03fb405e4266471b0765316d6ee
-
Filesize
437KB
MD573c4fbee68d108a6caf0b5257d263447
SHA1d8c09adcdb5f8550ade1276ad1435eb12b4c6956
SHA256e784bdcc6abdfb0bdcbdd06ff3d7474303ebe8131d52310d314180a9695606e6
SHA5124a298e45a72272e1008c6e2353f72bf089067d89cd3c9b062e08fe1b7facfb5b8b375d6494d7b3cd0f1918e1423960ff5071006d575247f01f91213498e41d0d
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB
-
Filesize
232KB