Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
28s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
-
submitted
03/09/2024, 15:39
General
-
Target
simple_port_forwarding_setup.exe
-
Size
6.6MB
-
MD5
b7abaf389a791b2a3a783c3c2427c37b
-
SHA1
85498ad92c7e6a1b82d666c484960c2e9b6c7f0b
-
SHA256
f1cbdfa43dab33030a5602decafa648bd589cf3f9ba28e4f9945c4901ffac483
-
SHA512
e5a6b38a1c1bde3f844769c8e1fd13d5ab7a9903ce6cc85158505c36bf1befce8e643ff53b79d7ad15ba9446b1448cf2acfb34a0ad907f863a5f5f0cf9038d5d
-
SSDEEP
196608:KYlWAFz6uG+K3wUHYuW7W+fVG1f8qYc1/8UkOIIaB:FYZ3wI2G1f88nVk
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 3 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\simple_port_forwarding_setup.exe"C:\Users\Admin\AppData\Local\Temp\simple_port_forwarding_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe"C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1744242 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\simple_port_forwarding_setup.exe" "__IRCT:3" "__IRTSS:0" "__IRSID:S-1-5-21-970747758-134341002-3585657277-1000"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Simple Port Forwarding\spf.exe"C:\Program Files (x86)\Simple Port Forwarding\spf.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Simple Port Forwarding\databases.exe"C:\Program Files (x86)\Simple Port Forwarding\databases.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD570d47914e2b28ab15fe0fc777b1f5990
SHA158fd4d814745a5e5f34c20a3db80c79fc8205ab5
SHA2560752bcac2be1c5b8223c067312080cd326c5f0c42d7cdc5712b54eb5ff895524
SHA512a66504cc1b1d453c24b8c4545be1293fa0c8474d9fa0e2e9c24e5ff85c80994129fbfc241a452a83fc0d159bd10d15b2c122b1db19fdb76ed1671ab0fad5db6b
-
Filesize
1KB
MD551bef95de9762bf2c6e5a5e50cbd9821
SHA1b0418c3621380ae26b3ddfa0b47c93c1cb57c8dd
SHA256e2f1bffe568c0661500fb177e14774217f6ec033d4da079479d3e18c5b925da4
SHA512b39d082e838d8a1a39159ef3a8e2b934c3816158bc049a977a13b221c31ea35f5e9d33daefcbea084c035f1e31e52d4f5ebdf203eb3ea62ca1f5c78e59972b1f
-
Filesize
129KB
MD590a39346e9b67f132ef133725c487ff6
SHA19cd22933f628465c863bed7895d99395acaa5d2a
SHA256e55627932120be87c7950383a75a5712b0ff2c00b8d18169195ad35bc2502fc2
SHA5120337817b9194a10b946d7381a84a2aeefd21445986afef1b9ae5a52921e598cdb0d1a576bdf8391f1ebf8be74950883a6f50ad1f61ff08678782c6b05a18adbf
-
Filesize
860KB
MD5ecc0b4dc8d1b15da901eba5f09ca5037
SHA15419ff79cc15badb25f26872e54ad7533b074c91
SHA256cc3c0485e724f612d54e57d2bdf6dad88d8d2080d4fbdfd6733ba5ef41a84914
SHA5123ec315aebed2be58c6654f3450509311fc50106fe69ec0b65c7e53963f022f47d70b587c4a9f153b8d392a38438ae26753dc5fd409a0f6cb4a8c1bef737a4f91
-
Filesize
1.1MB
MD5ad0eac85abc25b2e3c81c3ad41c10c42
SHA1883b2047c446efe70437edb0979f5c39ebd7a287
SHA256174252b088324bec2716d295451d7d449b79d89ea2e66245c56cb284b583d7d8
SHA512e05c31cddf6b872af10dd187087bfc4964b697ede456a3f9cd5b170b07974db08196ab3435fe157df53e6b9b7e13292294dedffe6f51809e2436c0749992c5de
-
Filesize
208KB
MD55d2a12a554889b7378977b229b11130e
SHA1ef9b33c2659c476ad2e4c35a21340e159b74004e
SHA256a6d4931cd17c7fdc8705a72da68b43c9f103373da60e08b3fd1880a7cece7a0c
SHA512f728adebd814332d35a15590ef1a779f506b9e16d738f42239ef5b6e07962412bb1648c80e3ce50e5d4abca0aa01d891207353ed8b568541c86f092d9c0d7a42
-
Filesize
108KB
MD59f2e56bf8dd2bf49a3ee36880bb57c5f
SHA18d0554c9939b7cb5a1e535bd182a20467b8b960b
SHA2567d0338a411dda93d1c3563e168a3a5053567bf216c2e8942aba0128a136b8b22
SHA512336b8022086bd9316cd7868824b455e7d95f39dbf451be9e4ec99f31c7eb4cde4225bac5475ac4933d4fc60380bdda9eceac626930207a25b642c9e3c1f82b8e
-
Filesize
24KB
MD521d0c4f3cff95c34e07ad1140136e99e
SHA11f7f58b1cf233d7ff0852c7fe79c3b67d1141cbe
SHA25645eba9d0872bcb19a40ec70ff01a410adeab5706424304ba3f19a7d530e98c78
SHA512413a4e7bfcbe072886a8928555f4873726aa06b2e5221f5b93f049022ac5c9c8702b00f5ae2d55ab8d5c6f853fc405bdbabad651a3a4cc398145edc0d068cf9a
-
Filesize
18KB
MD5f6d7b51994837ad061d6a646f7b57145
SHA109f18e3a2801861d98aeb9c633c0420ed6570642
SHA256bb614c2f7179e77babcffbb861e2fadac42eb919c408f83e0f4b3ba612bb6aed
SHA51228fcff03c2b95185a1d40fc86fc359d9e760ebd3241717a28563b308c4a4b82cb6b6ea03adf4b8e02a7ea75fe990bf423efe9ffa09fd947191883b3277084a5d
-
Filesize
19KB
MD569d469ce62a082526d77d32d29cd3e55
SHA1d2c1fb33b538cafb159b410187ae812d9711e437
SHA2562bbdbec4c1505b0686430aad42d88aee8e3ae200452ac30cf7f177d394ea00ff
SHA51293baa1492b9434e835cbdcd2d57c8e002f996bcb3e34a8bef26b605b4eedc8b3908a0a3cd8facf165d59fd9e09808d91c2e43979f12947fc32febcb3d0ba1a4c
-
Filesize
212KB
MD5bc276e1cafda9f0e7a0edbb60898bfd1
SHA12686c9f6682a4c2c5cb608f1f9cabd3af03d7df7
SHA2562db268d0eccc55445e8bf0c6e1bb72512c015d095e40e77a9fcf0b1060d479c1
SHA51251b31ce0f00a41552ff8925fa024b2756b5799647c05256243afcb3f9c49f908c0f395cb6f3d2723771d5c85418fe0080f1741ff7b1433b54c8bd4e949301ffa
-
Filesize
882KB
MD59a462dfdeeed05e299005496a2cabc26
SHA17dc013f3cb7797225755ec4484abc3d616d5d712
SHA256af48cf59f166d97d390fa757cace2c6dcde72644f82c6f158e6d793c36bf9797
SHA512ba2306514cf99b1c91dc2555c40ae3860de156b700de158f8197335fe766f634f9fc7e536592d4bf31f7d67a743886206d19f2809f1f6bfc2d2adb741207e1f4
-
Filesize
392KB
MD5e8c553eebc2a0baf813be9eeefd83f5b
SHA1308f94733c5052dd6ec6b0fe54ae744d6dc0e6b7
SHA2565d3f1bda769ffc8b755b5b97bdb322bbe3b14c80d3f51a18039f4c2ecd1d7e0b
SHA51205cde790e230b54e58acce6c09a2662e23a286d78c911d689ee495705eb3b138d821ca9a7f89f4a7a23b942373262040e0e86056073a9e193fe35bbec6c0130a
-
Filesize
340KB
MD542d7a683e52ec2ed56aba77dc19a557d
SHA16879183430f0c638321cfae8cfdc6cb0de4b1303
SHA256b49d4471af4e4329ed40e1723322878b8a5c71eb7fcec0acfaa6a04bc9f8a4f2
SHA5123568355377f89acd23f5db49bbc5b77841002a39dc94f4d057470586b8220dc070bb7e38475de5e499db328e6c31aebd6e3b72d432eb07d26b2efecf6d214c2b
-
Filesize
4.7MB
MD574ab0ab15192781b4a2fcb6cc11f1ceb
SHA1f5f58a64f2d745188010f1f525168a2b122d506a
SHA256854d63979e209483548db1555529e75d2bd0b60356abe2e1d8a339491e7de98d
SHA51279c8cf85d6ff4ed250eefba6beff447fef2a3e4f429b90f09fbb9b184fa243edb2a47c4db1cea0d53cdca61ff9434be7bef64f8e3eeae7756bce5ff1590ab3cd
-
Filesize
4.9MB
MD5e882686b301f399014edc0215bfe8d4b
SHA1ea9641fb919b3350893545b69165d082a2215681
SHA256677acf1217d28a655725b721a376bcb51671ead54c12632e87dd8798a41e0a3e
SHA51295d61d6e3c2a85de8b2e0c3f49f4e874ac0e3fc3ff9a8db49f07d067fbfe711ab0777d3cc7af34a6bd8ebaa7ba1de6e030f54a5e144c6fd01812b84001bc3652
-
Filesize
528B
MD571a98f438f7df95f615fb2e46a84f505
SHA1edeec17eb1dbaf9eba39a966ba943c382e174746
SHA256604b079470e0bd0e986a300813eb275ad77da94addfb23735e03d85d33b1ef0e
SHA512bf7503618269dc0108799b3c9f06db283ffed6a9179d1582f23d27997f31eb76f32d263730b8bb11524bc2dfda5a97e38f9c8514793a9300005ee6a4e550ff2a
-
Filesize
552B
MD5618c33b21601a0fea2406e6255cfaa7d
SHA15fd3718bdd3713b069a9cd700c537818f32936c7
SHA256fe431c19a190c9313955e813eb08d6dd3947c301a099e6985b3e3761adf52f03
SHA512e7a00f2fc4739471bed025a512963c1cb035b8ec986944d7c8c525c46f1da69ad6fde34784a2d910fd51c2cf75b26c2a963fb988ae64e2cc2b9ae03a185c8141
-
Filesize
550B
MD52120661e1869075da88d0a31ab63163b
SHA1d024bbadb7f197a0448dec3249a4671b3c605898
SHA2561bdbec410ca6d7c0856dab08a6414f1123e945e5218f7b54ba607119386a5ba0
SHA5121145cc8d9bf27adc2dc5802939ece6846629697a1d1a5d17168a1a2a045f250b31a3a902a776f77cffacf6c8844062ee8b04ca748791fc5c79e466089bb42155
-
Filesize
1.1MB
MD5a4e51ab835e89246f10c4c6bcea0d090
SHA114fdd3ce7e1c78828782995975cdeea93b38f15e
SHA25609dd725c4b462bee8b61e86c97d31b8eb2dd76390b6c0c9c18413bb403c43006
SHA5125b0754cb21cb5cb14e4e98faad27b57b4274cb1520d55cb425fea2e779a9cafa439a9ea323ea9fc153437debb4087b7a768a68585ef90fba0d791d201ac05a16
-
Filesize
94B
MD5d843c3a3bfd1b4c6072155ab6ae56c88
SHA11c82b81ab8fb7b24f269a6f470cb948f9c8644cb
SHA2569aa7df430d307ff6e768613f64dcaccdf45372cbba1120d07b83ad09aac696d8
SHA512f4694e9781dea3d559d5812e7419c9fc367258f79f6b3d70928b3e94bd7e520f528bce8186a12925bfa87a929b441c45504a56e1b7ce8730280e4fc381604648
-
Filesize
99B
MD53de48f50a7fb32d93b4a7883f699666a
SHA125069fc05a547a368aca317e70fe28df744e5790
SHA256fecb12916a42e01f60fff5224e3ce24d39e7473e6f594e06ec3b2bc0215797a8
SHA512db30a0751df711f262d93314f670fa6c51c2e0b7238334e513cef4930f25a87bbd756d2dff82fb31df5805276a997cef5a1c6626750aefa957f982b51c22eef8
-
Filesize
5KB
MD5f6b6fa565c6b9196495ffb5fe0f62634
SHA1964469c79b3631e722986e2db62f7b54a0a64169
SHA25690f2039624c85649d26864732d03e8ed84a25d52a77bf844a79bc27810ef4d3a
SHA51219503e3d30fc9ea4bd2ba869117dd2c2bb5b1ce38d806e77828d6b8ac0f3ce7073b180e837606c384d4c0e4a14ad552820b1d10ca5f060074f6bde8564331eed
-
Filesize
1.3MB
MD52237b196de74b2516360f2e0a4b302a0
SHA1cc25a25b67a197e811048bbda90bc11bebb862f2
SHA256163504468b302e52914ff784c2878d2c42a2d5b0c5d9eb3ff15b46aaecc48978
SHA512c6a4bc3150ff2b00435f2e094860f3a0cc9e9d1bbe4ed58450c472444d5050cb799d878eca144e36ae2911691876d96e016f5e22df69530ab5fa3197dc3d0907
-
Filesize
318KB
MD58c0b6838878f3dd76135f999ddb1c900
SHA1903371c45acc9afd86911a417938954963904442
SHA256f537713bbe56322189b5ca120537b25d380da267bac4b6a3fcafa62c1c8a0777
SHA512460bf428ebe57b2b018fdf0316028f80ac6921847c0600c1d9c7f3c8fe78c172ccfd4f1baa33ebc391040f9efd302523050bc0e239de85ed77dc205da87cadd4
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
124KB
-
Filesize
1.1MB
-
Filesize
4.6MB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
4.6MB
-
Filesize
4.6MB
