Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
7a3c0f183a5...fN.exe
windows7-x64
7a3c0f183a5...fN.exe
windows10-2004-x64
7$PLUGINSDIR/DL.dll
windows7-x64
3$PLUGINSDIR/DL.dll
windows10-2004-x64
3$PLUGINSDIR/IS.dll
windows7-x64
3$PLUGINSDIR/IS.dll
windows10-2004-x64
3$PLUGINSDIR/NET.dll
windows7-x64
3$PLUGINSDIR/NET.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$PLUGINSDI...ON.dll
windows7-x64
5$PLUGINSDI...ON.dll
windows10-2004-x64
5$PLUGINSDI...ze.dll
windows7-x64
7$PLUGINSDI...ze.dll
windows10-2004-x64
7Analysis
-
max time kernel
110s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27/09/2024, 12:48
Behavioral task
behavioral1
Sample
a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/DL.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/DL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/IS.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/IS.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/NET.dll
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/NET.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/nsJSON.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/nsResize.dll
Resource
win7-20240903-en
General
-
Target
a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe
-
Size
732KB
-
MD5
2e9e1fe868f8c76010b7b5e97b31e840
-
SHA1
ea627e8b712363a0252ffef2ae26ab7138d4550a
-
SHA256
a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4f
-
SHA512
32cdcf7273b58c109d534ba3d13ee6be642c706ba22704802619da92e403ec778e83b1fb4dbe276cc744c0c933e548209e1c80099eb5126c64064ec8e3830956
-
SSDEEP
12288:j0gsaGle5IGICmMwHW0MB3ybbhGNWVCOlO/ohLftqacu3pS:wvaUG+9e3yGN6vcu3
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 7 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x00070000000234e2-14.dat acprotect behavioral2/files/0x00070000000234e4-29.dat acprotect behavioral2/memory/1280-32-0x0000000073910000-0x0000000073919000-memory.dmp acprotect behavioral2/memory/1280-36-0x0000000073910000-0x0000000073919000-memory.dmp acprotect behavioral2/memory/1280-46-0x0000000073910000-0x0000000073919000-memory.dmp acprotect behavioral2/memory/1280-57-0x0000000073910000-0x0000000073919000-memory.dmp acprotect behavioral2/memory/1280-58-0x0000000073910000-0x0000000073919000-memory.dmp acprotect -
Loads dropped DLL 11 IoCs
pid Process 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe 1280 a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe -
resource yara_rule behavioral2/memory/1280-15-0x0000000074A00000-0x0000000074A0A000-memory.dmp upx behavioral2/files/0x00070000000234e2-14.dat upx behavioral2/files/0x00070000000234e4-29.dat upx behavioral2/memory/1280-32-0x0000000073910000-0x0000000073919000-memory.dmp upx behavioral2/memory/1280-36-0x0000000073910000-0x0000000073919000-memory.dmp upx behavioral2/memory/1280-46-0x0000000073910000-0x0000000073919000-memory.dmp upx behavioral2/memory/1280-56-0x0000000074A00000-0x0000000074A0A000-memory.dmp upx behavioral2/memory/1280-57-0x0000000073910000-0x0000000073919000-memory.dmp upx behavioral2/memory/1280-58-0x0000000073910000-0x0000000073919000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a3c0f183a5ac52c63d4db8c3e4f3a6ccfb42011db1bb88d4c1e5fe0b1bfe8e4fN.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5194dcc4b0a5ad6b6f7c1f166d96c4476
SHA1fb0390ac1e04a66f284adbd0af6e809bf5b0792e
SHA256643e7fd4591d117c43515efc93d4ddbaf0879b14403531147f4c34a49275ffd6
SHA5124161da2fddcd0561237082c639716aca566a7755dd0589c5b5d63d436dbb7df5838d2a7c8c11cbd74346d678cdb4c5b8022f78855f6a9613b17be9a47487af51
-
Filesize
92KB
MD563834ec07c42859db4ebef4947046d50
SHA1ea9551cba09926ae639c0ba93479049fc060af4c
SHA2561bd3438268e3a8e6060ec607e503714805657d01b3a35fea289f2624ff3265c0
SHA512972b8ecfa0ba2bae2f7ed269f66a11a90dfc45435f916bfee58ce493fb244b0b077412260390cf43adf64098f2771daabdd3541e2350137f450423d8c119503e
-
Filesize
11KB
MD5bf712f32249029466fa86756f5546950
SHA175ac4dc4808ac148ddd78f6b89a51afbd4091c2e
SHA2567851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af
SHA51213f69959b28416e0b8811c962a49309dca3f048a165457051a28a3eb51377dcaf99a15e86d7eee8f867a9e25ecf8c44da370ac8f530eeae7b5252eaba64b96f4
-
Filesize
9KB
MD54ccc4a742d4423f2f0ed744fd9c81f63
SHA1704f00a1acc327fd879cf75fc90d0b8f927c36bc
SHA256416133dd86c0dff6b0fcaf1f46dfe97fdc85b37f90effb2d369164a8f7e13ae6
SHA512790c5eb1f8b297e45054c855b66dfc18e9f3f1b1870559014dbefa3b9d5b6d33a993a9e089202e70f51a55d859b74e8605c6f633386fd9189b6f78941bf1bfdb
-
Filesize
7KB
MD578b913fcd04259634a5e901c616e6074
SHA1ad5e1c651851a1125bcad79b01ccdcfa45df4799
SHA256e3ce60666bb88c2412615ef9f432ec24e219532dee5cc1c7aebc65ed9ec94d59
SHA512cbe07179dd93011f3d9a8f83541961ff34fb83d96658ac82a433ef0aa3399b183eaec3e6a49ec1c1e478d1eada2d3ebc78ffb1ae0574984ae66a7a9cab5d59e5
-
Filesize
4KB
MD5a8655e0ca9e079edc631838273afc087
SHA120c4468e90f961c499870cfa6a179c82f6d72675
SHA256eeb2705599c3075e652762e74c88d3cb482e01ad8cae65f02022f91aebf13cb5
SHA512383201fc7f0d15f0d02ae638e411becac61eb5f475020220035ba6df560aee23cbb90082e6827aeaba434e150c08df87914e3cea308ed197f86d560eacc369e1