Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
28/09/2024, 22:58
240928-2xs5fssgje 7Analysis
-
max time kernel
47s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28/09/2024, 22:58
Errors
General
-
Target
AutoHotkey_2.0.18_setup.exe
-
Size
2.9MB
-
MD5
71e486a03ab282b75886e3712ebb1efa
-
SHA1
33501837a85ea22f98723746aecf5199865353f9
-
SHA256
a30af310f45d4076cf1580bb08015db9a1337ddc1a99cf61829e645b196e8b2e
-
SHA512
855e76b756a5b3d2a465a900fe146eaa7113fe45a7b8c88e057b8d4f975b2b08b8b6b11ea1a697fc7df2fea3f6f0772e6c356e109240bb4e655efae7dc407f55
-
SSDEEP
49152:7rPT2Gn+45fu74LQ7A8Y+kKuxIhMF2dRvwKfrPwzuedUzxS3:/PT2a+45fjLQ9YhKuxI+kdGKTPY7dR
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 14 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
UPX packed file 8 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies registry class 50 IoCs
-
Modifies system certificate store 2 TTPs 2 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe"C:\Users\Admin\AppData\Local\Temp\AutoHotkey_2.0.18_setup.exe" /to "C:\Program Files\AutoHotkey"2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\reset-assoc.ahk" /check3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
-
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" UX\ui-dash.ahk1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-editor.ahk" "C:\Users\Admin\Documents\AutoHotkey\Untitled.ahk"2⤵
- Executes dropped EXE
- Modifies registry class
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5d0cc6a21113957474e095fca77d75abd
SHA1ea84155577bc74bf65d902425c15543509c80f4b
SHA25670031669fef8c365a243322c52df9c3f854271489e67c5a9fc3139f56bc357e9
SHA5122ad8fdbbf79934560b42ac6064d86276a7e24f6d8610d163b4d551e736b72b8dd6070e0e0b21599f781ef638be9c3d6aff8e8e3e9b7a2c00be948477b6558934
-
Filesize
93B
MD5cdc8756680c459bd511d2bd2895fe2b2
SHA1a7ea57fd628cfe2f664f2647510c6a412c520dfb
SHA2567f618d3ca343a0739a52a4a3c4f5b963ed98dc077b60c65fdc77d70fb0ec12d3
SHA512101722eb5bba352d557e7d70704e24a54a129276857e8cc13f40da26dfa9267a67de79e52a0f552ff676d1825d0fb2eb467837b397d2e6905fa90d6891bccd45
-
Filesize
7KB
MD5e2067d978526b83a1da967f16a69c125
SHA108000fb66e6f1b1fcd450f32e1757a39b3a7ba16
SHA256040404a4def02f17cdafda938f5b63fc2181940ba1290da5742db0862c07166e
SHA512a453669b15c18f24a989a57441f961861578c09c145a4364c982410e5e05ab09b05ad4a77929ccf4ab9e00e5e3d73029a13660156bf4eef9011accfd59800ea0
-
Filesize
352B
MD5e8d9a7e78d6a2a40bfb532b4812bde59
SHA15674b63092a69c419a42bab9e7462bde3bdb3cad
SHA256a6c51e2188e31e3510577263d7b96db147b0df3dfa24c96df8fdd9d73da859ee
SHA512dd7d78c7724dca4684c732b0f3f8e73af67610de8945255b48b9301672ac0b4f405c802a8cd4c343d53266f492d2d0dcd2727b5ebdb9e90cfc9173876b9ab905
-
Filesize
1KB
MD52ffbde65b63790c5aa12996e9ef9068c
SHA1a793986e4e72d5b5a866e927855eacc3a0399a7a
SHA25640a6f0cda5fd1dff324cab288bb453aa60b41b09dacbfbc64f2d871423f33935
SHA512315b2803c8e803b238e87de63a5737350e41d248f67c54662341ca889c3bd5fc6fc2f516ca20f1ff4d74fca4af247b64ec7795d4c4e8990fffce49bbf037a906
-
Filesize
10KB
MD565d05ec61cca0547e218655e65e5ea7c
SHA11cf93558bb9f1ae5a055b3f9085bf4166b7f43dd
SHA256a9a824a763195e5810bf904854af7ed41c025527b2b8faa7532c6f24189d69b9
SHA51265172fa0f9148106e44fde99e0bcad173c4eef405a19b1f54961f2a248f6e6b0a05568d728e83d6582113d0d12a5e87ce763c53271c4d52b9362b19e22ea7d23
-
Filesize
844B
MD51a8ab9bb38fd0da51d03dc48e3a0b2ea
SHA15c74ddd45c91a39b921139881c76c48c97e35825
SHA25648a3f822a720b8e9b41165a1d19d56411d1f58036338ebd07ab40f2a14cf0f1b
SHA5121b88603fb9eb28e717cb77623ff0159f5f45e677c34316dc0c5d5c2ed46c59f10d3afb532b1f99920f91b8098e544873f944b1e0e575efd694dd24bdca22c14e
-
Filesize
2KB
MD5727ae6f2ec77a5b56774df9da14636d2
SHA18216a2122c825127ca59b05b0bae0d57e92f1110
SHA25684032ecac8ed334cf8788a81bea721b0af5cd7ca7dca57b60cdec3556ae33914
SHA512f1058216b5d1b8d590eb4cafd5139f71f8df5f96a3fcc314a7635cb1b99de8623d87c57c567868ebdafb09925b8d13fdadcee49fa89f1a239725a92b948272cc
-
Filesize
182B
MD54b095aae00456aa248024a184671e4d5
SHA184ae516fbc62ce0aa10ffeacd7ba865a35a0a375
SHA256d65c6e73417e6bba7a619f2e68933b74e6ae6141277b65542aed9b6acdfc83ff
SHA51277aabe92719d8fc7a28c76f3b76fa2e42a188db14f004262d8e913620aa990cde29119b82d919511fc0d828ca0a108ea79858ba158b6a8ed6a260b72b4ee229d
-
Filesize
420B
MD59e53fca8c7f6a9ee179f0fc0a7890ea3
SHA1dc2a1bf437eea36b3f5ba9318f3b391b405d5cb2
SHA256ea67340c555fdc1abf8e324ac550ac37d2ba5f96a8edef120e72fb340f8f95c0
SHA512cad5c07f952fb93413b4a3990c522ba4b446ae41f11c8dd323bdcde1b30fbfd76515606d5dc4bcb8768bd382cdb82553801539a192b002696d253341f3c0dbc5
-
Filesize
142B
MD5165b8fc572f943e3665994f87f1772b7
SHA1265ca3d2a66a7e1807962eb7e8a444cefb61bc0c
SHA2569b75c7f804d1d55807459e6f06db2bee8e1fb60ce9c9340d44a7b491ce53b982
SHA512e675453eef9a10560cb9ea95e993d8068c8dfca3664a140b6ba33361d0736632b8ce3a37770411583f558476173294bcc12b83bf33190d89eb009bfb9bb5f0af
-
Filesize
688B
MD5dac79ad5a978f0497de70a005b6a6084
SHA1db100ce15998772fe322679468f46b0f25239eb4
SHA256dbc1420c9368e954176cd1bc38c0bf5498d721cb7dee50b5abef51611a33c658
SHA5129f2a2c0e01724ef82860cfb97fbe6196d29b3b41080f04b3f51653f2f535849428b0a245bc954aa57569aa660d5a5a20d2d1e0dbb9081d718bf2deddb051f47c
-
Filesize
429B
MD5248b58535f55eb55d9baec04a384b5e6
SHA176d067318b67da9a3da71a232a887c8935c7068f
SHA2564d1f241a0c973e30f1bf19e71cadb386b872a14bf0c29d32d4781a56cafd998a
SHA5120186eb49da706c6cc6f48ecd94a4996c258ecea10bed26b9c79bddf0f7eca32df1449166309237859ca2508427bf79d447a2202eaeba211228da9822646cf23a
-
Filesize
1KB
MD53e5c97e6c3a76686329c81fba864b26b
SHA1ec111d01a5299de2ca93c5441e92bb49d9d5e710
SHA256f5b97911887c303b6859de44eff73780309e31e931dcba86a66aaafbe932af72
SHA512c70ba459abb2c35edfd62dfbe6efb9c54d5341802a72ac7d6b3b63877f28a97a974b96b6de747e29909550d6ba2c5d14da40bef6d91841c5c8c5a903697307c7
-
Filesize
3KB
MD5f27f09d324016bd49d2da38901e79a61
SHA1f2af4ea1ca36dc4ed53ba3a5817b83d457c9029c
SHA256c2563ab626df892398083404acecc5229300ba7dc6077b120844c65facfad854
SHA5121dd5a6ddf87a3026f5b2d468197173af0c4e6c2eeab64113bcd2bbd56be46089e546f694fea2416aadc9c2669070b29ef26ec689dfbe73def8af6fd0de310d04
-
Filesize
2KB
MD565029d2c4fd46ea517b13d615a0584f5
SHA1fb924c85e3e032b997aa86f85964516849baeb27
SHA256220629b006d13b24afb3367abeea424c5b4103ac0c5a137fdc9d98047cdd908f
SHA512c1346142f1b6dd5bd9a0d8cc9aac843e117f646f09a7ac40488ab513781d0162504249d7305e63080363bd273ffbb9d5f29c6dd860b9a80928aba944cfd51a0c
-
Filesize
4KB
MD5eeecd8af162d3f318496e0e60d6d8c57
SHA131a99c80e4f1033914ce9344e95b84571f76ad2d
SHA256968473df8eac7264d9e84e6ae91a4d706cda9f89f345d182617b161ef4fe1a7b
SHA5126f55968adf7f2f02e128945016ed0c4d003c9640e4cbfc7b22b82374647e6ebdb07c02e99240da369789f4107d2c130e54d4acb1324455fd26668c4d1d009884
-
Filesize
4KB
MD5f4251e653dbbbdd8cf4640bd9855c207
SHA1d08b6e5796150aa1436fd3da39bfc5fdbaaee297
SHA256deffd87d99ff125eccac2331a8ba4e3a0044e150e80316e9469dd57f322beda1
SHA51286896ccb0acbd27eeefe6e02747958cafcca31541638435dfe9f08d89b763144f6b5fb521df11dce4c3f46b186de4905f56ebcc7c57d4c29ef2a0731a6492698
-
Filesize
1KB
MD5c90bed0679b789b74e4865ae6f2709a3
SHA1b0dbee6a237ba93daec76a0553cd3254821d60a1
SHA256c242ebb51241acab13152d95cdb05be5382ffb97f3dca2da3a4e5a084c2e3ff4
SHA512f8dfe5c558b427e05905b2a3d8a09632347edf945d47ed4fc82ec38a9045f5837a798ef669f0fdae6504d9eee6762c49c8e6c32adac0f6a3e6c2eed6d48e64b2
-
Filesize
4KB
MD530b87fbfadc592c38be9d82edf597fa3
SHA11ff5d720858a38bdd2e21a5a492938c07b2811a5
SHA2561e59921bcddb3c41651eb01605cdefcdee3c6adec5db6b7cafb7ab801ead5e1e
SHA51279a407cad251f45d13c0505cdf7e27a281455e3eefe1f7fc5aedd658297351ac7dbbce21065a29ed9d86c6b908a175cd83201e0d60e972865e6258c2f8c145a7
-
Filesize
40KB
MD5a3caa9963c9133c2a14a4e36d62761e3
SHA17034faaf46b2fe7c36370eaf4677357bb0950a57
SHA256f628edfece15db0061fdfe96724266a3cfaaec396524a94b574e22e6e3970c40
SHA51290212e732a55b7d478ff4e5b629ac950656290cb81500ba47d8282091963899b15117d0ce4db36f9bfe4ab93235374f797aa09d4f20f70f156458e9911867301
-
Filesize
17KB
MD5596b69069bbbcc9a22ac26bba6efe546
SHA1694cec54200ff1ec70dc56320c577b652884b53d
SHA256830db4be4c8320f23ff32316dac933d4e72d9056ea5a819cc12c38614da6e06f
SHA5121c18acf4403915c6a2562f5e26c0ed7c4fc00e9d67d19622d1db8bb9338ff6d6e8bf9abe7317f1b529ef1c24901b45c3b13dc3b734d97582c91b206bee9aa8f8
-
Filesize
556B
MD535f4753a58432446b99bf89a9e930bf5
SHA1babc3341d9d95865a36ea9a20549a61146093006
SHA256e4659306a755b583e9cef5fdba3b3eb102d8939fb028afd91aad4496e758fad5
SHA512ac3483a17ead5173ce40a6af55c3c2361652fefd94c0bd82e004df8186ffc31eab194534a25fe995d677f2f71363095d177c01afb6ae50f2b63ba156855ef5e5
-
Filesize
2KB
MD50299132478b49e3eb706c214bf32e62f
SHA19705c410b9f515269c512c64129ced8e0b1b23d2
SHA256d26caef44190e0b612c3e4309ff6689dc2953c72cb3de1c94d002250b089f16b
SHA5122a9ce8ee71ab207dbf4c4fcc2634d49233304da858c7880813a2127c2a063dc58703d4b2129498db630d081e1d72f899d348c01dbbcc359d92ab720b89ccdc44
-
Filesize
6KB
MD5669bd791c5aafb60ee0885ef064d3622
SHA1acefb3c3997e2eadd32413814e71aaaad5a8b6d4
SHA256e8c0b4e149ad58c57e77aac12041f1fa8bc9f25c6d642d12837efc5fd97b8d21
SHA512eb0345b3562523c58894752276938c7e5ee63b7c3a660317c9a4c1a93b6e530b12015dd380a8a230324b94a9f042380c1a1d24b49d21c3805a4711cb185a33db
-
Filesize
8KB
MD582eb574294ff4e2e7461b95f5bad0a87
SHA1a981373ef3bd61ce5a2f0ad9bedaa1cf4acfd591
SHA2567263286eb3a42eccf5edc39b43c74a8bf7c82f2671204d1ae654236c1de3f05d
SHA5121c54e110b384d55ca0243ad343e69d1f0fa9b2a863af8da75a5c992d19f9e055182bba09be227882f82d0ebf4ec94094723e2db06cdf7ee2ed574348a8d72c74
-
Filesize
8KB
MD557dcc5f7853cfd0bdd49f35d1f86897b
SHA1e7cc5a9f5f689054469c670cd4efee2889d26968
SHA256179c96d787fae5dd26cdf832e5226142ab3e4f1ff53e3b1f24cecddcf3e79947
SHA512742fcfffa94752fcdb37b28749c9fc7e43f1e467470fb3fe59aaab2a29fbecbe29ab113481fc5d009ada059975bba00d294442ec13437cef588179b7e88fb116
-
Filesize
10KB
MD51b88198b4bd36eb25e23dc412321a555
SHA1d3b5670d1bc7343ae40ad087bc22309dc17e118a
SHA25631249ef15cce83d150a9a5de11168a5052ff2c55dbd574b8df1c054510b61843
SHA512409fb90d7ea768c9d9a2574c09b8a69c93e8afd76234c24e3e0f71aa3f564a4f1aa46ff18ea328b1afccab54604bb239d37249d5811e3a84f0ab692b032a732b
-
Filesize
7KB
MD5dd3f9c2f9115689f4350896752f15926
SHA1fa19f1632b865b2bc098611a8be66e9f10dc692b
SHA25668b114a2ea4af9df54709a78ec5991a1f271097b29cb93757403fdb158746bc7
SHA51212f34d5ec7a7d5452eef97e4c87093240050756c564140874d316d0b9d194c961debe139badc943b024b680b68961ef6cbe71fc1a567c6622797f90ed51fa549
-
Filesize
2KB
MD50fe4932669e99a498a7bc76975919000
SHA1e0d6a7b484d3a6c0d7427f611c575f93e4f87ba4
SHA2561e09fc4af5dc3e673d4facfe4fa849c6bdd0b29c67b0efd7f96aaf387fcef698
SHA512dd3b99739106953608ac2eb2ecc4e3d316b5122b1b305bd7cfab82fcc7ec0d92b5944f4724d37cbc01ca5c6b5381b57fad9256586b5dfd0026453f9c11a32394
-
Filesize
159B
MD5e5918a52b52ca3ce2e99788a26477984
SHA187c2b54b65663e1e29e866224faeed7e8bac759b
SHA256c1908cfc4b224b3bc8d1a5c67cfe4acdb4e738d8acf98560905afc412981c18b
SHA5124f320cbea5adfed4b07012e04281e8713689271932b26d3886e3519389b15e2adadb87217c5bf09b080d3db976c77accf555493b7eab5ceb45bc59131772f8e6
-
Filesize
17KB
MD5e3f2ad7733f3166fe770e4dc00af6c45
SHA13d436ffdd69f7187b85e0cf8f075bd6154123623
SHA256b27c1a7c92686e47f8740850ad24877a50be23fd3dbd44edee50ac1223135e38
SHA512ed97318d7c5beb425cb70b3557a16729b316180492f6f2177b68f512ba029d5c762ad1085dd56fabe022b5008f33e9ba564d72f8381d05b2e7f0fa5ec1aecdf3
-
Filesize
1.9MB
MD55836544d903111b9f15f3007ecf24e75
SHA1562e99a9591b6adda5dc892b35923f6d99582fa3
SHA256e18dbc5445fcd079fdbb189ba53c48ccff8fb8723fca39c353e9c99fdee38b85
SHA512837aaf2d66c8a0964a6b979cbf0d90f64dd20996e59c771d7ea47b9bb949bc017b14585b07b137c0b60842f846004b53f5a5b1fcdf9c78dd8e38e8b60eed9283
-
Filesize
955KB
MD579df35982c6d7de66155a01505c00bf1
SHA1e9e488f574ffb40dd62922328c4edec07b3d1a0c
SHA256fe0b57163bcf3d4542d902570b48665523d9293090496f990bb76ed421173f3c
SHA512643e8e0ef47afa87f81fb995a9e5c6d58a8a57c7a824fe91f3ddcb017a867578c0ac0ad9f05435418b9645805a07b97487f814e09e125d77ffb6bc7ed3b8f147
-
Filesize
955KB
MD5c198b9c4d97c074aa7b355d19303142b
SHA1aae2f53d1f3cdee6d3c5deacfb5fdb2f0172ce46
SHA256d87056076fe633d53c45e2629587ffd5160abef56664a9cf3903968635537db4
SHA512ab9bc4dacd1432ad0bb4f6223e20569160387b59ef255f3b17849878e6688287ddb305a7e193688632f91ef381087c3762bad9e1806af63d616633282e9b9e2e
-
Filesize
1008B
MD5b3f3381e0af2758dad636d5694238efc
SHA1a09d7da06cdbee993feea9dc4c5b34d56887492c
SHA256f661de069365398de25f499a830badb063c77f0f755f710d56ccedf6c26991ad
SHA5120ba5404b7a4ab51baca53367eef05574c3e13ee74c5d7a8e831f4720801ba05d995c8b8a5933f568715fabb66b5e86a4809b2d1a06d0471ea80c70c985d2b072
-
Filesize
1KB
MD5d678b7a56e3bcc248532ef098c57d179
SHA17d1ef042a77d084f049d9282e7fe56cb5f5526ae
SHA256467b80c40816f50a435fad72c3a4950cb2d03d66cc816dbcc54a3869f3d95b20
SHA512be4f1b09264e651f867f172d92a0b36ee80f0ad75826acc35d25c44a25b0723620f398ecd7defd5367ce44a02bce21e57c9994be48bdf0fe81600dd638b2394a
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB
-
Filesize
5.3MB