Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18/10/2024, 08:18
General
-
Target
a99860f6628b592c0f7b187a3aab5279723a5be8deb2b292dd62cbeabbbf3166.exe
-
Size
2.2MB
-
MD5
276a186c8671f1348db97205dd28e874
-
SHA1
e88cb8f03005223dd2a007aafebca33fb4d26099
-
SHA256
a99860f6628b592c0f7b187a3aab5279723a5be8deb2b292dd62cbeabbbf3166
-
SHA512
bc499ba71f599fc4dce5ec4c9296c731936e64bf81a18ce489c9fced72657dd91921c3a805f62b05c09a96469ef606c4e607cdccc48be188729a64cef81a216d
-
SSDEEP
49152:0Zrug17iugcy2JFUhn5GUcvawwzx48EbQDl2laGtY:00s2ug7uF+4iPEbQDopi
Malware Config
Signatures
-
UPX packed file 17 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Modifies Internet Explorer settings 1 TTPs 34 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 10 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a99860f6628b592c0f7b187a3aab5279723a5be8deb2b292dd62cbeabbbf3166.exe"C:\Users\Admin\AppData\Local\Temp\a99860f6628b592c0f7b187a3aab5279723a5be8deb2b292dd62cbeabbbf3166.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://lanseyou.top:6093/txt?&ys=0&lj=%E6%94%AF%E6%8C%81%E7%B9%81%E4%BD%93%E7%B3%BB%E7%BB%9F%E6%96%B9%E6%B3%952⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2744 CREDAT:275457 /prefetch:23⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
342B
MD5677cb542c535500ca046279310384a1c
SHA13314754ab2a66871668ad7b0a4065a47ef48f594
SHA256ee7ec32be76c14500cc8475e21fecff6b4ec52d641cc9cfe6252531034710feb
SHA51234351c797c0f1d6b9d77bb375dbe03eb61f65fdcd17f52b514b8bb03c0253117207ae895bc3c59318eeafeaf3fa63c2c756d634ff8c6fba1b42e5912ce515236
-
Filesize
342B
MD556eeb3c822aa9452bdc8988d8d336ce8
SHA191a8cabc40f4e4a87b9d2d61856e6865de48c90f
SHA2567d4272c8f15810da472df7e7200b51efd092528ef3d2a5dd445546d8a5efabdc
SHA512d69d0d9456917f0275addee41ff50418c5a737203ad7702db009642ba9c4ea9e28f9b4d07493040145e8960ea50cbd5eb99a562bc72086937036c3c378e4feca
-
Filesize
342B
MD5a879a9e408f2fb3280c5a97216d9ffb9
SHA185c9baf04d2f6509450ee119955de1927d2f8c83
SHA2560e946e2adf6d8d53c243ba0467ac1863ea12c1612cf9632f8c3b6bf3adf13b23
SHA51256bf0d49dbc5e9f75929fbb7f6852c049b6d124da9bca81d39acf33cc1f656b4090ecef9b3929d778e6ebf6270acbfe5d6e1f84a9e2b33e8e62e67bb2b26fb72
-
Filesize
342B
MD5bb2df4aeb222e2c67847a0a79a8df963
SHA1fbe085ccfa5820fec96ec64f84e27392cd96d320
SHA2560e10b20a9ec624fecde7e25096f1e36ded08dfa5b7921d2aea96ef57ca0fb452
SHA5121a8067eb26d4ba399099515a67a5015a1882f7b43a500711ea46de11c7db3f5a0b82b37b4ba890ee5b1355f629ce6a41c3b6b5fca0058fb09e3acd14b9438aa3
-
Filesize
342B
MD53f3ec27a0351995a26d88b3afe6c9383
SHA1a57a1ca32ebaf8d5126ace113e8c37f70ff13712
SHA256af344ecfe689a0fa649686f53f2cea3ed2caade91cf305e4fa57bb7041816b09
SHA512fb7a6372e6b7fc15ad0a5ab5b37bfffdae4c9bc8a5c7ef998806d33c48da15f4202bcc698b2a4275f6c6eda1fb0f0f16c23aff2d2a17dec9a5cbcd78c0aee9e9
-
Filesize
342B
MD58264584721e2f9a48c7a3e618914b1e1
SHA11f9a86f5714e2937052f48677b9301d09a37a706
SHA256082dfef882aea549f1bfc6b9ce6cd68424537da9cdaed178476a087e57995302
SHA51280f45f6b5009ebf710679d70e801e5cfe6bbaaa8688adcec9ad91fe1f0457f3f975dab2e9eb9497c3457d685c2f21e2d2167105c891bd335f0ee0504555299a7
-
Filesize
342B
MD5ed3fe743bc10f034b58cda026de9e37d
SHA16a16ce6208d209575ed96bb0b567a880c11459d2
SHA2560e50f96fc8d67cc6486daa5a56e470356623ae6c08dda8fe4a6d27bd4b32db55
SHA51246a52d02e5667966c75ab59fee5a618d4cf86d39b8e965ccaaa379c12f306f6cf65181c63f8d66f72e4ac983067772933697f38c806499121a40df9db6086f3d
-
Filesize
342B
MD55138d305023da4f7aa3ed9b7cc69fee2
SHA19dda24627f37a5f74024b2dc0f523761a3ca3c6b
SHA256d43e07665ff043c22370d720b52052b22b579b463a3e413e34e41b3df7b08027
SHA512db07c3f9d82aa5af0267b5f0827d724c63344cc208ffc4eb63f668e6e4bc6328bb372042cff8062eb97be63375934c800553943f0440fa35783a70d10a7955a5
-
Filesize
342B
MD58efadeb9d96f96dd37d2f779e7fe0d0f
SHA178129fa77b98f49fc35c55cd9ac5f190a5c855ac
SHA256c99dfbe4b505f9e215f8bbbd5b8db0e348b9d66894789ebc14ca2c49db51a6db
SHA512a98035b29e153f1c62f1c39c2053e27e68ded53ae29e5a0151d3a305db2283bdfde65597191ef73135d8978a09461090741ec41eff3daba9acd2d393f8a6fdc1
-
Filesize
342B
MD59fca89657ccda9a9464b96414a17222d
SHA1cdb7a1a2af06eff91b386d1e0e1afaeb322368a1
SHA2565473026b39fe601e3fd0adeca709256f1ac70749edbed9ef2143e6899fda2014
SHA51276bab6302b6deab59d0c1c4637e7fdab37401a788d1789a943640d9670b2ad8b1077a43b8c8eeb997f36489deecc30ace109e19ff6513b3ad5fd13f6d5b57947
-
Filesize
342B
MD5eb37d1b54f9bd315d895cfdd7f25f498
SHA1818ec6c829c16fc715ff71adb5b43a58781d54e3
SHA25619b09d3f6531ba4cfc006c74df4ccdbdb62867b4589c6c502df20397c2a215ef
SHA51284cec82288dc064f79ff3daddb4855eca1afae53209267d50936ff1d4c59c800bfcd0c552906558c7068abfaf46aa3be92d78e9f06e8f2b9a276d7794c975367
-
Filesize
342B
MD5a9b9043c8446ce760320dcf8e0a0a1f0
SHA16e25ca9b5f56d08b2d0afc36b65ece5096acdf6a
SHA256a8043b0cd031b30ac3de52b8a34cc2bd2e0e84ef86b802aad64c953533e517aa
SHA512d001fdc03e645d5e6f89ef514bf3600e003fd4b566686a6aa2e198255df8bed34f43055601ef4eaf7eb12d087f74673015cb4f5a93ec0a059e006efc883e1f3a
-
Filesize
342B
MD50135bfce20f23ba6110b67b83806f1a3
SHA101b92ec5002d1ddcf16edd7ad0a3796ec97bc244
SHA2561ddffae6a5870ccbc1f63756521575379ca44e497b7d493d1703bc0b8498d922
SHA5129cce1efbde463c7dd78a626c3be62259d3db432fab7cff932e8211c1aea75d9cc626dab9c186e7c3116371379faff35e6f16ba92b9ac2905f4d026b5964a0028
-
Filesize
342B
MD5132b1c31bc21a2e1ff6dd416212fe915
SHA1cb422923349eaaae32eecc998f2e05c3d84e8624
SHA2561150ff4a0e34cfa619f19b39c93d0e191c5fe4e436bfd5a53710b476143b81a9
SHA512fb4232f47965976b2092860464694c70c32ceda81e517648ff04e447b73a97f3733933b07fcf855fa6e3afd7cd214f41eff8d130e9f1f15b62cfd7def40d6773
-
Filesize
342B
MD5e22a01db90dd8693a795ee0c89c99800
SHA151818b09d8b8f62fc69a77751d6faad15c037c1a
SHA25642b16b5cac63eb800584cbcb7a0460f2f174bc6b83d2905826eb3059fce35bd4
SHA51251ec6d5314c676461263e3b88f52f204b65960183aaea574f3819b0321cbcb9adf2e047b9116aff39afffef637d0d3400e7dc37293fc0efd75254550b851c9cb
-
Filesize
342B
MD55ebefdb28cc0c26eaddd9f7c9cfdc278
SHA1bfee6a97d0eb192a9f5c1b5abd31c099a840c222
SHA2569d6eb0ac5d492a573183eb36ab58bcf4e9df308a6b8419bb2f514e3b56d72d54
SHA512faffb5d07f72f570d85106b388d7c3e844a2251c726863ca8bf3cc652bb256e3a9d8ba0492311c6244aa94564b69e0da9f10a53582d200183bfe56c23b530820
-
Filesize
342B
MD59e84d07a196c3386d6f880e8fb39d511
SHA11d281b285a3a7e76763836cc12bc452d9fcfff69
SHA25687c8d2737c24e17134b8c6e5e1f5e87658f24a8f79b029ad02a760aabdae4673
SHA5122526802b1b2cfd5b76ac1c8e03374210ab4cdaa0775d4333e8c2ebc98febe5665d18aad25a9215bbd96d1faae7a5d6c8976ea8ad4a8fd6c21263308a3695b8ae
-
Filesize
342B
MD59f1e14defa186f3c8d1789f4e4c39ece
SHA12ed973c9470a4df3cc6ce46c2e632bcdab692db0
SHA256051a048b2ea48edab54207c4adc42e7b29ee22f69f937d05f5c94ddf94100fcc
SHA512bfc83a6016d92fc3983ab8b4a5282b37ba58018e89954fb68b4a7848b902d00ba933a012718ed111adadfe6daa6b7af18121ebabff36709144a385099165bd08
-
Filesize
342B
MD5041b940e1f601c7108d19b628f114e82
SHA19608b3804b0ec09b20189bfdcc6aad6cd7a2ec38
SHA256bf82144a7f6665126ded3b1c83a4fc972a0566a213bb1c06efcc069df1d39075
SHA512e6c8c151db7ce3587d3553a2b8a7574460f810c59ebaa7e3fee0fcba86242abc96fe010b615bc67deaaf8442317854603b1e2fdcdcefac5f7915d2b6502d95b8
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
82B
MD536b11c4a12ab512f597604d405f320fb
SHA1c1998e7066a810e00daf78e2ea9ccec567e61bbf
SHA2566a0b2a6204a3416594229c738bca5650b5d35f64f4d47dace98eb0ac03e8bad4
SHA512f4c6d98a6a2224f235ed7274c2d75a2c6b87d5a1ba2aabc19ea2f4aa30e89e6b13d2f620ac8a907e9cf56966f16bb699e4b21d4ae2331c4adcba2b30d0a549cd
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
4KB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
11.1MB
-
Filesize
64KB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
64KB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
11.1MB
-
Filesize
11.1MB