Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

Install.exe

windows7_x64

8

Install.exe

windows10_x64

10

Install2.exe

windows7_x64

8

Install2.exe

windows10_x64

8

keygen-step-4.exe

windows7_x64

10

keygen-step-4.exe

windows10_x64

8

keygen-step-4d.exe

windows7_x64

10

keygen-step-4d.exe

windows10_x64

8

Resubmissions

12/11/2024, 01:29

241112-bwgrxs1gnf 10

08/07/2021, 12:18

210708-8z6d5h8z2n 10

06/07/2021, 17:53

210706-g6we6sa7sa 10

19/06/2021, 18:17

210619-vr8bj2dzfn 10

17/06/2021, 21:39

210617-a9cvlnmrbx 10

11/06/2021, 17:26

210611-wvab1yw2tj 10

08/06/2021, 06:47

210608-qrbpch3y46 10

08/06/2021, 06:47

210608-64tndgm1ln 10

05/06/2021, 18:40

210605-cd6qpr55sx 10

04/06/2021, 11:56

210604-5c416rs3ns 10

Analysis

  • max time kernel
    1698s
  • max time network
    1705s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    17/06/2021, 21:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Install.exe

  • Size

    497KB

  • MD5

    41a5f4fd1ea7cac4aa94a87aebccfef0

  • SHA1

    0d0abf079413a4c773754bf4fda338dc5b9a8ddc

  • SHA256

    97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9

  • SHA512

    5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Score
10/10

Malware Config

Signatures

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
      PID:3092
      • C:\Users\Admin\AppData\Local\Temp\Install.exe
        "C:\Users\Admin\AppData\Local\Temp\Install.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:648
        • C:\Users\Admin\AppData\Local\Temp\is-RDLN1.tmp\Install.tmp
          "C:\Users\Admin\AppData\Local\Temp\is-RDLN1.tmp\Install.tmp" /SL5="$201DE,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:796
      • C:\Windows\system32\SystemSettingsAdminFlows.exe
        "C:\Windows\system32\SystemSettingsAdminFlows.exe" FeedbackOptinLevel 1
        2⤵
          PID:2376
        • C:\Windows\system32\SystemSettingsAdminFlows.exe
          "C:\Windows\system32\SystemSettingsAdminFlows.exe" FeedbackOptinLevel 3
          2⤵
            PID:1320
        • C:\Windows\ImmersiveControlPanel\SystemSettings.exe
          "C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
          1⤵
          • Suspicious use of NtCreateUserProcessOtherParentProcess
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2480
        • C:\Windows\system32\wwahost.exe
          "C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:592
        • C:\Windows\system32\wermgr.exe
          "C:\Windows\system32\wermgr.exe" -outproc 1 592 416 364 424 0 0 0 0 0 0 0 0
          1⤵
            PID:2052
          • \??\c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NgcSvc
            1⤵
              PID:3340
            • \??\c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
              1⤵
                PID:3772
              • C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe
                "C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca
                1⤵
                • Suspicious use of SetWindowsHookEx
                PID:2984
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 2984 -s 1652
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Checks processor information in registry
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2148
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                1⤵
                • Drops file in Windows directory
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:2960
              • C:\Windows\system32\browser_broker.exe
                C:\Windows\system32\browser_broker.exe -Embedding
                1⤵
                • Modifies Internet Explorer settings
                PID:3772
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies registry class
                • Suspicious use of SetWindowsHookEx
                PID:304
              • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                1⤵
                • Modifies Internet Explorer settings
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:2036

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/592-122-0x000001AFA1D20000-0x000001AFA1D22000-memory.dmp

                Filesize

                8KB

                Download

              • memory/592-123-0x000001AFA1D20000-0x000001AFA1D23000-memory.dmp

                Filesize

                12KB

                Download

              • memory/648-114-0x0000000000400000-0x000000000042B000-memory.dmp

                Filesize

                172KB

                Download

              • memory/796-119-0x00000000001E0000-0x00000000001E1000-memory.dmp

                Filesize

                4KB

                Download