Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    60s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/11/2022, 00:41

General

  • Target

    driver_booster_setup_cyri.exe

  • Size

    24.7MB

  • MD5

    291dd01e49c206cb9f1f7892d1b3776e

  • SHA1

    cf46cd488fccdad30d1e381dbf3f10992b6b3430

  • SHA256

    7d2d951a80874ac6d0194f5c972e76c2d92be57627198e2a7c011811868a91dd

  • SHA512

    b4ae258d903057cff0c2fdeb265f544fe3191d86e692fbbfcfca6bac747b2d46938adbba5bde28fddbb83a7869eab8c2579512a13352f8e4c582b5bfc0e985f7

  • SSDEEP

    393216:/4I5UMYEojxBzIUWUdQ5/lXUryjYCRcSUbUMAWNArssIKXxYdKDc46YE:/4+UDvDzLNW/5l8CRiYwArcKXxYYDIYE

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe
    "C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2044
    • C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp" /SL5="$9007C,25203947,139264,C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe"
      2⤵
      • Executes dropped EXE
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3016
      • C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe
        "C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe" /title="Driver Booster 9" /dbver=9.1.0.142 /eula="C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\EULA.rtf" /noemailpage /nochromepmt
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        PID:5012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe

    Filesize

    7.1MB

    MD5

    b9561578e1dd583f74bbd0e1dfe91105

    SHA1

    c8dae9e25a35759d4e6e08a3116319aef02a15bf

    SHA256

    8e6c349e197158a3f44f15e85bec54690e2ce6a6676867de193fe67dbaec93cf

    SHA512

    8f28759a6ef591aaef5cd1096fb7dea1e9f4b4469dca8257561e32bf27cf75eb191c54d575f40c3e3179cf0604f5bb962c4f73bf641fa68153b15d9480af29e4

  • C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe

    Filesize

    7.1MB

    MD5

    b9561578e1dd583f74bbd0e1dfe91105

    SHA1

    c8dae9e25a35759d4e6e08a3116319aef02a15bf

    SHA256

    8e6c349e197158a3f44f15e85bec54690e2ce6a6676867de193fe67dbaec93cf

    SHA512

    8f28759a6ef591aaef5cd1096fb7dea1e9f4b4469dca8257561e32bf27cf75eb191c54d575f40c3e3179cf0604f5bb962c4f73bf641fa68153b15d9480af29e4

  • C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp

    Filesize

    1.2MB

    MD5

    68b52a0b8e3d45bf3b520a0e7f16dad1

    SHA1

    e50408326eafb5ca8adc70db29c33b64e25bbbbd

    SHA256

    b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b

    SHA512

    b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf

  • memory/2044-132-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2044-136-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2044-137-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB

  • memory/2044-141-0x0000000000400000-0x000000000042C000-memory.dmp

    Filesize

    176KB