Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2022, 00:41
Static task
static1
Behavioral task
behavioral1
Sample
driver_booster_setup_cyri.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
driver_booster_setup_cyri.exe
Resource
win10v2004-20220901-en
General
-
Target
driver_booster_setup_cyri.exe
-
Size
24.7MB
-
MD5
291dd01e49c206cb9f1f7892d1b3776e
-
SHA1
cf46cd488fccdad30d1e381dbf3f10992b6b3430
-
SHA256
7d2d951a80874ac6d0194f5c972e76c2d92be57627198e2a7c011811868a91dd
-
SHA512
b4ae258d903057cff0c2fdeb265f544fe3191d86e692fbbfcfca6bac747b2d46938adbba5bde28fddbb83a7869eab8c2579512a13352f8e4c582b5bfc0e985f7
-
SSDEEP
393216:/4I5UMYEojxBzIUWUdQ5/lXUryjYCRcSUbUMAWNArssIKXxYdKDc46YE:/4+UDvDzLNW/5l8CRiYwArcKXxYYDIYE
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 3016 driver_booster_setup_cyri.tmp 5012 setup.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation driver_booster_setup_cyri.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3016 driver_booster_setup_cyri.tmp 3016 driver_booster_setup_cyri.tmp 3016 driver_booster_setup_cyri.tmp 3016 driver_booster_setup_cyri.tmp 5012 setup.exe 5012 setup.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3016 driver_booster_setup_cyri.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5012 setup.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2044 wrote to memory of 3016 2044 driver_booster_setup_cyri.exe 80 PID 2044 wrote to memory of 3016 2044 driver_booster_setup_cyri.exe 80 PID 2044 wrote to memory of 3016 2044 driver_booster_setup_cyri.exe 80 PID 3016 wrote to memory of 5012 3016 driver_booster_setup_cyri.tmp 81 PID 3016 wrote to memory of 5012 3016 driver_booster_setup_cyri.tmp 81 PID 3016 wrote to memory of 5012 3016 driver_booster_setup_cyri.tmp 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe"C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp"C:\Users\Admin\AppData\Local\Temp\is-S4PBP.tmp\driver_booster_setup_cyri.tmp" /SL5="$9007C,25203947,139264,C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe"C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\setup.exe" "C:\Users\Admin\AppData\Local\Temp\driver_booster_setup_cyri.exe" /title="Driver Booster 9" /dbver=9.1.0.142 /eula="C:\Users\Admin\AppData\Local\Temp\is-Q7858.tmp-dbinst\EULA.rtf" /noemailpage /nochromepmt3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5012
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
7.1MB
MD5b9561578e1dd583f74bbd0e1dfe91105
SHA1c8dae9e25a35759d4e6e08a3116319aef02a15bf
SHA2568e6c349e197158a3f44f15e85bec54690e2ce6a6676867de193fe67dbaec93cf
SHA5128f28759a6ef591aaef5cd1096fb7dea1e9f4b4469dca8257561e32bf27cf75eb191c54d575f40c3e3179cf0604f5bb962c4f73bf641fa68153b15d9480af29e4
-
Filesize
7.1MB
MD5b9561578e1dd583f74bbd0e1dfe91105
SHA1c8dae9e25a35759d4e6e08a3116319aef02a15bf
SHA2568e6c349e197158a3f44f15e85bec54690e2ce6a6676867de193fe67dbaec93cf
SHA5128f28759a6ef591aaef5cd1096fb7dea1e9f4b4469dca8257561e32bf27cf75eb191c54d575f40c3e3179cf0604f5bb962c4f73bf641fa68153b15d9480af29e4
-
Filesize
1.2MB
MD568b52a0b8e3d45bf3b520a0e7f16dad1
SHA1e50408326eafb5ca8adc70db29c33b64e25bbbbd
SHA256b409d6d6f8896dc2afd1774479c741ca253c0e9b4732daaa08af84aa9c96888b
SHA512b8e0b486e2b9652831eb8efe48cf9575eef49204e827a64d69ae7c9c30304b2d98a66c28f1072fe8596847c15f13bbf7ec39d7708684ff64051bbae7ed063faf