Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
100s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 00:57
Static task
static1
Behavioral task
behavioral1
Sample
58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe
Resource
win10v2004-20220812-en
General
-
Target
58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe
-
Size
3.4MB
-
MD5
0da52be4f0362dd4a0655340d84562de
-
SHA1
4dd924e6f32f0d1992b18ebb82ffc75121922a28
-
SHA256
58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f
-
SHA512
4af1dc5c0b8330cc811731a49fcd87ae8e4563b33ee534e8a1efd20bfcf4847f3db0556bb05ee790cd208736027a4688776fd76fd3415f8b8311cc0fcf99ea51
-
SSDEEP
98304:63yobVyq03fv0oKATM6A/7zf8iEFb1OL6PVgNZzi:Yyey13EoXM68vHO5fPeNZ2
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 792 drvprosetup.exe 632 drvprosetup.tmp -
Loads dropped DLL 5 IoCs
pid Process 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 792 drvprosetup.exe 632 drvprosetup.tmp 632 drvprosetup.tmp 632 drvprosetup.tmp -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 drvprosetup.tmp Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString drvprosetup.tmp -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1652 wrote to memory of 792 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 27 PID 1652 wrote to memory of 792 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 27 PID 1652 wrote to memory of 792 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 27 PID 1652 wrote to memory of 792 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 27 PID 1652 wrote to memory of 792 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 27 PID 1652 wrote to memory of 792 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 27 PID 1652 wrote to memory of 792 1652 58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe 27 PID 792 wrote to memory of 632 792 drvprosetup.exe 28 PID 792 wrote to memory of 632 792 drvprosetup.exe 28 PID 792 wrote to memory of 632 792 drvprosetup.exe 28 PID 792 wrote to memory of 632 792 drvprosetup.exe 28 PID 792 wrote to memory of 632 792 drvprosetup.exe 28 PID 792 wrote to memory of 632 792 drvprosetup.exe 28 PID 792 wrote to memory of 632 792 drvprosetup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe"C:\Users\Admin\AppData\Local\Temp\58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\drvprosetup.exeC:\Users\Admin\AppData\Local\Temp\\drvprosetup.exe /VERYSILENT2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\is-3UDM5.tmp\drvprosetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-3UDM5.tmp\drvprosetup.tmp" /SL5="$60124,2637513,85504,C:\Users\Admin\AppData\Local\Temp\drvprosetup.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:632
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD5e2bc1e4dbb1b4a5342b8dea5ba2ec9da
SHA15325f6df57aa9d6cae42964aba0e035ab64edfd6
SHA256c7cf53ed5ed00bce7d76401ce81ea293e3e7e773a58aace75719f489bc52dfcd
SHA5125e8f0b900ac38539d77204bbc6e3aed42c3e7d39279b0d21fe2fe1f37fe27e63f96d70fa7dd175198a747be0e3e04133e66ba84943fe06bdc162a826ce8d78f1
-
Filesize
3.0MB
MD5e2bc1e4dbb1b4a5342b8dea5ba2ec9da
SHA15325f6df57aa9d6cae42964aba0e035ab64edfd6
SHA256c7cf53ed5ed00bce7d76401ce81ea293e3e7e773a58aace75719f489bc52dfcd
SHA5125e8f0b900ac38539d77204bbc6e3aed42c3e7d39279b0d21fe2fe1f37fe27e63f96d70fa7dd175198a747be0e3e04133e66ba84943fe06bdc162a826ce8d78f1
-
Filesize
1.1MB
MD5dcb39cc84c9294a56d2f2a01211377bf
SHA1ea30b92f18668d34e421821f343a7061e8138086
SHA25655ca4a2da5da485d1216ad825572165c23d1440204f0bbfac127f6cfe45a6108
SHA5126579250d2ac658c860f40fd85fd525c0856fb7ad4faa75122e8685eac407c7c99ad7078450eaf106ecef60654693ddfa18a421dab4be7eee4ec20d097bc57cd7
-
Filesize
3.0MB
MD5e2bc1e4dbb1b4a5342b8dea5ba2ec9da
SHA15325f6df57aa9d6cae42964aba0e035ab64edfd6
SHA256c7cf53ed5ed00bce7d76401ce81ea293e3e7e773a58aace75719f489bc52dfcd
SHA5125e8f0b900ac38539d77204bbc6e3aed42c3e7d39279b0d21fe2fe1f37fe27e63f96d70fa7dd175198a747be0e3e04133e66ba84943fe06bdc162a826ce8d78f1
-
Filesize
1.1MB
MD5dcb39cc84c9294a56d2f2a01211377bf
SHA1ea30b92f18668d34e421821f343a7061e8138086
SHA25655ca4a2da5da485d1216ad825572165c23d1440204f0bbfac127f6cfe45a6108
SHA5126579250d2ac658c860f40fd85fd525c0856fb7ad4faa75122e8685eac407c7c99ad7078450eaf106ecef60654693ddfa18a421dab4be7eee4ec20d097bc57cd7
-
Filesize
1.2MB
MD5c5d6b7f4520e35daaaa9f8c1b0c3477c
SHA1da3371df6b0dcdf0fd2ab812e2f62b4b6cfdc187
SHA2564d1725cd717e0d907c2b24185a8993fba90ed98953093fed4954f985f685897f
SHA512b4bb63e9be54f28df02d43aa8adbfb22ea4167eee40833963ae40b497471f8116af2521fcb929d02389177c31e9b3848cb9a4f8cf2faa73375b8d06af5b0c1bc
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3