Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    100s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    27/11/2022, 00:57

General

  • Target

    58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe

  • Size

    3.4MB

  • MD5

    0da52be4f0362dd4a0655340d84562de

  • SHA1

    4dd924e6f32f0d1992b18ebb82ffc75121922a28

  • SHA256

    58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f

  • SHA512

    4af1dc5c0b8330cc811731a49fcd87ae8e4563b33ee534e8a1efd20bfcf4847f3db0556bb05ee790cd208736027a4688776fd76fd3415f8b8311cc0fcf99ea51

  • SSDEEP

    98304:63yobVyq03fv0oKATM6A/7zf8iEFb1OL6PVgNZzi:Yyey13EoXM68vHO5fPeNZ2

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 5 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe
    "C:\Users\Admin\AppData\Local\Temp\58de51bd10a4c6fe6472f3302f01fae772f6f9ec1abaeca6a2fa3210f0beee8f.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1652
    • C:\Users\Admin\AppData\Local\Temp\drvprosetup.exe
      C:\Users\Admin\AppData\Local\Temp\\drvprosetup.exe /VERYSILENT
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:792
      • C:\Users\Admin\AppData\Local\Temp\is-3UDM5.tmp\drvprosetup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-3UDM5.tmp\drvprosetup.tmp" /SL5="$60124,2637513,85504,C:\Users\Admin\AppData\Local\Temp\drvprosetup.exe" /VERYSILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks processor information in registry
        PID:632

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\drvprosetup.exe

    Filesize

    3.0MB

    MD5

    e2bc1e4dbb1b4a5342b8dea5ba2ec9da

    SHA1

    5325f6df57aa9d6cae42964aba0e035ab64edfd6

    SHA256

    c7cf53ed5ed00bce7d76401ce81ea293e3e7e773a58aace75719f489bc52dfcd

    SHA512

    5e8f0b900ac38539d77204bbc6e3aed42c3e7d39279b0d21fe2fe1f37fe27e63f96d70fa7dd175198a747be0e3e04133e66ba84943fe06bdc162a826ce8d78f1

  • C:\Users\Admin\AppData\Local\Temp\drvprosetup.exe

    Filesize

    3.0MB

    MD5

    e2bc1e4dbb1b4a5342b8dea5ba2ec9da

    SHA1

    5325f6df57aa9d6cae42964aba0e035ab64edfd6

    SHA256

    c7cf53ed5ed00bce7d76401ce81ea293e3e7e773a58aace75719f489bc52dfcd

    SHA512

    5e8f0b900ac38539d77204bbc6e3aed42c3e7d39279b0d21fe2fe1f37fe27e63f96d70fa7dd175198a747be0e3e04133e66ba84943fe06bdc162a826ce8d78f1

  • C:\Users\Admin\AppData\Local\Temp\is-3UDM5.tmp\drvprosetup.tmp

    Filesize

    1.1MB

    MD5

    dcb39cc84c9294a56d2f2a01211377bf

    SHA1

    ea30b92f18668d34e421821f343a7061e8138086

    SHA256

    55ca4a2da5da485d1216ad825572165c23d1440204f0bbfac127f6cfe45a6108

    SHA512

    6579250d2ac658c860f40fd85fd525c0856fb7ad4faa75122e8685eac407c7c99ad7078450eaf106ecef60654693ddfa18a421dab4be7eee4ec20d097bc57cd7

  • \Users\Admin\AppData\Local\Temp\drvprosetup.exe

    Filesize

    3.0MB

    MD5

    e2bc1e4dbb1b4a5342b8dea5ba2ec9da

    SHA1

    5325f6df57aa9d6cae42964aba0e035ab64edfd6

    SHA256

    c7cf53ed5ed00bce7d76401ce81ea293e3e7e773a58aace75719f489bc52dfcd

    SHA512

    5e8f0b900ac38539d77204bbc6e3aed42c3e7d39279b0d21fe2fe1f37fe27e63f96d70fa7dd175198a747be0e3e04133e66ba84943fe06bdc162a826ce8d78f1

  • \Users\Admin\AppData\Local\Temp\is-3UDM5.tmp\drvprosetup.tmp

    Filesize

    1.1MB

    MD5

    dcb39cc84c9294a56d2f2a01211377bf

    SHA1

    ea30b92f18668d34e421821f343a7061e8138086

    SHA256

    55ca4a2da5da485d1216ad825572165c23d1440204f0bbfac127f6cfe45a6108

    SHA512

    6579250d2ac658c860f40fd85fd525c0856fb7ad4faa75122e8685eac407c7c99ad7078450eaf106ecef60654693ddfa18a421dab4be7eee4ec20d097bc57cd7

  • \Users\Admin\AppData\Local\Temp\is-RVPTB.tmp\DrvProHelper.dll

    Filesize

    1.2MB

    MD5

    c5d6b7f4520e35daaaa9f8c1b0c3477c

    SHA1

    da3371df6b0dcdf0fd2ab812e2f62b4b6cfdc187

    SHA256

    4d1725cd717e0d907c2b24185a8993fba90ed98953093fed4954f985f685897f

    SHA512

    b4bb63e9be54f28df02d43aa8adbfb22ea4167eee40833963ae40b497471f8116af2521fcb929d02389177c31e9b3848cb9a4f8cf2faa73375b8d06af5b0c1bc

  • \Users\Admin\AppData\Local\Temp\is-RVPTB.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-RVPTB.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/632-68-0x0000000002CF1000-0x0000000002DFA000-memory.dmp

    Filesize

    1.0MB

  • memory/792-58-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/792-57-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

    Filesize

    8KB

  • memory/792-66-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB

  • memory/792-69-0x0000000000400000-0x000000000041F000-memory.dmp

    Filesize

    124KB