Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
90s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/12/2022, 20:29
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20220901-en
General
-
Target
setup.exe
-
Size
2.3MB
-
MD5
f2fe4128181bbdde2073e805b1aa29cd
-
SHA1
08b285fcbad873a5bc027784dbf2b3118cb1e91c
-
SHA256
3856ea7cc88b635d2aec8040bf7f3c3e502c54bb6bb802938046192edaf01aae
-
SHA512
92558a64af0e094ca3a5420d8da4301ee79c3c6b2954517ef10108310a57bf54274911cb39e04e809824fb686f37a777c3e10769f1e8e5662bc094343301b1af
-
SSDEEP
49152:4J14zJ+k1be7lcDhPW3RlWVUKhuNrOhEMhGuA27mh5mq9kq:e4zs8XNiRlWVdhuNrOhBhV7Emq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4920 setup.tmp -
Loads dropped DLL 6 IoCs
pid Process 4920 setup.tmp 4920 setup.tmp 4920 setup.tmp 4920 setup.tmp 4920 setup.tmp 4920 setup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4920 setup.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4964 wrote to memory of 4920 4964 setup.exe 80 PID 4964 wrote to memory of 4920 4964 setup.exe 80 PID 4964 wrote to memory of 4920 4964 setup.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\is-MIQ11.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-MIQ11.tmp\setup.tmp" /SL5="$90046,1676905,369152,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:4920
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
1.4MB
MD59b9a3568622d0837854a554e3c6cfbe4
SHA1724dcae274f7b4948b568d700e6de86d8f2efdf7
SHA256aae2d106363d3c9f8c54b3aa8a9708215068ff8800ba3a9701dc18cfec13042e
SHA512567a9e45744c0fbce988ffe1219370a9ffe78b054266a6e755cfcc2f8ce348a3f35b12cedfdd33ad447a7fd277ab49b088567069f63958c31696951b1ca3ba3d
-
Filesize
1.4MB
MD59b9a3568622d0837854a554e3c6cfbe4
SHA1724dcae274f7b4948b568d700e6de86d8f2efdf7
SHA256aae2d106363d3c9f8c54b3aa8a9708215068ff8800ba3a9701dc18cfec13042e
SHA512567a9e45744c0fbce988ffe1219370a9ffe78b054266a6e755cfcc2f8ce348a3f35b12cedfdd33ad447a7fd277ab49b088567069f63958c31696951b1ca3ba3d