Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
8Static
static
Instalador...ia.exe
windows7-x64
8Instalador...ia.exe
windows10-2004-x64
8Instalador...os.xls
windows7-x64
1Instalador...os.xls
windows10-2004-x64
1Instalador...os.xls
windows7-x64
1Instalador...os.xls
windows10-2004-x64
1Instalador...ia.xml
windows7-x64
1Instalador...ia.xml
windows10-2004-x64
1Instalador...te.xml
windows7-x64
1Instalador...te.xml
windows10-2004-x64
1Instalador...ta.xml
windows7-x64
1Instalador...ta.xml
windows10-2004-x64
1Instalador...do.xml
windows7-x64
1Instalador...do.xml
windows10-2004-x64
1Instalador...do.xml
windows7-x64
1Instalador...do.xml
windows10-2004-x64
1Instalador...or.xml
windows7-x64
1Instalador...or.xml
windows10-2004-x64
1Instalador...as.xml
windows7-x64
1Instalador...as.xml
windows10-2004-x64
1Instalador...as.xml
windows7-x64
1Instalador...as.xml
windows10-2004-x64
1Instalador...ck.xml
windows7-x64
1Instalador...ck.xml
windows10-2004-x64
1Instalador...ja.xml
windows7-x64
1Instalador...ja.xml
windows10-2004-x64
1Instalador...do.xml
windows7-x64
1Instalador...do.xml
windows10-2004-x64
1Instalador...as.xml
windows7-x64
1Instalador...as.xml
windows10-2004-x64
1Instalador...ia.xml
windows7-x64
1Instalador...ia.xml
windows10-2004-x64
1Analysis
-
max time kernel
109s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
28/12/2022, 04:39
Static task
static1
Behavioral task
behavioral1
Sample
Instalador SisFarmacia V4.0/SisFarmacia.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Instalador SisFarmacia V4.0/SisFarmacia.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Instalador SisFarmacia V4.0/Software para Famacias - Archivos Excel/Categoria de Productos.xls
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
Instalador SisFarmacia V4.0/Software para Famacias - Archivos Excel/Categoria de Productos.xls
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
Instalador SisFarmacia V4.0/Software para Famacias - Archivos Excel/Productos.xls
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
Instalador SisFarmacia V4.0/Software para Famacias - Archivos Excel/Productos.xls
Resource
win10v2004-20221111-en
Behavioral task
behavioral7
Sample
Instalador SisFarmacia V4.0/src/Reportes/Categoria.xml
Resource
win7-20221111-en
Behavioral task
behavioral8
Sample
Instalador SisFarmacia V4.0/src/Reportes/Categoria.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral9
Sample
Instalador SisFarmacia V4.0/src/Reportes/Cliente.xml
Resource
win7-20220901-en
Behavioral task
behavioral10
Sample
Instalador SisFarmacia V4.0/src/Reportes/Cliente.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral11
Sample
Instalador SisFarmacia V4.0/src/Reportes/ConsolidadoVenta.xml
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
Instalador SisFarmacia V4.0/src/Reportes/ConsolidadoVenta.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral13
Sample
Instalador SisFarmacia V4.0/src/Reportes/InventarioValorizado.xml
Resource
win7-20220812-en
Behavioral task
behavioral14
Sample
Instalador SisFarmacia V4.0/src/Reportes/InventarioValorizado.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
Instalador SisFarmacia V4.0/src/Reportes/KardexValorizado.xml
Resource
win7-20220812-en
Behavioral task
behavioral16
Sample
Instalador SisFarmacia V4.0/src/Reportes/KardexValorizado.xml
Resource
win10v2004-20220901-en
Behavioral task
behavioral17
Sample
Instalador SisFarmacia V4.0/src/Reportes/Proveedor.xml
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
Instalador SisFarmacia V4.0/src/Reportes/Proveedor.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral19
Sample
Instalador SisFarmacia V4.0/src/Reportes/RComprasPorFechas.xml
Resource
win7-20221111-en
Behavioral task
behavioral20
Sample
Instalador SisFarmacia V4.0/src/Reportes/RComprasPorFechas.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
Instalador SisFarmacia V4.0/src/Reportes/RVentasPorFechas.xml
Resource
win7-20221111-en
Behavioral task
behavioral22
Sample
Instalador SisFarmacia V4.0/src/Reportes/RVentasPorFechas.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteAlertaStock.xml
Resource
win7-20220901-en
Behavioral task
behavioral24
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteAlertaStock.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral25
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteCaja.xml
Resource
win7-20221111-en
Behavioral task
behavioral26
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteCaja.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral27
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteCantidadProductoVendido.xml
Resource
win7-20220812-en
Behavioral task
behavioral28
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteCantidadProductoVendido.xml
Resource
win10v2004-20221111-en
Behavioral task
behavioral29
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteDetalleCompraFechas.xml
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteDetalleCompraFechas.xml
Resource
win10v2004-20220812-en
Behavioral task
behavioral31
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteDetalleVentaDiaria.xml
Resource
win7-20220812-en
Behavioral task
behavioral32
Sample
Instalador SisFarmacia V4.0/src/Reportes/ReporteDetalleVentaDiaria.xml
Resource
win10v2004-20220812-en
General
-
Target
Instalador SisFarmacia V4.0/SisFarmacia.exe
-
Size
26.3MB
-
MD5
d70ef7837cfe5384462b2beefa416a29
-
SHA1
cd3a9add1593afdd2ed010d03293837275a0685f
-
SHA256
db5f11d627bc35e0ae02c83b3aa8bcde104f8b0002213aa4b2ebdfc22dc80b23
-
SHA512
9027c8dd06805b79f1e2dbf0ba83d87c3c01a642c4a92b2bf7f218814ac95b424a19855a20e146af8d2c2280f105edfd1235b27642e4ecdf20048c046a6a6a84
-
SSDEEP
786432:+RVsd+VFvQYHQY1pjPPNsNlEDJ0Z8+hcO2ona7c:YVFY+1pbNi+N2CSaQ
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 276 SisFarmacia.tmp 1812 SisFarmacia.exe -
Loads dropped DLL 2 IoCs
pid Process 2008 SisFarmacia.exe 276 SisFarmacia.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\SisFarmacia\SisFarmacia.exe SisFarmacia.tmp File created C:\Program Files (x86)\SisFarmacia\unins000.dat SisFarmacia.tmp File created C:\Program Files (x86)\SisFarmacia\is-D685C.tmp SisFarmacia.tmp File created C:\Program Files (x86)\SisFarmacia\is-J9VUB.tmp SisFarmacia.tmp File opened for modification C:\Program Files (x86)\SisFarmacia\unins000.dat SisFarmacia.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A736B81-866A-11ED-B243-5AF036119C64} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage\java.com\NumberOfSubdomains = "1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 276 SisFarmacia.tmp 276 SisFarmacia.tmp -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1168 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1168 AUDIODG.EXE Token: 33 1168 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1168 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 276 SisFarmacia.tmp 1776 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1776 iexplore.exe 1776 iexplore.exe 1176 IEXPLORE.EXE 1176 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2008 wrote to memory of 276 2008 SisFarmacia.exe 28 PID 2008 wrote to memory of 276 2008 SisFarmacia.exe 28 PID 2008 wrote to memory of 276 2008 SisFarmacia.exe 28 PID 2008 wrote to memory of 276 2008 SisFarmacia.exe 28 PID 2008 wrote to memory of 276 2008 SisFarmacia.exe 28 PID 2008 wrote to memory of 276 2008 SisFarmacia.exe 28 PID 2008 wrote to memory of 276 2008 SisFarmacia.exe 28 PID 276 wrote to memory of 1812 276 SisFarmacia.tmp 31 PID 276 wrote to memory of 1812 276 SisFarmacia.tmp 31 PID 276 wrote to memory of 1812 276 SisFarmacia.tmp 31 PID 276 wrote to memory of 1812 276 SisFarmacia.tmp 31 PID 1812 wrote to memory of 1776 1812 SisFarmacia.exe 32 PID 1812 wrote to memory of 1776 1812 SisFarmacia.exe 32 PID 1812 wrote to memory of 1776 1812 SisFarmacia.exe 32 PID 1812 wrote to memory of 1776 1812 SisFarmacia.exe 32 PID 1776 wrote to memory of 1176 1776 iexplore.exe 34 PID 1776 wrote to memory of 1176 1776 iexplore.exe 34 PID 1776 wrote to memory of 1176 1776 iexplore.exe 34 PID 1776 wrote to memory of 1176 1776 iexplore.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe"C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\is-136L1.tmp\SisFarmacia.tmp"C:\Users\Admin\AppData\Local\Temp\is-136L1.tmp\SisFarmacia.tmp" /SL5="$101B8,26858922,797184,C:\Users\Admin\AppData\Local\Temp\Instalador SisFarmacia V4.0\SisFarmacia.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Program Files (x86)\SisFarmacia\SisFarmacia.exe"C:\Program Files (x86)\SisFarmacia\SisFarmacia.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1176
-
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1fc1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1168
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
27.5MB
MD5174c35ddcc0e16e09e79c1ca9cec8583
SHA147f9cc5d3b5359c567656dd18a8b2c49f55e3da5
SHA2566bfaefce386126e6c9e3ec781a30106cfd7f74e420cbc91f720d9c2c4a28ad0c
SHA5124d73e5e5b5bee5ca5a6ef3fecc16f87d1dd64e40730772572f4befe4653c7277350c00b0649a9096f5ef877da3bd25d706a326e7d3b9a24defe8fe37be481031
-
Filesize
2.5MB
MD527468e29378f0528abb039cd242b99a9
SHA1b8c088508ff39708c1048b6fc64106339a8c5c52
SHA25614e7028ed14eed990ef349ddcd991fe53c37416307b05e6cdc0c2eebeb8f6734
SHA5121cc62d4c28cacc120c0bfd7ebc80432f6b17f2b0d4d9d51ebb2122e265138f42cd14ddc2992bb9c863cc2207f0c02abb7e2900aee5a4f08b971801078c3fb827
-
Filesize
2.5MB
MD527468e29378f0528abb039cd242b99a9
SHA1b8c088508ff39708c1048b6fc64106339a8c5c52
SHA25614e7028ed14eed990ef349ddcd991fe53c37416307b05e6cdc0c2eebeb8f6734
SHA5121cc62d4c28cacc120c0bfd7ebc80432f6b17f2b0d4d9d51ebb2122e265138f42cd14ddc2992bb9c863cc2207f0c02abb7e2900aee5a4f08b971801078c3fb827
-
Filesize
27.5MB
MD5174c35ddcc0e16e09e79c1ca9cec8583
SHA147f9cc5d3b5359c567656dd18a8b2c49f55e3da5
SHA2566bfaefce386126e6c9e3ec781a30106cfd7f74e420cbc91f720d9c2c4a28ad0c
SHA5124d73e5e5b5bee5ca5a6ef3fecc16f87d1dd64e40730772572f4befe4653c7277350c00b0649a9096f5ef877da3bd25d706a326e7d3b9a24defe8fe37be481031
-
Filesize
2.5MB
MD527468e29378f0528abb039cd242b99a9
SHA1b8c088508ff39708c1048b6fc64106339a8c5c52
SHA25614e7028ed14eed990ef349ddcd991fe53c37416307b05e6cdc0c2eebeb8f6734
SHA5121cc62d4c28cacc120c0bfd7ebc80432f6b17f2b0d4d9d51ebb2122e265138f42cd14ddc2992bb9c863cc2207f0c02abb7e2900aee5a4f08b971801078c3fb827