Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
61s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2022, 05:38
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
langs/Hungarian.ps1
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
langs/Hungarian.ps1
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
langs/Korean.ps1
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
langs/Korean.ps1
Resource
win10v2004-20220812-en
General
-
Target
Setup.exe
-
Size
457.1MB
-
MD5
aa035b5cc5302df7dd4daeef996eda50
-
SHA1
d2eb27fd73dd479d2a64930578229b7b4096a9f5
-
SHA256
543d20b501a808f51aaa083158c196f07de2f0ab56e34aebbe0858bdb65abcff
-
SHA512
0b94ad6536229417b31968b4201877c3d38005cf0478afeaeed0575d021e36fb7cff633152395daef0df1f2f81cffc2e77b19a3605526d96dc1c30c7cf307d65
-
SSDEEP
12288:fIipf19UlmFI5ojbOh4EV8QdxSvx3uE8L7y/npsASJBQCHj8Gqq3DEd/E/JycH7S:V9UgzjlOUXi2sDdjiBajNAlV0AN
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3920 set thread context of 2708 3920 Setup.exe 80 -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80 PID 3920 wrote to memory of 2708 3920 Setup.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵PID:2708
-