Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
31/12/2022, 08:25
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20221111-en
General
-
Target
setup.exe
-
Size
2.8MB
-
MD5
c84216035b6549a2826636ae6336e1cc
-
SHA1
cb667626f7a95ea9542ccc1dd882bf7752afbcc5
-
SHA256
a9574deb0745080e5ca3d3845f62c0053a04f9deb75ac7899f9528ac4c1f9fca
-
SHA512
b4f55ce201533eca0d4910b4983d19cf06e09af5ab0b9e59e93fa13fa1c8f8e25bad04ce6ee13670406dfa5ee3055fc65fd8422292336f892e3e0539367834ae
-
SSDEEP
49152:R8yvPzboKxeBZHq9K5+eWyMMe7j9W3c/sJCLsx0kOwourZZyfwMk9pqw1ZZGZ2BT:6OPzblcqxVbMeQcECAx/SknyoMgN1Z8w
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 696 setup.tmp 956 unins000.exe 1700 _iu14D2N.tmp -
Loads dropped DLL 11 IoCs
pid Process 1504 setup.exe 696 setup.tmp 696 setup.tmp 696 setup.tmp 696 setup.tmp 696 setup.tmp 696 setup.tmp 696 setup.tmp 956 unins000.exe 1700 _iu14D2N.tmp 1700 _iu14D2N.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 696 setup.tmp 696 setup.tmp -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 696 setup.tmp 696 setup.tmp 1700 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1504 wrote to memory of 696 1504 setup.exe 26 PID 1504 wrote to memory of 696 1504 setup.exe 26 PID 1504 wrote to memory of 696 1504 setup.exe 26 PID 1504 wrote to memory of 696 1504 setup.exe 26 PID 1504 wrote to memory of 696 1504 setup.exe 26 PID 1504 wrote to memory of 696 1504 setup.exe 26 PID 1504 wrote to memory of 696 1504 setup.exe 26 PID 696 wrote to memory of 956 696 setup.tmp 27 PID 696 wrote to memory of 956 696 setup.tmp 27 PID 696 wrote to memory of 956 696 setup.tmp 27 PID 696 wrote to memory of 956 696 setup.tmp 27 PID 696 wrote to memory of 956 696 setup.tmp 27 PID 696 wrote to memory of 956 696 setup.tmp 27 PID 696 wrote to memory of 956 696 setup.tmp 27 PID 956 wrote to memory of 1700 956 unins000.exe 28 PID 956 wrote to memory of 1700 956 unins000.exe 28 PID 956 wrote to memory of 1700 956 unins000.exe 28 PID 956 wrote to memory of 1700 956 unins000.exe 28 PID 956 wrote to memory of 1700 956 unins000.exe 28 PID 956 wrote to memory of 1700 956 unins000.exe 28 PID 956 wrote to memory of 1700 956 unins000.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\is-KRC89.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-KRC89.tmp\setup.tmp" /SL5="$60120,2213935,327680,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Games\Plague Inc Evolved\unins000.exe"C:\Games\Plague Inc Evolved\unins000.exe" /VERYSILENT /NODELSAVE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\Plague Inc Evolved\unins000.exe" /FIRSTPHASEWND=$201C8 /VERYSILENT /NODELSAVE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1700
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5f73d3d5cca6ceb6638147cc1c497a4ba
SHA17ba84efc0bb4d34bfbc0c3bb84c13197ab0e5bcd
SHA25653591abe3f04f6e2d1659d75dc2bcf4b9bbb6178b2e01d94d98a6625de078f6e
SHA512fa2b0fd922eadf0308e9a7b691220780ce3bb0d54cd1493f1d2e34cc60dfa29650c44335204ec7142c3f00835b8de422a1de6dce48c4fe7f71f1b0151966e8af
-
Filesize
1.3MB
MD53dfe6759668018babfac31fd4d1b297a
SHA17c29a0902ba46f670c60538413d5647da45749d9
SHA256fa9d3686af6946cf8ee187e082a8801f32cc7ce4050f7847c8095d272aefed95
SHA512ee7af710415ed124390cb64227afd42d0c63faa4b9c6762359798742b2c0bfdf0c2e1ad115ef21a2d7f9a54f67ae4de6097a9abd4523eaec290ffa8f46dbc020
-
Filesize
1.3MB
MD53dfe6759668018babfac31fd4d1b297a
SHA17c29a0902ba46f670c60538413d5647da45749d9
SHA256fa9d3686af6946cf8ee187e082a8801f32cc7ce4050f7847c8095d272aefed95
SHA512ee7af710415ed124390cb64227afd42d0c63faa4b9c6762359798742b2c0bfdf0c2e1ad115ef21a2d7f9a54f67ae4de6097a9abd4523eaec290ffa8f46dbc020
-
Filesize
1.3MB
MD53dfe6759668018babfac31fd4d1b297a
SHA17c29a0902ba46f670c60538413d5647da45749d9
SHA256fa9d3686af6946cf8ee187e082a8801f32cc7ce4050f7847c8095d272aefed95
SHA512ee7af710415ed124390cb64227afd42d0c63faa4b9c6762359798742b2c0bfdf0c2e1ad115ef21a2d7f9a54f67ae4de6097a9abd4523eaec290ffa8f46dbc020
-
Filesize
1.3MB
MD53dfe6759668018babfac31fd4d1b297a
SHA17c29a0902ba46f670c60538413d5647da45749d9
SHA256fa9d3686af6946cf8ee187e082a8801f32cc7ce4050f7847c8095d272aefed95
SHA512ee7af710415ed124390cb64227afd42d0c63faa4b9c6762359798742b2c0bfdf0c2e1ad115ef21a2d7f9a54f67ae4de6097a9abd4523eaec290ffa8f46dbc020
-
Filesize
1.3MB
MD54df45c25b3dbd0f13af0c6158588c833
SHA1ec8fee7ce313550ffcd95248add799f5cee69fcf
SHA2563e8888a1cb3ef9ac97c25950d3a763989ca7758c0d19cdd9ce38028fc6b5210f
SHA5128fb40fafe901ba65905674bdb307b11cdc109c0fad26281d9368cf68e5ded32076afefb22e73a4ec52824424abfc8080c3cb6621b0aa9066906fbb10c526e190
-
Filesize
1.3MB
MD54df45c25b3dbd0f13af0c6158588c833
SHA1ec8fee7ce313550ffcd95248add799f5cee69fcf
SHA2563e8888a1cb3ef9ac97c25950d3a763989ca7758c0d19cdd9ce38028fc6b5210f
SHA5128fb40fafe901ba65905674bdb307b11cdc109c0fad26281d9368cf68e5ded32076afefb22e73a4ec52824424abfc8080c3cb6621b0aa9066906fbb10c526e190
-
Filesize
1.3MB
MD53dfe6759668018babfac31fd4d1b297a
SHA17c29a0902ba46f670c60538413d5647da45749d9
SHA256fa9d3686af6946cf8ee187e082a8801f32cc7ce4050f7847c8095d272aefed95
SHA512ee7af710415ed124390cb64227afd42d0c63faa4b9c6762359798742b2c0bfdf0c2e1ad115ef21a2d7f9a54f67ae4de6097a9abd4523eaec290ffa8f46dbc020
-
Filesize
1.3MB
MD53dfe6759668018babfac31fd4d1b297a
SHA17c29a0902ba46f670c60538413d5647da45749d9
SHA256fa9d3686af6946cf8ee187e082a8801f32cc7ce4050f7847c8095d272aefed95
SHA512ee7af710415ed124390cb64227afd42d0c63faa4b9c6762359798742b2c0bfdf0c2e1ad115ef21a2d7f9a54f67ae4de6097a9abd4523eaec290ffa8f46dbc020
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.3MB
MD54df45c25b3dbd0f13af0c6158588c833
SHA1ec8fee7ce313550ffcd95248add799f5cee69fcf
SHA2563e8888a1cb3ef9ac97c25950d3a763989ca7758c0d19cdd9ce38028fc6b5210f
SHA5128fb40fafe901ba65905674bdb307b11cdc109c0fad26281d9368cf68e5ded32076afefb22e73a4ec52824424abfc8080c3cb6621b0aa9066906fbb10c526e190