Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
04/01/2023, 22:33
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20220812-en
General
-
Target
setup.exe
-
Size
2.3MB
-
MD5
15371ee5004d95fd93cfa59c6bbcb9de
-
SHA1
d830988927ec98b22f93a92dd8031e6f77fde17b
-
SHA256
a6ceaffd88e280240ba97054c44492185752b767e9c3b4b50b823aa16da16587
-
SHA512
40c89134e0ef5a9c8db14df03b723f78fd3d4d88af22304eb7a4073b9032e935b41c05bc063d0a99980898b7e90c8c3cca7adf198dc0c31856ba16317f101eda
-
SSDEEP
49152:955zOqRgFMJS4p2JcW57/QF4gIsY3SOk19WCf/a43ZMHacd:/ZR9YKUzQSgtYw9WC3VyHrd
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1116 setup.tmp 540 unins000.exe 320 _iu14D2N.tmp -
Loads dropped DLL 11 IoCs
pid Process 1484 setup.exe 1116 setup.tmp 1116 setup.tmp 1116 setup.tmp 1116 setup.tmp 1116 setup.tmp 1116 setup.tmp 1116 setup.tmp 540 unins000.exe 320 _iu14D2N.tmp 320 _iu14D2N.tmp -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1116 setup.tmp 1116 setup.tmp -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 1116 setup.tmp 1116 setup.tmp 320 _iu14D2N.tmp -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1484 wrote to memory of 1116 1484 setup.exe 27 PID 1484 wrote to memory of 1116 1484 setup.exe 27 PID 1484 wrote to memory of 1116 1484 setup.exe 27 PID 1484 wrote to memory of 1116 1484 setup.exe 27 PID 1484 wrote to memory of 1116 1484 setup.exe 27 PID 1484 wrote to memory of 1116 1484 setup.exe 27 PID 1484 wrote to memory of 1116 1484 setup.exe 27 PID 1116 wrote to memory of 540 1116 setup.tmp 28 PID 1116 wrote to memory of 540 1116 setup.tmp 28 PID 1116 wrote to memory of 540 1116 setup.tmp 28 PID 1116 wrote to memory of 540 1116 setup.tmp 28 PID 1116 wrote to memory of 540 1116 setup.tmp 28 PID 1116 wrote to memory of 540 1116 setup.tmp 28 PID 1116 wrote to memory of 540 1116 setup.tmp 28 PID 540 wrote to memory of 320 540 unins000.exe 29 PID 540 wrote to memory of 320 540 unins000.exe 29 PID 540 wrote to memory of 320 540 unins000.exe 29 PID 540 wrote to memory of 320 540 unins000.exe 29 PID 540 wrote to memory of 320 540 unins000.exe 29 PID 540 wrote to memory of 320 540 unins000.exe 29 PID 540 wrote to memory of 320 540 unins000.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\is-MUBNP.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-MUBNP.tmp\setup.tmp" /SL5="$A0122,1823362,310784,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Games\Payday 2\unins000.exe"C:\Games\Payday 2\unins000.exe" /VERYSILENT /NODELSAVE3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Games\Payday 2\unins000.exe" /FIRSTPHASEWND=$201CE /VERYSILENT /NODELSAVE4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:320
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
191KB
MD554001a41061d55c805f0db99728a92ee
SHA186590c146af0e4f6fb555080c10cf79b504bb2a1
SHA2563b1e0482360e7fb8391c08720b6a4a402ca1acc4f43680c233c08eadb20eeec0
SHA5129e03107d40bb453fd996eae812a871a10a86ae3b67a64356d40d3c0b6a76726999b4023ee676f4b0be01729255f706592cc99da57e697caf8ef5d944f75492fd
-
Filesize
25KB
MD5da5341a6985defa3c1efb257502f11ce
SHA1bf1c39e5d1fd61fb504ccd2dd2ee333953aa58d0
SHA25641411067350be8c7d183bd104eb3c155c226399731b26be28c74d54f9c17d8ca
SHA512f7166dc00d6f450249b7fb684e58fe882c9c78d887c37c1ed703ce9f32e246a7dfd00ff224d6caf1582136aa10964852d5c10423b5dd43451dfd5d2e5cfa6b7b
-
Filesize
1.3MB
MD567d70773580539df630bab618ad9ec6a
SHA13954e12a0140f93c60a8cd29cfce018ed9f726ee
SHA256b272c89f8e58a6608259c8db283782578bfbe6c4f24745ed20676fd65b041f24
SHA51216f60e80b960f62b4b24376b4c4be78b4566cd60a450eb0fabc4758a9f718b2df5f745cd9390e399d676f6d5d446e681ad2ecb6c7693454bf67e99da6a71e627
-
Filesize
1.3MB
MD567d70773580539df630bab618ad9ec6a
SHA13954e12a0140f93c60a8cd29cfce018ed9f726ee
SHA256b272c89f8e58a6608259c8db283782578bfbe6c4f24745ed20676fd65b041f24
SHA51216f60e80b960f62b4b24376b4c4be78b4566cd60a450eb0fabc4758a9f718b2df5f745cd9390e399d676f6d5d446e681ad2ecb6c7693454bf67e99da6a71e627
-
Filesize
1.3MB
MD567d70773580539df630bab618ad9ec6a
SHA13954e12a0140f93c60a8cd29cfce018ed9f726ee
SHA256b272c89f8e58a6608259c8db283782578bfbe6c4f24745ed20676fd65b041f24
SHA51216f60e80b960f62b4b24376b4c4be78b4566cd60a450eb0fabc4758a9f718b2df5f745cd9390e399d676f6d5d446e681ad2ecb6c7693454bf67e99da6a71e627
-
Filesize
1.3MB
MD567d70773580539df630bab618ad9ec6a
SHA13954e12a0140f93c60a8cd29cfce018ed9f726ee
SHA256b272c89f8e58a6608259c8db283782578bfbe6c4f24745ed20676fd65b041f24
SHA51216f60e80b960f62b4b24376b4c4be78b4566cd60a450eb0fabc4758a9f718b2df5f745cd9390e399d676f6d5d446e681ad2ecb6c7693454bf67e99da6a71e627
-
Filesize
1.3MB
MD52402dc6657c4a50f0fb2a4987bda91ac
SHA12cbfd09d0cb8dc9822a415775e85e182f43ee96a
SHA25611b6a1721fc4e38504515ad938ab7be67879ae11686e50f0c12dcda4ac230414
SHA51264e45f9f1470275232ae33f85b4942363c32172f1ed6d946e3605a02b31d4e4dfb24e36dd3113f500f72c3e067da1212500b562e8db2a9f80fde6694f9bcd65b
-
Filesize
1.3MB
MD52402dc6657c4a50f0fb2a4987bda91ac
SHA12cbfd09d0cb8dc9822a415775e85e182f43ee96a
SHA25611b6a1721fc4e38504515ad938ab7be67879ae11686e50f0c12dcda4ac230414
SHA51264e45f9f1470275232ae33f85b4942363c32172f1ed6d946e3605a02b31d4e4dfb24e36dd3113f500f72c3e067da1212500b562e8db2a9f80fde6694f9bcd65b
-
Filesize
1.3MB
MD567d70773580539df630bab618ad9ec6a
SHA13954e12a0140f93c60a8cd29cfce018ed9f726ee
SHA256b272c89f8e58a6608259c8db283782578bfbe6c4f24745ed20676fd65b041f24
SHA51216f60e80b960f62b4b24376b4c4be78b4566cd60a450eb0fabc4758a9f718b2df5f745cd9390e399d676f6d5d446e681ad2ecb6c7693454bf67e99da6a71e627
-
Filesize
1.3MB
MD567d70773580539df630bab618ad9ec6a
SHA13954e12a0140f93c60a8cd29cfce018ed9f726ee
SHA256b272c89f8e58a6608259c8db283782578bfbe6c4f24745ed20676fd65b041f24
SHA51216f60e80b960f62b4b24376b4c4be78b4566cd60a450eb0fabc4758a9f718b2df5f745cd9390e399d676f6d5d446e681ad2ecb6c7693454bf67e99da6a71e627
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
1.3MB
MD52402dc6657c4a50f0fb2a4987bda91ac
SHA12cbfd09d0cb8dc9822a415775e85e182f43ee96a
SHA25611b6a1721fc4e38504515ad938ab7be67879ae11686e50f0c12dcda4ac230414
SHA51264e45f9f1470275232ae33f85b4942363c32172f1ed6d946e3605a02b31d4e4dfb24e36dd3113f500f72c3e067da1212500b562e8db2a9f80fde6694f9bcd65b
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3