Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2023, 01:36
Static task
static1
Behavioral task
behavioral1
Sample
Setup soothe2 v1.1.2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
Setup soothe2 v1.1.2.exe
Resource
win10v2004-20221111-en
General
-
Target
Setup soothe2 v1.1.2.exe
-
Size
29.3MB
-
MD5
0158a14c23a8da850a6ee55097662354
-
SHA1
42a81c184384b1570e3fa38f47366ffe64e418a5
-
SHA256
d5b6c825e2febc952ac4cc7e9a5977398a545bcc067fa5e9f490b461efb23d37
-
SHA512
c7e7252ebf2071c5c6052600939319e88a304a81b3f5102d4aa120913f5252f46e86861287c563a515eb4c926a3a13b216fb758985639a77bc35f255917b600b
-
SSDEEP
786432:qBPNt1Vn5rkfUg2K39kqiCXg8aJmd2V+fJk4pNs:MPvb5L4CJmd2QfJ3pO
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4728 Setup soothe2 v1.1.2.tmp -
Loads dropped DLL 5 IoCs
pid Process 4728 Setup soothe2 v1.1.2.tmp 4728 Setup soothe2 v1.1.2.tmp 4728 Setup soothe2 v1.1.2.tmp 4728 Setup soothe2 v1.1.2.tmp 4728 Setup soothe2 v1.1.2.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4728 Setup soothe2 v1.1.2.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4760 wrote to memory of 4728 4760 Setup soothe2 v1.1.2.exe 80 PID 4760 wrote to memory of 4728 4760 Setup soothe2 v1.1.2.exe 80 PID 4760 wrote to memory of 4728 4760 Setup soothe2 v1.1.2.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup soothe2 v1.1.2.exe"C:\Users\Admin\AppData\Local\Temp\Setup soothe2 v1.1.2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\is-G6MQJ.tmp\Setup soothe2 v1.1.2.tmp"C:\Users\Admin\AppData\Local\Temp\is-G6MQJ.tmp\Setup soothe2 v1.1.2.tmp" /SL5="$A01C8,30179246,121344,C:\Users\Admin\AppData\Local\Temp\Setup soothe2 v1.1.2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4728
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
357KB
MD5f30afccd6fafc1cad4567ada824c9358
SHA160a65b72f208563f90fba0da6af013a36707caa9
SHA256e28d16fad16bca8198c47d7dd44acfd362dd6ba1654f700add8aaf2c0732622d
SHA51259b199085ed4b59ef2b385a09d0901ff2efde7b344db1e900684a425fc2df8e2010ca73d2f2bffa547040cb1dd4c8938b175c463ccc5e39a840a19f9aa301a6c
-
Filesize
4KB
MD50f8bbab51c5f70093b7ed7dd825d68e8
SHA1a96809560b3e9001124083937a339cf2453a94c8
SHA2567fc4fa7f5cea34df0a6733527081886cfb1c49b369df2db454de87cc4e70bdb5
SHA5127b824ad5d7ec786535106d98bc80c9350f35ac2b76d7ee20163e90becf076dfeaca4732c0ecbe2d3d84a2efef337c380d5548ca0123e69e66e30bb396f0b9b81
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
813KB
MD55f87caf3f7cf63dde8e6af53bdf31289
SHA1a2c3cc3d9d831acd797155b667db59a32000d7a8
SHA2564731982b02b067d3f5a5a7518279a9265a49fb0f7b3f8dc3d61b82a5359d4940
SHA5124875298d82037ef1fff1ee3c58a9059d8480274326c862729fcc56664ecb49e2692c3838948c66dc8336e4050469d831cbf1fbd79b66565ab673d2a67765109d
-
Filesize
1.1MB
MD590fc739c83cd19766acb562c66a7d0e2
SHA1451f385a53d5fed15e7649e7891e05f231ef549a
SHA256821bd11693bf4b4b2b9f3c196036e1f4902abd95fb26873ea6c43e123b8c9431
SHA5124cb11ad48b7585ef1b70fac9e3c25610b2f64a16358cd51e32adcb0b17a6ab1c934aeb10adaa8e9ddf69b2e2f1d18fe2e87b49b39f89b05ea13aa3205e41296c