Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
62s -
max time network
63s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
13/02/2023, 00:01
General
-
Target
PPSSPPSetup.exe
-
Size
18.6MB
-
MD5
9140856104249d5b1b054fa5bb096fb4
-
SHA1
3c07f9f1a9598b5cb3213b37d855b6d16a03a329
-
SHA256
2fef2279bc8ca2b93f2278bd79b3ab912b1d2d2a7a8225e2545f3c2840440cd4
-
SHA512
3611c577480bb551177d4893ec383facb7789a910e7ebf251cc9632654f64e83e8eb0e1bba3b00d4547ab1298770f93a393255a64cc7f81915df19328bae4a39
-
SSDEEP
393216:k92F8bqtLeyagFCUEUwLMkUyXtrq8abS/q9+JFqgRc4jOZrLEeGx44X4iH2HXMo:kwSELePgFCUEUwLMgXlSFIrRc/ZuL4is
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops desktop.ini file(s) 1 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 4 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PPSSPPSetup.exe"C:\Users\Admin\AppData\Local\Temp\PPSSPPSetup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8JBEA.tmp\PPSSPPSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-8JBEA.tmp\PPSSPPSetup.tmp" /SL5="$70080,18995901,121344,C:\Users\Admin\AppData\Local\Temp\PPSSPPSetup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files\PPSSPP\README.txt3⤵
-
-
C:\Program Files\PPSSPP\PPSSPPWindows64.exe"C:\Program Files\PPSSPP\PPSSPPWindows64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\PPSSPP\PPSSPPWindows64.exe"C:\Program Files\PPSSPP\PPSSPPWindows64.exe" --vulkan-available-check4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\bcastdvr.exe"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer1⤵
- Drops desktop.ini file(s)
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1e01⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 00000000000701FE /startuptips1⤵
- Checks SCSI registry key(s)
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14.6MB
MD5ea83b2c4be2f60d93a6e2ec4f4b31395
SHA18f64f9b27249bfbf888a73edbc2abc5289313e28
SHA25614fc01dd148cff343b42e96ff5a931cac12687545ff8e6cce112cf2adab805cb
SHA512fc7e797cb6cd2e24a4cb18c4b7835bc8635e11a7ac7256ac3ec4dcc5047018ff3c46eb19068706d280c540ca87203b28edd3ec7164d171f1496095062b19c0a7
-
Filesize
14.6MB
MD5ea83b2c4be2f60d93a6e2ec4f4b31395
SHA18f64f9b27249bfbf888a73edbc2abc5289313e28
SHA25614fc01dd148cff343b42e96ff5a931cac12687545ff8e6cce112cf2adab805cb
SHA512fc7e797cb6cd2e24a4cb18c4b7835bc8635e11a7ac7256ac3ec4dcc5047018ff3c46eb19068706d280c540ca87203b28edd3ec7164d171f1496095062b19c0a7
-
Filesize
14.6MB
MD5ea83b2c4be2f60d93a6e2ec4f4b31395
SHA18f64f9b27249bfbf888a73edbc2abc5289313e28
SHA25614fc01dd148cff343b42e96ff5a931cac12687545ff8e6cce112cf2adab805cb
SHA512fc7e797cb6cd2e24a4cb18c4b7835bc8635e11a7ac7256ac3ec4dcc5047018ff3c46eb19068706d280c540ca87203b28edd3ec7164d171f1496095062b19c0a7
-
Filesize
35KB
MD5b048470f9e6f4ee448aeecb01c38fc4f
SHA183eddf71029b28b7c052597de4f9254e09eb3bac
SHA25645c434d4ef4b4e52c09f9224a3daae60175cee687acca4b9b8d787939a083d3d
SHA512fe0f5eae0d1fdbfc1e715d56ecb3f8e7486709aca0edd27bd66be18680f292f3ed87cfc43fb05588a4b81342e1e514c3e2bf1952f6da434f4a37185a7473218e
-
Filesize
6KB
MD5a062688b08c70a42ff2a0acff6c46d93
SHA108325554623568bb9babadc10213bfc0b1151766
SHA25692ab3d61d17e6fa2111a80bd75d89cc241f2a85461d0f3e58198f84adcf35c9c
SHA512c23420967e83fbea19579d45b9840ecc4ab312442843cce6fc71c94774ee103bfc8bc332de62f738035c3b3cd4db666044eac059297bfb633db50f3ff766e49a
-
Filesize
81KB
MD5ad0542e2956a8dddf52357f28a8a7d9c
SHA19d6c9874c1d6a0c57a1345f211154fe1e494b55a
SHA2561020b3cc03eced719dceec715b547f849b5594c4b7085143eab50ed3e3d87afc
SHA512c0e5ad7442d78e5aba5cbdb2aa6cda372c5c50796cc8ce89a6c48414ad71ae3d0de3f60a3966bb9dc59d2619c277a5bb08a10159a43711a6cb642cb75be09d3f
-
Filesize
47KB
MD577997ec1e9921985b18cd6cf11140b9b
SHA198216abb005beef246654fa073cc20cb9ede3473
SHA256db4f865430a61d1f6f21ad4500577973d3af4c44b602580f9eca6c40991067cb
SHA51228882f4af9006310e4f179af018fe76ac699ec0d7820993b2ecb37d926916a0448d3ea23fc304079f576d07e04ce5e6e4efd4e3b942730bbf938c7a330d4935a
-
Filesize
1KB
MD5a040cb201f082896ebe0a3af8f654aa7
SHA1b8bb3c5a6e71173325317acbcb36de276a402312
SHA2565a665794365419ae2ac39375ffb951a8551bce63d16f21a76e1d078cdb4eacbc
SHA51268e2e2bf22e6b96bd94c246aef72f3c3499275312aff4661ffdcd4959c25ea46c54cf89b7e4f8b486f5da13fd54c8173101ed8a3e3fa9ced7e996b0706fd071e
-
Filesize
31KB
MD5c873ac1ea00c42828e03d9898a3b41ef
SHA14fff7da19d8810d8fc8f97eb769bdfd15563658a
SHA2568e6550b975a34511788dbeaacae47c9be6c89c967052c12342c6cc32f5650e4c
SHA512c86c50b13cd2f5a961c3361f4b183930c62ee1e08ca00921c1aeebb306c69d2dd33a4952df3a8f46287869d55e387b42d2d3274d82d3e215ab06b3d3fb9d6258
-
Filesize
44KB
MD5c3bc568204bdecc72ef7120cc56d01b8
SHA156b05f7483e44889a1703fbb2d7318484e6d732f
SHA256c2fdb1d1e6e677883f13eb866a1d83b8f67cc94f00aec21163612f61afefb693
SHA512d3b323a3bf4ab325d230f07e54c84bf85f9739ba03310327ae3d8917034b7a356448d789d8f59200c2e1e7550cfdbe729220703a9f0bb9bdf4e702d8c9083c84
-
Filesize
27KB
MD58f8a25fe78b52bd404c28dd06dc1aa23
SHA10bd3eabc432b6119507e4fc43354113b68bdbf66
SHA2566d108dcae03c5a4ea04136b972c7c202b8b5013f4771791f0cb7348db0051dc1
SHA51267dd6add09bd2febc19730f0b86128d6c2ea2b95b96dc18934844a0355cda4dbf5837e0a203b8775a25139bd19543445a824be5c10b8e42758d84e1efa7e380a
-
Filesize
33KB
MD591d7befe927f45c5aaa6df0b3b754a5c
SHA1d63735758f437788638edfc6cc2ce29afcf02cc5
SHA2565d3c60e5fd12658ffc562f14331b7d0c962b818bee4a38aa9c928d2f08fb4f6b
SHA5121c7b4fa8f48ce6230d3465736e94ab39409f20f2d35b04e7f8637e4fdafbd003e34d85a945c06fc976d1dc28a9778de3f89456f6274ded2fd9890de8a8a79591
-
Filesize
37KB
MD566b4e28e92ebc1b16305c1898caa69da
SHA17932cd34fce034aaae6867b41c84978d2d1504ab
SHA256f56b389dde4da2ad6f65f3ac136c3d9c1a681aa76c3ca531e984410b261b4810
SHA512d871a003564ed48189b7377debd3eec6aa2355d91af6d729c227fe9dac38baf8ca354fe4ef85f99283bc7b645bc7dcfb113f8fcca47ed96de1ab189231f296a3
-
Filesize
749B
MD526da1fc3c9874bf2385924776cb7d048
SHA114abdf2670a3227ee456a2e892125f79fc549c9d
SHA256b8ae8848494033ee1e59bb5e044ea4c81f36c46e9c8808d5a8f0266584125113
SHA5125609ac405b14c33bdb1bcbbccd3134bd8753e8cc428167ed6813332d5f55a7e4ffd58c7c713d08e0e568ee7cc378ab5f968b3f8f9e72834f80e71069156b7f90
-
Filesize
1KB
MD5a0dd792a448683b3c8627170e29e517b
SHA17156aeee01a803a372f9df8ebc99c73c46c723d8
SHA25638b30f59395cf35d9be7d9a26b536a4cf24290f9c084c1856120321511477a19
SHA5126ea4a122a537db8f45d086e3c8ca485845a7dc5ead9d78c817028b4fe34df8d2840edfe418b354597723966ef42240fad7214641b26aa60c41fbf331c532203c
-
Filesize
63KB
MD5a60163c46c2fb35420c044f142927007
SHA133a0a5919f14a259bcfe86730d27b44e2893636c
SHA256da9d9c35bb786eaf0bd71d1e31266eda4ba5d28a627fb47137e7bfe64fb6d15c
SHA51258e01c5c79b93a3d5441243bea56aa701e8436bd3b219165698abaca334a5e44a328ffa9564970d70f61053bb05c582a3ecfd86f3cb538a0f5281129aa91345c
-
Filesize
4.0MB
MD5b0ae3aa9dd1ebd60bdf51cb94834cd04
SHA1ee2f5726ac140fb42d17aba033d678afaf8c39c1
SHA256e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
SHA512756ebf4fa49029d4343d1bdb86ea71b2d49e20ada6370fd7582515455635c73d37ad0dbdeef456a10ab353a12412ba827ca4d70080743c86c3b42fa0a3152aa3
-
Filesize
149B
MD5db96d786bf4def028c7abdf5248b0845
SHA18e697e4c4cfd68323112904b0dab4bb85546e060
SHA2562a0937e6b494bfe812b3f49209dacfd83a3e38b39e561fd5a65706dd5a3bf4c4
SHA512a4ddc17b387c639d3d7e16ecb33a9d02616d4ed745ddfa2dc86bbc9831c9d36e8ce16ebf90d02f580db9df5fef09cc1cdabf25ae6403127c90fed1f84782e34a
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
1.1MB
MD534acc2bdb45a9c436181426828c4cb49
SHA15adaa1ac822e6128b8d4b59a54d19901880452ae
SHA2569c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07
SHA512134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb
-
Filesize
190B
MD5b0d27eaec71f1cd73b015f5ceeb15f9d
SHA162264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA25686d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
SHA5127b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
-
Filesize
4.0MB
MD5b0ae3aa9dd1ebd60bdf51cb94834cd04
SHA1ee2f5726ac140fb42d17aba033d678afaf8c39c1
SHA256e994847e01a6f1e4cbdc5a864616ac262f67ee4f14db194984661a8d927ab7f4
SHA512756ebf4fa49029d4343d1bdb86ea71b2d49e20ada6370fd7582515455635c73d37ad0dbdeef456a10ab353a12412ba827ca4d70080743c86c3b42fa0a3152aa3
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
160KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB