Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    85s
  • max time network
    113s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    14/02/2023, 00:04

General

  • Target

    avast_setup_offline.exe

  • Size

    698.1MB

  • MD5

    9a20a05ff03f91145e826b0a778422d2

  • SHA1

    8bbc9f4ff8a4e04afe41edb7287a9b2470864a42

  • SHA256

    08e7454e5ed4466e82e148134e179c3aaa1062ffb3448c1d7240dfa5c36c2371

  • SHA512

    8099169e868053f225742dbf855eafe76f0f81daf09726f166b561f79e01526f5438708dfac27c4168c3d3650869ffc260734ba90f6d2b5b11713f8274761b91

  • SSDEEP

    12582912:fZYcu+AIJEfIub4XU723Ko1cqB6rSfuzpk0gF+s9PkZnNmTxh4XpV:fucZA1HbF723Ko1vjuzT2n6Ab4r

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Checks for any installed AV software in registry 1 TTPs 28 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies registry class 2 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\avast_setup_offline.exe
    "C:\Users\Admin\AppData\Local\Temp\avast_setup_offline.exe"
    1⤵
    • Loads dropped DLL
    • Checks for any installed AV software in registry
    • Writes to the Master Boot Record (MBR)
    • Checks processor information in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:964
    • C:\Windows\Temp\asw.a1093ddffd466cf5\instup.exe
      "C:\Windows\Temp\asw.a1093ddffd466cf5\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.a1093ddffd466cf5 /edition:12 /prod:ais /guid:1e0b5d2d-4fc4-459a-838c-ebb803b7bdc2 /ga_clientid:f0ffc0b5-a858-4e73-9be0-989f69de690b
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks for any installed AV software in registry
      • Writes to the Master Boot Record (MBR)
      • Checks processor information in registry
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1708

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Avast Software\Persistent Data\Avast\Logs\Setup.log

    Filesize

    1KB

    MD5

    4d0825d0f67eaa2071bd92c73d467bd6

    SHA1

    ff3175dbfe261bc6668998126a946afc7c1823c1

    SHA256

    c1454362141450d3dc7b1320e0865ec4004fda0479a9453a900e4449d4cf74b4

    SHA512

    86d21c88fcef3f7c7187fdd658455fc65805b378cd3e4506ffc6aa283b034c99f7379092168fa0af989e49a6af602237fd81dc2352ed887290ddecef14a60531

  • C:\Windows\Temp\asw.a1093ddffd466cf5\HTMLayout.dll

    Filesize

    3.3MB

    MD5

    71ae4a2caf76d4413c43bd78c7a642b1

    SHA1

    cd1a0f3654911aa0208353327377238e553f391d

    SHA256

    3848c53d372858740b4c6f2d6bfba7b4f5c1a9d113fb500f5ea827bce798ca0b

    SHA512

    4764e27ac2ce6a6a0d4306f4cf140d6c537fe2ee93b065a590c2273bcfa02409db10db62cb6e840d722988840f4a5376f75fec5175e1511ad9d894a45f642aa8

  • C:\Windows\Temp\asw.a1093ddffd466cf5\Instup.dll

    Filesize

    19.1MB

    MD5

    5687b20720d7df8837c070f13b33fdf3

    SHA1

    d26d59e82904922594e301b2be0a6ed74e930047

    SHA256

    02d5be79de645a40bc81df9dd04ec07b1bbca0a0209ec3afb0e1360c0a464092

    SHA512

    0a9b961677421852745e5885f44bdb6fbceb7700328b609efaa858ddc6fb9f5aa0f7ffa322245d1a56076d151740f05e404dbddf21dcd598c6c627f3a976b421

  • C:\Windows\Temp\asw.a1093ddffd466cf5\Instup.exe

    Filesize

    3.1MB

    MD5

    7010b5c01c247efa439f6aba9f5c7ef5

    SHA1

    5ede7a7d9d8c6a854d4bb97c3e65ca0f32980967

    SHA256

    ba17eabc4e0bd2bb10e44a4a2822922285f1cb787abc1e58a5029a409b56a04c

    SHA512

    3844d99e6768448bde1e305b4b7ab635b3824e50f49d579590b0bd0c10683c46c37bdb76ba104e71398383720915be9a86f694c1e2e4c8ef8e2f1ec32ecf61a8

  • C:\Windows\Temp\asw.a1093ddffd466cf5\config.def

    Filesize

    26KB

    MD5

    6ff6d647e600e13cb86cfdf6a539dc2a

    SHA1

    bb8bf38631c43076ddfd32c1bd951d2cbaf6d010

    SHA256

    2f651dbe61f358553962af658b4f9a8f0f5bf245f7698523941fe4302f8ff1e8

    SHA512

    5a14a75713368f5284fc7ce5c01c3b024a72e30356098eb20999bc75b918f6f014732ba7cd52aa02634ecbe9c766305d84651ea0b631c07c15a635b18200b88d

  • C:\Windows\Temp\asw.a1093ddffd466cf5\prod-pgm.vpx

    Filesize

    572B

    MD5

    f7a67d80534fa08b6046fc98c11605f4

    SHA1

    25089b04321fdf333f4d4f0e5d114fe6b192ba15

    SHA256

    c6be5bc1f5ba21be1f01ebf8bd8efb7942f2ae57b0bd6b04c4da814f4677c88c

    SHA512

    bc7f5f2ec0f98b33d7a80951795e77026b4841bb2388ce54f8d7308d44880f2e38627f0fe9f5d950f32a4c71b1aafc980ad5f037ee258ab5204fcdf7bae8b802

  • C:\Windows\Temp\asw.a1093ddffd466cf5\servers.def

    Filesize

    29KB

    MD5

    37b34b427232c4a50016a8172716e9eb

    SHA1

    f44aca572ebc264d4398c1ebb01e7ff46f50b716

    SHA256

    7e1da0647af38594f942cb800219705867b731fe9b0243417c6cb61a20151757

    SHA512

    97ed09a9cc72ae7d1636bdc8251ee74bcc12c9385e62e816ef7a2ec882bf2a518075ecabe4c8714f4454b4aa23f16f670dc8ff009c52bda4ba6afebe2f2bb390

  • C:\Windows\Temp\asw.a1093ddffd466cf5\uat.vpx

    Filesize

    15KB

    MD5

    7961e923b0ccbb430658ea7cb3fd6d55

    SHA1

    9a4fd01cb23395759e96260c960683dc352fdd4b

    SHA256

    2b79386a6dd8cbefe18bfeb41215d1c71db52d52bc1fc438d7e1cc8edc3c25b4

    SHA512

    a62d062661e9dd9acf405a76468f3d30a5277d2b224ff62af7f9cc645914f1f7a80c0821207d886544881129d208a0db71f9a66d6b9a1aa32cb0eefe2e1d59d8

  • \Windows\Temp\asw.a1093ddffd466cf5\HTMLayout.dll

    Filesize

    3.3MB

    MD5

    71ae4a2caf76d4413c43bd78c7a642b1

    SHA1

    cd1a0f3654911aa0208353327377238e553f391d

    SHA256

    3848c53d372858740b4c6f2d6bfba7b4f5c1a9d113fb500f5ea827bce798ca0b

    SHA512

    4764e27ac2ce6a6a0d4306f4cf140d6c537fe2ee93b065a590c2273bcfa02409db10db62cb6e840d722988840f4a5376f75fec5175e1511ad9d894a45f642aa8

  • \Windows\Temp\asw.a1093ddffd466cf5\HTMLayout.dll

    Filesize

    3.3MB

    MD5

    71ae4a2caf76d4413c43bd78c7a642b1

    SHA1

    cd1a0f3654911aa0208353327377238e553f391d

    SHA256

    3848c53d372858740b4c6f2d6bfba7b4f5c1a9d113fb500f5ea827bce798ca0b

    SHA512

    4764e27ac2ce6a6a0d4306f4cf140d6c537fe2ee93b065a590c2273bcfa02409db10db62cb6e840d722988840f4a5376f75fec5175e1511ad9d894a45f642aa8

  • \Windows\Temp\asw.a1093ddffd466cf5\HTMLayout.dll

    Filesize

    3.3MB

    MD5

    71ae4a2caf76d4413c43bd78c7a642b1

    SHA1

    cd1a0f3654911aa0208353327377238e553f391d

    SHA256

    3848c53d372858740b4c6f2d6bfba7b4f5c1a9d113fb500f5ea827bce798ca0b

    SHA512

    4764e27ac2ce6a6a0d4306f4cf140d6c537fe2ee93b065a590c2273bcfa02409db10db62cb6e840d722988840f4a5376f75fec5175e1511ad9d894a45f642aa8

  • \Windows\Temp\asw.a1093ddffd466cf5\HTMLayout.dll

    Filesize

    3.3MB

    MD5

    71ae4a2caf76d4413c43bd78c7a642b1

    SHA1

    cd1a0f3654911aa0208353327377238e553f391d

    SHA256

    3848c53d372858740b4c6f2d6bfba7b4f5c1a9d113fb500f5ea827bce798ca0b

    SHA512

    4764e27ac2ce6a6a0d4306f4cf140d6c537fe2ee93b065a590c2273bcfa02409db10db62cb6e840d722988840f4a5376f75fec5175e1511ad9d894a45f642aa8

  • \Windows\Temp\asw.a1093ddffd466cf5\Instup.dll

    Filesize

    19.1MB

    MD5

    5687b20720d7df8837c070f13b33fdf3

    SHA1

    d26d59e82904922594e301b2be0a6ed74e930047

    SHA256

    02d5be79de645a40bc81df9dd04ec07b1bbca0a0209ec3afb0e1360c0a464092

    SHA512

    0a9b961677421852745e5885f44bdb6fbceb7700328b609efaa858ddc6fb9f5aa0f7ffa322245d1a56076d151740f05e404dbddf21dcd598c6c627f3a976b421

  • \Windows\Temp\asw.a1093ddffd466cf5\Instup.exe

    Filesize

    3.1MB

    MD5

    7010b5c01c247efa439f6aba9f5c7ef5

    SHA1

    5ede7a7d9d8c6a854d4bb97c3e65ca0f32980967

    SHA256

    ba17eabc4e0bd2bb10e44a4a2822922285f1cb787abc1e58a5029a409b56a04c

    SHA512

    3844d99e6768448bde1e305b4b7ab635b3824e50f49d579590b0bd0c10683c46c37bdb76ba104e71398383720915be9a86f694c1e2e4c8ef8e2f1ec32ecf61a8

  • \Windows\Temp\asw.a1093ddffd466cf5\uat.dll

    Filesize

    26KB

    MD5

    af25e2083815dd908d9def2f75fc22f0

    SHA1

    c27f5d8566e8468adbc4bfcd4ff33ea820375357

    SHA256

    1b408c68012e7116e6be65c94aa7afdef0fc05852fe8741e79f0f4bd3f16cf22

    SHA512

    ef89deb565045797dd7fa8928267214b9ec200ed097220d18ad6461017f56fc45d633b7147b23340c65bff8613eb7672e732fbe28ba309a0bbfe21672427e45d

  • memory/964-54-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

    Filesize

    8KB