Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
69s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
-
submitted
17/03/2023, 16:53
Errors
General
-
Target
setup.exe
-
Size
4.0MB
-
MD5
de9e298b50913ea7d3d8512e36ba7eb4
-
SHA1
c4e34ed9bb50e283a8bdddb1556cee965346bde4
-
SHA256
7ff48e4483bb80637c0b2c5eccfdd6dc13db14c34e0a492408adad27b864ded2
-
SHA512
3849b51ef096385c7aa17d5b6da7b0f4239c2daca00b4b555bb7ea44711555e3e002f99055ce29de2a19a566d6f9ee3033e790267e306613ba9bbd8a4f5597e6
-
SSDEEP
98304:xZ1hCFd+mS9C+WxoM8CtkskTNfNZ2ynS9KGqCS0vYW:xZrCFda9CZx0vZ2y/4SzW
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 9 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 15 IoCs
-
Modifies registry class 31 IoCs
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-PQUE7.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-PQUE7.tmp\setup.tmp" /SL5="$80054,3687301,168448,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Cities Skylines Campus\unins000.exe"C:\Cities Skylines Campus\unins000.exe" /VERYSILENT3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp"C:\Users\Admin\AppData\Local\Temp\_iu14D2N.tmp" /SECONDPHASE="C:\Cities Skylines Campus\unins000.exe" /FIRSTPHASEWND=$30222 /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3b41⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa3ad2055 /state1:0x41c64e6d1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD50aebaaf2c2467a9997179873b019bdab
SHA1ddaff9ac7377575487adf7746a61aa82c4237fb7
SHA256202d0293d8c5bf8f9a62c6e5e7f095b8bf4d82ba407164b2093b9d227b0ec078
SHA5126de27bef21be6fc34e59fe9c028583818e6982cdc8e56e34fecf936c8b9573a4158590632379304e70625fc4b2bfdf57753bc75ce9917630f99d4eec7bf66880
-
Filesize
1.5MB
MD5173873241aee86df006a97971fbc31d6
SHA1243c4b1c282edb39d1ac77698f071a19da5364cc
SHA2567f52ecac8e649f140444bd12e837841e12636ae23edd7ef0b20a8b9e577d04f4
SHA512847946aa2664a431049a860fe39d14d18be11c9b40e198d0e45f4dbf1ffb983ec7caef232ee5c5ebbf780ec2020b4c131d7f22d594de5a835cd9764cec5b018a
-
Filesize
1.5MB
MD5173873241aee86df006a97971fbc31d6
SHA1243c4b1c282edb39d1ac77698f071a19da5364cc
SHA2567f52ecac8e649f140444bd12e837841e12636ae23edd7ef0b20a8b9e577d04f4
SHA512847946aa2664a431049a860fe39d14d18be11c9b40e198d0e45f4dbf1ffb983ec7caef232ee5c5ebbf780ec2020b4c131d7f22d594de5a835cd9764cec5b018a
-
Filesize
1.5MB
MD5173873241aee86df006a97971fbc31d6
SHA1243c4b1c282edb39d1ac77698f071a19da5364cc
SHA2567f52ecac8e649f140444bd12e837841e12636ae23edd7ef0b20a8b9e577d04f4
SHA512847946aa2664a431049a860fe39d14d18be11c9b40e198d0e45f4dbf1ffb983ec7caef232ee5c5ebbf780ec2020b4c131d7f22d594de5a835cd9764cec5b018a
-
Filesize
1.5MB
MD5173873241aee86df006a97971fbc31d6
SHA1243c4b1c282edb39d1ac77698f071a19da5364cc
SHA2567f52ecac8e649f140444bd12e837841e12636ae23edd7ef0b20a8b9e577d04f4
SHA512847946aa2664a431049a860fe39d14d18be11c9b40e198d0e45f4dbf1ffb983ec7caef232ee5c5ebbf780ec2020b4c131d7f22d594de5a835cd9764cec5b018a
-
Filesize
1.5MB
MD5173873241aee86df006a97971fbc31d6
SHA1243c4b1c282edb39d1ac77698f071a19da5364cc
SHA2567f52ecac8e649f140444bd12e837841e12636ae23edd7ef0b20a8b9e577d04f4
SHA512847946aa2664a431049a860fe39d14d18be11c9b40e198d0e45f4dbf1ffb983ec7caef232ee5c5ebbf780ec2020b4c131d7f22d594de5a835cd9764cec5b018a
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
1.5MB
MD578ca3ba9a7390bce0e7d5e2b0bb762d6
SHA1eb4e539127aece6c6fa4d2feafec71c46ed51358
SHA2561bc8ec2f907e8a21f483c205ef1c4751927b102e26ea132cc052801f7aae30bc
SHA5121295ffbd1524e47906421865a7b5e86b75e48e033f2bd7bb9e8716de3202869b78d552230936482d95addb2614886f2ccfe43b32870135f2604078654b13f6dd
-
Filesize
1.5MB
MD578ca3ba9a7390bce0e7d5e2b0bb762d6
SHA1eb4e539127aece6c6fa4d2feafec71c46ed51358
SHA2561bc8ec2f907e8a21f483c205ef1c4751927b102e26ea132cc052801f7aae30bc
SHA5121295ffbd1524e47906421865a7b5e86b75e48e033f2bd7bb9e8716de3202869b78d552230936482d95addb2614886f2ccfe43b32870135f2604078654b13f6dd
-
Filesize
107KB
MD5c0b11a7e60f69241ddcb278722ab962f
SHA1ff855961eb5ed8779498915bab3d642044fc9bb1
SHA256a8d979460e970e84eacce36b8a68ae5f6b9cc0fe16e05a6209b4ead52b81b021
SHA512cb040aca6592310bffb72c898b8eb3ca8a46ff2df50212634c637593c58683c8ab62e0188da7aea362e1b063ae5db55cf4bf474295922af0ab94a526465cc472
-
Filesize
446KB
MD5dce6d68da86f44ba0cb70fa7718e2e84
SHA158cd39196abfc70b5b9bcc964f41a21024a61480
SHA256b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d
SHA512bd2f559640b63a46e15a2af90719c10e53e1c30020685163ed6b3bb669197d20d5dd76c7fd1052cf0841e3e1fdbd5a365a4bdb519d2f8fcad9122e77d923e8d6
-
Filesize
446KB
MD5dce6d68da86f44ba0cb70fa7718e2e84
SHA158cd39196abfc70b5b9bcc964f41a21024a61480
SHA256b9bdc4a0309aa47613a7b5a680c55839aa7ba28e28f96e6b9316d4d5fe1dbe9d
SHA512bd2f559640b63a46e15a2af90719c10e53e1c30020685163ed6b3bb669197d20d5dd76c7fd1052cf0841e3e1fdbd5a365a4bdb519d2f8fcad9122e77d923e8d6
-
Filesize
1.9MB
MD564101d65027abe80025028af0cfdb6b3
SHA1ad1fa0b6f9abd2df8193ace3c058c6aab6565a2f
SHA256c2debfb2a38bc839365f000878fa4561ddebf4955616feeb812d5adf3094b721
SHA51258caf74ec58dd9a0e7ab3ff11ba89622376ff165cef225c00597ba0522adc42910f53c7b5e2f29fa72ab236b3c4347483fe960acb4f7f9c796162fd6a80b0ab8
-
Filesize
1.9MB
MD564101d65027abe80025028af0cfdb6b3
SHA1ad1fa0b6f9abd2df8193ace3c058c6aab6565a2f
SHA256c2debfb2a38bc839365f000878fa4561ddebf4955616feeb812d5adf3094b721
SHA51258caf74ec58dd9a0e7ab3ff11ba89622376ff165cef225c00597ba0522adc42910f53c7b5e2f29fa72ab236b3c4347483fe960acb4f7f9c796162fd6a80b0ab8
-
Filesize
129KB
MD570cd1d226553f3c0546664d76373fe67
SHA1509d03b6fce1e35b6e848ae88af52b7b9ff42d48
SHA25665a7e7fb213007ba2e285bb2c3e2df1a553990a2a3e26a0a6591f01ce6c87bc0
SHA5125b2487bfffb26ff76988f175e4aa97f7ae83b9dd747bd61ae7d3b338f04447a345186a715bfe0bb86c07cd5c3c829540fc4099254cfee20d873700573ef5826f
-
Filesize
129KB
MD570cd1d226553f3c0546664d76373fe67
SHA1509d03b6fce1e35b6e848ae88af52b7b9ff42d48
SHA25665a7e7fb213007ba2e285bb2c3e2df1a553990a2a3e26a0a6591f01ce6c87bc0
SHA5125b2487bfffb26ff76988f175e4aa97f7ae83b9dd747bd61ae7d3b338f04447a345186a715bfe0bb86c07cd5c3c829540fc4099254cfee20d873700573ef5826f
-
Filesize
27KB
MD539a339e9c9ecc529202508c9c89a9956
SHA192e697882abb90cba6a783aef98d3d05deb8e4b9
SHA25688160915cd065e25bc0b9b89099663ccbcca606a5707a28a5df12e9c118d4f16
SHA512b96e3bac6da4e3812f09d21d575642beac47338c026f3bc116d42b09cfb492b1e51cc74cbb9d1724e744ec2129619b196247ca1ddc03d8c0a27a2613890cbef3
-
Filesize
27KB
MD539a339e9c9ecc529202508c9c89a9956
SHA192e697882abb90cba6a783aef98d3d05deb8e4b9
SHA25688160915cd065e25bc0b9b89099663ccbcca606a5707a28a5df12e9c118d4f16
SHA512b96e3bac6da4e3812f09d21d575642beac47338c026f3bc116d42b09cfb492b1e51cc74cbb9d1724e744ec2129619b196247ca1ddc03d8c0a27a2613890cbef3
-
Filesize
4KB
-
Filesize
204KB
-
Filesize
204KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
472KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
320KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
164KB
-
Filesize
96KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
2.1MB
-
Filesize
472KB
-
Filesize
4KB
-
Filesize
96KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
2.1MB