Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
11/05/2023, 01:26
Static task
static1
Behavioral task
behavioral1
Sample
tes_construction_set_1.2.404.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
tes_construction_set_1.2.404.exe
Resource
win10v2004-20230220-en
General
-
Target
tes_construction_set_1.2.404.exe
-
Size
7.0MB
-
MD5
396089d6a610179d366d6b6b24ed52cd
-
SHA1
0e6999c61ba62fa607ee334fad733acae3e8cbf4
-
SHA256
34fd2cfbde39f21408be51e11ac399991550295484c518091ca0770f186fb4ec
-
SHA512
fc32def8ff59b1ad92b598b9665adc116b85dd6545b36ef582f43fed2e3efc646bc2650343178550a1a14780c68c024354140f3ba6ee5c0c72945758e55e7088
-
SSDEEP
196608:fp0c3is57E0DO+IO3ySMwDmCkr4EVY2UYJ2mHYUUvpIir:fp0c3N79DOhrwDmCZxmgeYzp1r
Malware Config
Signatures
-
Loads dropped DLL 6 IoCs
pid Process 828 tes_construction_set_1.2.404.exe 828 tes_construction_set_1.2.404.exe 828 tes_construction_set_1.2.404.exe 828 tes_construction_set_1.2.404.exe 828 tes_construction_set_1.2.404.exe 828 tes_construction_set_1.2.404.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\set5FD.tmp tes_construction_set_1.2.404.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\isp5DD.tmp\temp.000 tes_construction_set_1.2.404.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\isp6E9.tmp\temp.000 tes_construction_set_1.2.404.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKe798.tmp tes_construction_set_1.2.404.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\iKe798.tmp tes_construction_set_1.2.404.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1388 wrote to memory of 828 1388 tes_construction_set_1.2.404.exe 28 PID 1388 wrote to memory of 828 1388 tes_construction_set_1.2.404.exe 28 PID 1388 wrote to memory of 828 1388 tes_construction_set_1.2.404.exe 28 PID 1388 wrote to memory of 828 1388 tes_construction_set_1.2.404.exe 28 PID 1388 wrote to memory of 828 1388 tes_construction_set_1.2.404.exe 28 PID 1388 wrote to memory of 828 1388 tes_construction_set_1.2.404.exe 28 PID 1388 wrote to memory of 828 1388 tes_construction_set_1.2.404.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\tes_construction_set_1.2.404.exe"C:\Users\Admin\AppData\Local\Temp\tes_construction_set_1.2.404.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\tes_construction_set_1.2.404.exeC:\Users\Admin\AppData\Local\Temp\tes_construction_set_1.2.404.exe -deleter2⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:828
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\isp6E9.tmp\IGdi.dll
Filesize196KB
MD5cd37457a02ebb8cc8596ec1ec4805959
SHA1b280ab56de15b2ba67bef5152f1489c04da02bbd
SHA25607ced62e7f3611fb56840480778b3cce83ee02913de95bcd67f52dcb9fb0b0ed
SHA512b35fb4006d1290a56d60c04e10d87ea6768c88a83ac26b36b29b1fdc583b17f48461a6afce12a58f036980467a8859f8258b6c9dcaf8066a89f62613e67bdd84
-
Filesize
324KB
MD55b5182aa2d922801cbf083b2a69b1a46
SHA16dd0c36b874374b9c16c77ed8cd95c8c405358b4
SHA25683412e1ed4caf8043a731b8cd86d739d85c831d01ccacc28c440343bbbca7a80
SHA512c81005b53b495f69170530ee0f48f6772f7083e1fe2959cc78020a595d27498e0242ccaa3845a9cedfb52eee227726b084ce882b2fc3528efb32d895738dff63
-
Filesize
739B
MD54b582edd5811e3feb0b113cb2cbcdeb6
SHA16e3c9f1cee3c4e7df8ac8ec1e0f273c585fdd026
SHA256b622838d5e6cfa7ec72c27c74d291a930d8c800842c8bb6ab933fc9f933786b3
SHA51280d799c7a509805b9e2f50fd05cfcbf87b2cde590a7dd31fa66f35c57b4a9f77ed6f0012ccd1c2c0e84fd1a3318f4809cb4b2023a789368bc307703c9633aef0
-
Filesize
153B
MD554c129336767e805bb4cfab34255d252
SHA137d1d94fdc63a93b63648cf2688085c3314a7818
SHA256a7014823a4e37402f2bfe7fb86dcb866a0cbc4621a816c6f4bd99ab77e7d2d59
SHA512dcecc70fd4988c237206477e3b764e7ad04f8bd7eaf4eeabf5141d6c8ca6b61eee5c60f23fdd697cfe8ab6696a93247606ceb72ef47bd3b964b8e4783bdf3481
-
Filesize
386KB
MD59402376c4dce39be1021b5f7ee2a6a80
SHA12e3a387969b92a47b64fc606a12a680b6b026c79
SHA256e5908cd7a47f15dc7ac16b81ccb151576771e68594275dccff5119711afb6c0b
SHA51259af674c92733e9a068cc8df38a59d3867f167acd8c1b3317330d59244c4090b3e8caac08a62341a42678dd8914c07ded6041f8815f92664ab36e49ab5ceaeb9
-
Filesize
156KB
MD52656cb75c1f6b71cde6b7e7b3645e1d9
SHA17d20db395762e7ce19bf43c4e57820ac37d04db3
SHA25612440426c955f9cadf425222da0a592c7e16ed9c4486225f4dc53378b59ab7b0
SHA512bc1f6d579863a3435c4532b2dbeb3fb4258e9f0d0a85062b33709a28f3449197e86608d91e6ed5826291cde8328bc2238b1c7e4302e9f25bef4c7f50a1726af6
-
Filesize
156KB
MD52656cb75c1f6b71cde6b7e7b3645e1d9
SHA17d20db395762e7ce19bf43c4e57820ac37d04db3
SHA25612440426c955f9cadf425222da0a592c7e16ed9c4486225f4dc53378b59ab7b0
SHA512bc1f6d579863a3435c4532b2dbeb3fb4258e9f0d0a85062b33709a28f3449197e86608d91e6ed5826291cde8328bc2238b1c7e4302e9f25bef4c7f50a1726af6
-
Filesize
480B
MD5b9a348a7001ad06c1c6625593b5ba81a
SHA170152746181bf806a38a5b27d1d392afe8a18bd8
SHA25617a7ce3aa45795f61e841f26e686e9ece666f15a4b8cb852c26937b71067eaf6
SHA512387625752186ddbe630ac9f9c6399ae734b64fb9459e0bd2bddb77f26f75a90366985a91d1cf7b47c326a902c577adfd431f2fa25a7d76c4abfea51950cf2b53
-
Filesize
736KB
MD5594678e8fc20d430eb7bd2de53f8f307
SHA10fa3e19b6444847f840b53786d92f2847c07959d
SHA2568f137730eb7330b72ade6b67d6c4b3d6793280423a4e29c53973662a95fa24ba
SHA512f2a336d69ed17c3beb7ccbcfdae6a74a19a0faa9a9cc342a072aee5257d5ab2c2bf7cd69bab429f6c44449cbbd1763bdb72bcd50dd82b5df3e4276fdae406b84
-
Filesize
736KB
MD5594678e8fc20d430eb7bd2de53f8f307
SHA10fa3e19b6444847f840b53786d92f2847c07959d
SHA2568f137730eb7330b72ade6b67d6c4b3d6793280423a4e29c53973662a95fa24ba
SHA512f2a336d69ed17c3beb7ccbcfdae6a74a19a0faa9a9cc342a072aee5257d5ab2c2bf7cd69bab429f6c44449cbbd1763bdb72bcd50dd82b5df3e4276fdae406b84
-
\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\isp6E9.tmp\IGdi.dll
Filesize196KB
MD5cd37457a02ebb8cc8596ec1ec4805959
SHA1b280ab56de15b2ba67bef5152f1489c04da02bbd
SHA25607ced62e7f3611fb56840480778b3cce83ee02913de95bcd67f52dcb9fb0b0ed
SHA512b35fb4006d1290a56d60c04e10d87ea6768c88a83ac26b36b29b1fdc583b17f48461a6afce12a58f036980467a8859f8258b6c9dcaf8066a89f62613e67bdd84
-
\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\11\00\Intel32\isp6E9.tmp\IGdi.dll
Filesize196KB
MD5cd37457a02ebb8cc8596ec1ec4805959
SHA1b280ab56de15b2ba67bef5152f1489c04da02bbd
SHA25607ced62e7f3611fb56840480778b3cce83ee02913de95bcd67f52dcb9fb0b0ed
SHA512b35fb4006d1290a56d60c04e10d87ea6768c88a83ac26b36b29b1fdc583b17f48461a6afce12a58f036980467a8859f8258b6c9dcaf8066a89f62613e67bdd84
-
Filesize
324KB
MD55b5182aa2d922801cbf083b2a69b1a46
SHA16dd0c36b874374b9c16c77ed8cd95c8c405358b4
SHA25683412e1ed4caf8043a731b8cd86d739d85c831d01ccacc28c440343bbbca7a80
SHA512c81005b53b495f69170530ee0f48f6772f7083e1fe2959cc78020a595d27498e0242ccaa3845a9cedfb52eee227726b084ce882b2fc3528efb32d895738dff63
-
Filesize
156KB
MD52656cb75c1f6b71cde6b7e7b3645e1d9
SHA17d20db395762e7ce19bf43c4e57820ac37d04db3
SHA25612440426c955f9cadf425222da0a592c7e16ed9c4486225f4dc53378b59ab7b0
SHA512bc1f6d579863a3435c4532b2dbeb3fb4258e9f0d0a85062b33709a28f3449197e86608d91e6ed5826291cde8328bc2238b1c7e4302e9f25bef4c7f50a1726af6