Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
16/05/2023, 23:47
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20230220-en
General
-
Target
Setup.exe
-
Size
2.7MB
-
MD5
c65cf922a22f331d5762c8c810ec2a77
-
SHA1
f5a403decdf3819eba22900cf76f812e36f2521b
-
SHA256
565be6b129c1976ad1d57d8e5304e11b91f7b045a32fc877437b935b86f0aa80
-
SHA512
15b5b56090280fc0c1ce1b0436a73bf5605f18da08197302d09a25ea01265bdc1aa9e4e231c950eaa0ca066b34b8a3b3f8c9343e479ee491a2062b018cbb6018
-
SSDEEP
49152:RBuZrEUKDEWFINqGFMVFHwXGuP1eklXTX:3kLK7ac5V6XGujljX
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2008 Setup.tmp -
Loads dropped DLL 1 IoCs
pid Process 1696 Setup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mc_config_avc.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mocha.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\qml\QtQuick\Extras\qtquickextrasplugin.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\bin\Qt5QuickControls2.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\MOG_Framework_5.3.6.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\Common\libmmd.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\icucnv69.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\crxdec.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mc_mux_dv.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\boost_test.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\qml\QtQml\qmlplugin.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\zlib1.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\WRServices.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\libdynamic-napi.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\bin\opencv_calib3d430.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\dvascriptedworkflow.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\DisplaySurface.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mc_enc_mp2sr.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugPlug.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\HandlerCapture.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\dvanetsync.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\ExportSettings.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\DynamicLinkMedia.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\HandlerProject.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\vcruntime140.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\qml\QtQuick\Dialogs\dialogplugin.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\ImporterHost.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mc_enc_dv.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\HandlerEvents.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\RadialController.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\MediaUtils.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\tbbmalloc.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PProHeadless.exe Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\Common\DVControl.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\aedisplay.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\bin\Qt5QuickShapes.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\Batch.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\dvastorage.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\AGM.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\HandlerMediaBrowser.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\MLCloudSupport.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mc_trans_audio_converter.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\boost_regex.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\SweetPeaSupport.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\IngestCore.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\ATEWrapper.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\SLU.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mp4decoder_dll.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\qml\QtQuick\XmlListModel\qmlxmllistmodelplugin.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\ScriptLayer.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\bin\Qt5QuickParticles.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\Dialogs.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\EAMedia.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mc_dec_avc.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\UIFramework.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\AudioFilterHost.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\TitleImageManager.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\mc_enc_mp2v.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\bin\Qt5QuickTemplates2.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\PlugIns\(AfterEffectsLib)\Effects\mochaAE\MochaAE.bundle\Contents\Win64\mochaui\bin\opencl.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\SMDK-VC140-x64-4_21_0.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\TitleLayout.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\GPUFoundation.dll Setup.tmp File opened for modification C:\Program Files\Adobe\Adobe Premiere Pro 2023\ARE.dll Setup.tmp -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2008 Setup.tmp 2008 Setup.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2008 Setup.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2008 Setup.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1696 wrote to memory of 2008 1696 Setup.exe 27 PID 1696 wrote to memory of 2008 1696 Setup.exe 27 PID 1696 wrote to memory of 2008 1696 Setup.exe 27 PID 1696 wrote to memory of 2008 1696 Setup.exe 27 PID 1696 wrote to memory of 2008 1696 Setup.exe 27 PID 1696 wrote to memory of 2008 1696 Setup.exe 27 PID 1696 wrote to memory of 2008 1696 Setup.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\is-6TKGL.tmp\Setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-6TKGL.tmp\Setup.tmp" /SL5="$A0124,881152,0,C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:2008
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD56be97c3e948113b96eec486a41ea7df2
SHA1ffbe580deb19fee55f7329a7db6619fa52f974d3
SHA256a561b065bf1f2b36a37698cf2e21edcf913c565c6ba618070a504bdb64b296d9
SHA512a117895c1ee7b6cf52225ee07bf148d7fa039a1545748d31199db32b2302e78f8672446bc58390bb0705a0c3d1d7b6e8dc88194937feb43ccbda6330e69e5faa
-
Filesize
3.1MB
MD56be97c3e948113b96eec486a41ea7df2
SHA1ffbe580deb19fee55f7329a7db6619fa52f974d3
SHA256a561b065bf1f2b36a37698cf2e21edcf913c565c6ba618070a504bdb64b296d9
SHA512a117895c1ee7b6cf52225ee07bf148d7fa039a1545748d31199db32b2302e78f8672446bc58390bb0705a0c3d1d7b6e8dc88194937feb43ccbda6330e69e5faa