Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2023, 09:57
Static task
static1
Behavioral task
behavioral1
Sample
DriverToolkitInstaller.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
DriverToolkitInstaller.exe
Resource
win10v2004-20230220-en
General
-
Target
DriverToolkitInstaller.exe
-
Size
2.3MB
-
MD5
ade449592745b54724fa70ec488b99fd
-
SHA1
9aa32c2a67da99465f6b4c8c88cd52b109a243c4
-
SHA256
2097cfcef072f6b12370139d94a171073df2255807c01ad6d747f0d24a190aa6
-
SHA512
9675264caea44f30c035013f617591679b0802f8d7bc552b0091b944720db67ebc7ec3d1e9536ba7f13dcb07ef591d20e5c063de6e3979540c34d2b0963156ed
-
SSDEEP
49152:khg3LcSpYqQLyUf42fy6A4OeOqdAIjtYKmbaS/0GfVfcDi9r:JLcSpd8yEzvPlK1JODiN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2044 DriverToolkitInstaller.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4628 wrote to memory of 2044 4628 DriverToolkitInstaller.exe 85 PID 4628 wrote to memory of 2044 4628 DriverToolkitInstaller.exe 85 PID 4628 wrote to memory of 2044 4628 DriverToolkitInstaller.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\DriverToolkitInstaller.exe"C:\Users\Admin\AppData\Local\Temp\DriverToolkitInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\is-RUCG4.tmp\DriverToolkitInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-RUCG4.tmp\DriverToolkitInstaller.tmp" /SL5="$C0160,2034942,134144,C:\Users\Admin\AppData\Local\Temp\DriverToolkitInstaller.exe"2⤵
- Executes dropped EXE
PID:2044
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54fec953b2903ca1dc503a08db5dfd8b7
SHA14d1ae35ce801b19abe2ffa48c972a6c416b92644
SHA25625a03caed8ced6b4aff82ac86106bf1401f6c780c7719d821e8b44c2b7496680
SHA5121baf114e41190c4acf436d39ae3db424f9fafb64a0219a580a33f70f5c24e117710830f29a6c2b06c977055644d764c83820e55d49c8d49d0a894e6ab133a85a
-
Filesize
1.1MB
MD54fec953b2903ca1dc503a08db5dfd8b7
SHA14d1ae35ce801b19abe2ffa48c972a6c416b92644
SHA25625a03caed8ced6b4aff82ac86106bf1401f6c780c7719d821e8b44c2b7496680
SHA5121baf114e41190c4acf436d39ae3db424f9fafb64a0219a580a33f70f5c24e117710830f29a6c2b06c977055644d764c83820e55d49c8d49d0a894e6ab133a85a