Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    88s
  • max time network
    100s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2023, 07:18

General

  • Target

    setup.exe

  • Size

    1.1MB

  • MD5

    bd007ef0eee8010b56f262a94d4d79f4

  • SHA1

    f09d4cf8a0241e561fb22238c72292c902608aec

  • SHA256

    840d52d35ff84d5ca2b3967a4cc837c225da4352071e7ada61baeeceeaaba4b5

  • SHA512

    8c24a9c10a2efcf02d60a7c83c7046631096ea026a05954657b706e68e1be747aa45fc31777ec035e99e53499a77d99ddabed1a9c375bcf8fa954e024a2223c4

  • SSDEEP

    12288:yDPdsil5fCMggBIiMVO26kk+FG4eMb01JQntLOCVLoz6UD:yD1s2ts96kTbemVAh

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5028
    • \??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe
      VSTOInstaller.exe /install http://siscc.aleksus.ee/StatDataManager.vsto
      2⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:3444

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Deployment\XWYAMPCB.Z38\D5GV6YW9.8GD.application

    Filesize

    5KB

    MD5

    60bdcbdbcce37aa6f0605d163f4557c0

    SHA1

    fb235516c78b702cedbde8c364dcc28634d89579

    SHA256

    2a24abc925527ca2e0c6534399aceddd396484b311a2fa084c2b0480a056ac5d

    SHA512

    69e09b2c12cf19b6bc92d43b28f026897cbccb46435d6c6926dae2bc9aee5ce95a4d5bbd85183a76f40171dcdae4c609d6a05e0cdba62974d0f8e8a802b8425c

  • memory/3444-140-0x000000001B900000-0x000000001B918000-memory.dmp

    Filesize

    96KB

  • memory/3444-139-0x000000001B960000-0x000000001B994000-memory.dmp

    Filesize

    208KB

  • memory/3444-137-0x000000001B9B0000-0x000000001BA16000-memory.dmp

    Filesize

    408KB

  • memory/3444-141-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

    Filesize

    64KB

  • memory/3444-142-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

    Filesize

    64KB

  • memory/3444-143-0x000000001DCD0000-0x000000001DE56000-memory.dmp

    Filesize

    1.5MB

  • memory/3444-144-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

    Filesize

    64KB

  • memory/3444-146-0x000000001E870000-0x000000001E8C0000-memory.dmp

    Filesize

    320KB

  • memory/3444-138-0x000000001B920000-0x000000001B956000-memory.dmp

    Filesize

    216KB

  • memory/3444-159-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

    Filesize

    64KB

  • memory/3444-160-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

    Filesize

    64KB

  • memory/3444-161-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

    Filesize

    64KB

  • memory/3444-162-0x000000001B9A0000-0x000000001B9B0000-memory.dmp

    Filesize

    64KB