Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
14/06/2023, 07:18
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230220-en
General
-
Target
setup.exe
-
Size
1.1MB
-
MD5
bd007ef0eee8010b56f262a94d4d79f4
-
SHA1
f09d4cf8a0241e561fb22238c72292c902608aec
-
SHA256
840d52d35ff84d5ca2b3967a4cc837c225da4352071e7ada61baeeceeaaba4b5
-
SHA512
8c24a9c10a2efcf02d60a7c83c7046631096ea026a05954657b706e68e1be747aa45fc31777ec035e99e53499a77d99ddabed1a9c375bcf8fa954e024a2223c4
-
SSDEEP
12288:yDPdsil5fCMggBIiMVO26kk+FG4eMb01JQntLOCVLoz6UD:yD1s2ts96kTbemVAh
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager VSTOInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "D1MO1M288D2CYOGD2JWE1DNV" VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion VSTOInstaller.exe Key deleted \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 VSTOInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "R7YHVJLWN9EYRX83YJ34X80N" VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft VSTOInstaller.exe Set value (str) \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "J439XH9O3VN2N570R8WXNRHO" VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies VSTOInstaller.exe Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components VSTOInstaller.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3444 VSTOInstaller.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5028 wrote to memory of 3444 5028 setup.exe 83 PID 5028 wrote to memory of 3444 5028 setup.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5028 -
\??\c:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exeVSTOInstaller.exe /install http://siscc.aleksus.ee/StatDataManager.vsto2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3444
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD560bdcbdbcce37aa6f0605d163f4557c0
SHA1fb235516c78b702cedbde8c364dcc28634d89579
SHA2562a24abc925527ca2e0c6534399aceddd396484b311a2fa084c2b0480a056ac5d
SHA51269e09b2c12cf19b6bc92d43b28f026897cbccb46435d6c6926dae2bc9aee5ce95a4d5bbd85183a76f40171dcdae4c609d6a05e0cdba62974d0f8e8a802b8425c