Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
130s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
14/06/2023, 10:12
Static task
static1
Behavioral task
behavioral1
Sample
EMBR_Setup_2.0.4.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
EMBR_Setup_2.0.4.exe
Resource
win10v2004-20230220-en
General
-
Target
EMBR_Setup_2.0.4.exe
-
Size
177.7MB
-
MD5
91f977d84733be5d3a0b145065d945da
-
SHA1
afab46c456e36f695ec8c9e4a59f2f823f3cbf8a
-
SHA256
fc3b49c6ea712bc51c606936ad55e719d208e165e247b0197079fb2bf80d46c2
-
SHA512
24e4645efc741084a2c6155c51accb74e05ac59eecf0242feb08f82d5b931fd6393ad4f0546b45091bfcbcb4647377b798e9ac8dcdc0a576c0a1f1c5fcc62153
-
SSDEEP
3145728:qgookt6Qy3tGHE41CJ+GUylUPBlWLTTaUPBlWLTsQYQNGGiffRSR5Ua/EE9iQEdd:4R6+mvhOWf+OWfFhPiffA/Ualg
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2024 EMBR_Setup_2.0.4.exe 2024 EMBR_Setup_2.0.4.exe 2024 EMBR_Setup_2.0.4.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2024 EMBR_Setup_2.0.4.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD533b4e69e7835e18b9437623367dd1787
SHA153afa03edaf931abdc2d828e5a2c89ad573d926c
SHA25672d38ef115e71fc73dc5978987c583fc8c6b50ff12e4a5d30649a4d164a8b6ae
SHA512ca890e785d1a0a7e0b4a748416fba417826ae66b46e600f407d4e795b444612a8b830f579f2cf5b6e051bea800604f34f8801cc3daf05c8d29ad05bcda454a77
-
Filesize
11KB
MD575ed96254fbf894e42058062b4b4f0d1
SHA1996503f1383b49021eb3427bc28d13b5bbd11977
SHA256a632d74332b3f08f834c732a103dafeb09a540823a2217ca7f49159755e8f1d7
SHA51258174896db81d481947b8745dafe3a02c150f3938bb4543256e8cce1145154e016d481df9fe68dac6d48407c62cbe20753320ebd5fe5e84806d07ce78e0eb0c4
-
Filesize
14KB
MD5adb29e6b186daa765dc750128649b63d
SHA1160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA2562f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
SHA512b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada