Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1223s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
29/06/2023, 14:23
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20230621-en
General
-
Target
setup.exe
-
Size
4.7MB
-
MD5
077f63a50fc9039db9be0e9ace472f32
-
SHA1
689369e5da1e38c28aa78e374f53936587db7a26
-
SHA256
8a4fa749fd6252d7d592d1c54fae3d1462caf70e8498b95c9d539f86c9a4f26e
-
SHA512
e0f5c09b326533c4ea61fd511368fc14706e3fa31d0db1f756e4aa468365161c3ec8e43c270105bd23b6bc5d2d2bf52a68e5cc0280f52fe1983716078e3ae650
-
SSDEEP
98304:if7wCQInrje/CAVMJy1Wlwkk6O3HtT8N5SgfQ9XN:ifn6/VSllHhOXEzfE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4768 setup.tmp -
Loads dropped DLL 11 IoCs
pid Process 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp 4768 setup.tmp -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4768 setup.tmp -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1132 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1132 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4768 setup.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1708 wrote to memory of 4768 1708 setup.exe 82 PID 1708 wrote to memory of 4768 1708 setup.exe 82 PID 1708 wrote to memory of 4768 1708 setup.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\is-34FE3.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-34FE3.tmp\setup.tmp" /SL5="$9016E,4419924,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:4768
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x390 0x3941⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵PID:3760
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5ae9890548f2fcab56a4e9ae446f55b3f
SHA1e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA25609af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
SHA512154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
-
Filesize
1.4MB
MD5ae9890548f2fcab56a4e9ae446f55b3f
SHA1e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA25609af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
SHA512154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb
-
Filesize
103KB
MD58005750ec63eb5292884ad6183ae2e77
SHA1c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA256df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
SHA512febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
380KB
MD563dc27b7bc65243efaa59a9797a140ba
SHA122f893aefcebecc9376e2122a3321befa22cdd73
SHA256c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
SHA5123df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
-
Filesize
380KB
MD563dc27b7bc65243efaa59a9797a140ba
SHA122f893aefcebecc9376e2122a3321befa22cdd73
SHA256c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
SHA5123df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
-
Filesize
1KB
MD5473a683962d3375a00f93dd8ce302158
SHA11c0709631834fd3715995514eef875b2b968a6be
SHA2567f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
SHA51224ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
220KB
MD5af555ac9c073f88fe5bf0d677f085025
SHA15fff803cf273057c889538886f6992ea05dd146e
SHA256f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
SHA512c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf