Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

3

advanced-s...er.exe

windows7-x64

7

advanced-s...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    43s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    22/09/2023, 06:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    advanced-scene-switcher-windows-x64-Installer.exe

  • Size

    41.4MB

  • MD5

    28b45d54602aa1ca00aa3ef7a38a7067

  • SHA1

    5b686db35f96c94dabf2dda6ea5ccd4ae3de79ed

  • SHA256

    782cd4820b705f339a1a1c89748fe4f37b00fcac7e8bb8e37de1beb27fc36639

  • SHA512

    4f8a4f6fdb19df723e0aa762499e410588fc88111421f2bbc9f16fc47298dae5529c8f469b26963f3cb7ae068052da92c2a0498ef3c14e9ada233e6226fb2d1d

  • SSDEEP

    786432:3VqaZRN5mYtnPXoct0MhzPg59syZALU76905H5UY2rvH3xaIoiYoGUWu+3DRt:Tvb5PoYLhzP8szLUg05HKrv0IoyXl+3f

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\advanced-scene-switcher-windows-x64-Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\advanced-scene-switcher-windows-x64-Installer.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2128
    • C:\Users\Admin\AppData\Local\Temp\is-DQ4R9.tmp\advanced-scene-switcher-windows-x64-Installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-DQ4R9.tmp\advanced-scene-switcher-windows-x64-Installer.tmp" /SL5="$400E0,42546233,832512,C:\Users\Admin\AppData\Local\Temp\advanced-scene-switcher-windows-x64-Installer.exe"
      2⤵
      • Executes dropped EXE
      PID:2172

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-DQ4R9.tmp\advanced-scene-switcher-windows-x64-Installer.tmp
    Filesize

    3.1MB

    MD5

    d72b2f28d9bf1d6581717b4307e4baa1

    SHA1

    76c869ed1170414d979bbc0c4f14ac8e5040ef68

    SHA256

    c56fe246991ea3a287a6e6215c885d78211305eefbe6ab0960dca755cd9d0b06

    SHA512

    eb088e4aceb6e72d83153d192b715b3bef2ee0019ad5120c0ec86b39814d9b0bf218989e681b92d955a92f87c7f8fba3241ff65da2abfe47eb35153718ee287a

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-DQ4R9.tmp\advanced-scene-switcher-windows-x64-Installer.tmp
    Filesize

    3.1MB

    MD5

    d72b2f28d9bf1d6581717b4307e4baa1

    SHA1

    76c869ed1170414d979bbc0c4f14ac8e5040ef68

    SHA256

    c56fe246991ea3a287a6e6215c885d78211305eefbe6ab0960dca755cd9d0b06

    SHA512

    eb088e4aceb6e72d83153d192b715b3bef2ee0019ad5120c0ec86b39814d9b0bf218989e681b92d955a92f87c7f8fba3241ff65da2abfe47eb35153718ee287a

    Download Submit

  • memory/2128-1-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

    Download

  • memory/2128-12-0x0000000000400000-0x00000000004D8000-memory.dmp

    Filesize

    864KB

    Download

  • memory/2172-8-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2172-13-0x0000000000400000-0x000000000071C000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2172-14-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download