Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
40s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
22/09/2023, 06:39
General
-
Target
advanced-scene-switcher-windows-x64-Installer.exe
-
Size
41.4MB
-
MD5
28b45d54602aa1ca00aa3ef7a38a7067
-
SHA1
5b686db35f96c94dabf2dda6ea5ccd4ae3de79ed
-
SHA256
782cd4820b705f339a1a1c89748fe4f37b00fcac7e8bb8e37de1beb27fc36639
-
SHA512
4f8a4f6fdb19df723e0aa762499e410588fc88111421f2bbc9f16fc47298dae5529c8f469b26963f3cb7ae068052da92c2a0498ef3c14e9ada233e6226fb2d1d
-
SSDEEP
786432:3VqaZRN5mYtnPXoct0MhzPg59syZALU76905H5UY2rvH3xaIoiYoGUWu+3DRt:Tvb5PoYLhzP8szLUg05HKrv0IoyXl+3f
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\advanced-scene-switcher-windows-x64-Installer.exe"C:\Users\Admin\AppData\Local\Temp\advanced-scene-switcher-windows-x64-Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HHCU3.tmp\advanced-scene-switcher-windows-x64-Installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-HHCU3.tmp\advanced-scene-switcher-windows-x64-Installer.tmp" /SL5="$A006A,42546233,832512,C:\Users\Admin\AppData\Local\Temp\advanced-scene-switcher-windows-x64-Installer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5d72b2f28d9bf1d6581717b4307e4baa1
SHA176c869ed1170414d979bbc0c4f14ac8e5040ef68
SHA256c56fe246991ea3a287a6e6215c885d78211305eefbe6ab0960dca755cd9d0b06
SHA512eb088e4aceb6e72d83153d192b715b3bef2ee0019ad5120c0ec86b39814d9b0bf218989e681b92d955a92f87c7f8fba3241ff65da2abfe47eb35153718ee287a
-
Filesize
3.1MB
MD5d72b2f28d9bf1d6581717b4307e4baa1
SHA176c869ed1170414d979bbc0c4f14ac8e5040ef68
SHA256c56fe246991ea3a287a6e6215c885d78211305eefbe6ab0960dca755cd9d0b06
SHA512eb088e4aceb6e72d83153d192b715b3bef2ee0019ad5120c0ec86b39814d9b0bf218989e681b92d955a92f87c7f8fba3241ff65da2abfe47eb35153718ee287a
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
4KB
-
Filesize
3.1MB
-
Filesize
3.1MB
-
Filesize
864KB
-
Filesize
864KB
-
Filesize
864KB