Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
03/10/2023, 15:30
General
-
Target
EPS_setup.exe
-
Size
4.3MB
-
MD5
3d0b02cad726d1a45a3f55bcf395b210
-
SHA1
cb2239ee9f5e6652ce7e54f49d667874312161a3
-
SHA256
b18a540f4506ae9400bbc58fb8b69028274b3ccc4851de605df77b545c7c625b
-
SHA512
f21c530547c161405d72c518e2849db299bd6e625758a83095c8b5a894f1287861693a0f2ba76593558d7160ad539f3273ff842f259e3fb886dbfa4abc4a90f1
-
SSDEEP
49152:GqeNVSZPSLIkg/JFF85w8pLe0xgcMw10EDl0qO7wv3My+B2sO2skryk9ReN/xj:3EsPSLIlM5w8Rbdr0SI723My+AsGkCr
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in Program Files directory 14 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 1 IoCs
-
Suspicious use of SetWindowsHookEx 6 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\EPS_setup.exe"C:\Users\Admin\AppData\Local\Temp\EPS_setup.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DR20S.tmp\EPS_setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-DR20S.tmp\EPS_setup.tmp" /SL5="$700DC,3714644,795648,C:\Users\Admin\AppData\Local\Temp\EPS_setup.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Didsoft\Elite Proxy Switcher\EPS.exe"C:\Program Files (x86)\Didsoft\Elite Proxy Switcher\EPS.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
574KB
MD5b6ae1db2233568d6571fe949125b0bab
SHA1e75eb96b5d30014a83e9dde43334d4b78494a3e3
SHA256fbc65fe373c16600ac9becea7158b1e73fb49047b8922feee8f9b1f1250d4d07
SHA51264076c815a4509c7b9ecd6c789470d0ee7c49034f71a61cf6f61c4796b04c7a213562dfb32c1a30eff0a0a087dc2bd52070c69a8ce88d2816eb2e80c566f37b5
-
Filesize
574KB
MD5b6ae1db2233568d6571fe949125b0bab
SHA1e75eb96b5d30014a83e9dde43334d4b78494a3e3
SHA256fbc65fe373c16600ac9becea7158b1e73fb49047b8922feee8f9b1f1250d4d07
SHA51264076c815a4509c7b9ecd6c789470d0ee7c49034f71a61cf6f61c4796b04c7a213562dfb32c1a30eff0a0a087dc2bd52070c69a8ce88d2816eb2e80c566f37b5
-
Filesize
574KB
MD5b6ae1db2233568d6571fe949125b0bab
SHA1e75eb96b5d30014a83e9dde43334d4b78494a3e3
SHA256fbc65fe373c16600ac9becea7158b1e73fb49047b8922feee8f9b1f1250d4d07
SHA51264076c815a4509c7b9ecd6c789470d0ee7c49034f71a61cf6f61c4796b04c7a213562dfb32c1a30eff0a0a087dc2bd52070c69a8ce88d2816eb2e80c566f37b5
-
Filesize
411KB
MD5bc83108b18756547013ed443b8cdb31b
SHA179bcaad3714433e01c7f153b05b781f8d7cb318d
SHA256b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
SHA5126e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
4.2MB
MD5493fc0f59054a6f4f3775655fb55295c
SHA12afe4f5eb626fb5c5aa5bb6c2bc61c88e37cf42f
SHA256cac58c98f7e587ba1b2a4f41874764b59bdf6cb684a4a44aee93f91b3b9a019b
SHA5129da41078a65a6b8c731388ccf4ce2a988705305f29f0841039b96cd2649f82e8ea219f082de184826e39f0edaa4a1d9aff2e60ebb8d27771222d0c7cb165598d
-
Filesize
4.2MB
MD5493fc0f59054a6f4f3775655fb55295c
SHA12afe4f5eb626fb5c5aa5bb6c2bc61c88e37cf42f
SHA256cac58c98f7e587ba1b2a4f41874764b59bdf6cb684a4a44aee93f91b3b9a019b
SHA5129da41078a65a6b8c731388ccf4ce2a988705305f29f0841039b96cd2649f82e8ea219f082de184826e39f0edaa4a1d9aff2e60ebb8d27771222d0c7cb165598d
-
Filesize
411KB
MD5bc83108b18756547013ed443b8cdb31b
SHA179bcaad3714433e01c7f153b05b781f8d7cb318d
SHA256b2ad109c15eaa92079582787b7772ba0a2f034f7d075907ff87028df0eaea671
SHA5126e72b2d40e47567b3e506be474dafa7cacd0b53cd2c2d160c3b5384f2f461fc91bb5fdb614a351f628d4e516b3bbdabc2cc6d4cb4710970146d2938a687dd011
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
755KB
MD50e37fbfa79d349d672456923ec5fbbe3
SHA14e880fc7625ccf8d9ca799d5b94ce2b1e7597335
SHA2568793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18
SHA5122bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630
-
Filesize
2.5MB
MD54dd95bdea5d7f374b64b81d7fd5121a5
SHA119915c376b37662184e55422040e20f4121f3f7f
SHA2567aff0c5d9017ecea08f9a9b169f5e50551d4a8aac0681c9c49a251e1339c8bce
SHA512055d72412132421b21eb30e4da3463209cf6b1aad3f51aa9966a584e677e3e13cfbe993eeb9f79959e6c8a9529c9940cb379308e931374f1f950372956be6deb
-
Filesize
345B
MD520392dd491583ea5b8e676336d65b5bc
SHA16746fd0856cce70fb5df8c4bcda1b87004610b63
SHA25681d1add43d768cc45aeb4f2cf67370bff113dcd9d712269587fcb99cc9679130
SHA51286ff8c96038125957e4ed3b41e775d3a467d64dc32f6712a78ff3c3541de343e12e620407cf73a032b389efb82072853bec3cb5d60e9074b3cb428272cd82ec5
-
Filesize
36B
MD5989a825ecaa519865ea39c9c2591e42e
SHA1774a0f4425d0c00423d499270fe372ea5167b0bd
SHA2563be0afa28ced01a026e5e84b99afd332a808da3ab079448f8ffe6ee3ab4a042b
SHA512b8e5750c7b07fe81d7f35d40b0ca11825b1270c65adccddf93b2e02172eaf77c20a34635a405cb6aa6ebbb460ee2d95b56d75ce0cfc334649db1b7a89a5af328
-
Filesize
2.5MB
MD54dd95bdea5d7f374b64b81d7fd5121a5
SHA119915c376b37662184e55422040e20f4121f3f7f
SHA2567aff0c5d9017ecea08f9a9b169f5e50551d4a8aac0681c9c49a251e1339c8bce
SHA512055d72412132421b21eb30e4da3463209cf6b1aad3f51aa9966a584e677e3e13cfbe993eeb9f79959e6c8a9529c9940cb379308e931374f1f950372956be6deb
-
Filesize
2.5MB
MD54dd95bdea5d7f374b64b81d7fd5121a5
SHA119915c376b37662184e55422040e20f4121f3f7f
SHA2567aff0c5d9017ecea08f9a9b169f5e50551d4a8aac0681c9c49a251e1339c8bce
SHA512055d72412132421b21eb30e4da3463209cf6b1aad3f51aa9966a584e677e3e13cfbe993eeb9f79959e6c8a9529c9940cb379308e931374f1f950372956be6deb
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
4KB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
2.5MB
-
Filesize
4KB