Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/03/2024, 13:41
240322-qzd8jaed3s 828/12/2023, 08:18
231228-j7d46scdd9 813/12/2023, 16:39
231213-t55t8aggb9 813/11/2023, 18:53
231113-xjvznsee5s 820/10/2023, 12:54
231020-p49dssch35 818/10/2023, 12:57
231018-p6wwgsga73 814/10/2023, 13:18
231014-qkc2xsef2w 813/10/2023, 08:25
231013-kbcf5sfh5w 811/10/2023, 09:32
231011-lhkxjadh3v 811/10/2023, 09:28
231011-lfb7lsfg37 7Analysis
-
max time kernel
156s -
max time network
175s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 09:28
Static task
static1
Behavioral task
behavioral1
Sample
avast_secure_browser_setup.exe
Resource
win10v2004-20230915-en
General
-
Target
avast_secure_browser_setup.exe
-
Size
5.8MB
-
MD5
3ad1c03d333da86a47884f01b8ae7664
-
SHA1
9feb944a823a0374f6db7bfd5abf78b494e49782
-
SHA256
4b6cc676769de04acf4936a5a395349cb779616c0621c5921bf07c3e405b51ee
-
SHA512
121c6bd0150ecde57e379a62a19583c1412cd6f411ef46533a3d3241c59613905e56ae58943bc685ba7f892bbf37018ec34d3e6f6fdb36efd39220b2db60cb1f
-
SSDEEP
98304:R8PxEloFJNcSmf0UH/Z10hTSYPHnyJLhNr1/K9O6oTCA+iGGps74a4:RSvFJyBsucZ74hNxKDiG/4a
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion aj75D5.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion aj75D5.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation aj75D5.exe Key value queried \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\Control Panel\International\Geo\Nation avast_secure_browser_setup.exe -
Executes dropped EXE 1 IoCs
pid Process 4112 aj75D5.exe -
Loads dropped DLL 14 IoCs
pid Process 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 4112 aj75D5.exe 4112 aj75D5.exe 4112 aj75D5.exe 4112 aj75D5.exe 4112 aj75D5.exe 4112 aj75D5.exe 4112 aj75D5.exe 4112 aj75D5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks for any installed AV software in registry 1 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast aj75D5.exe Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\AVAST Software\Avast aj75D5.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avast_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-1574508946-349927670-1185736483-1000\SOFTWARE\AVAST Software\Avast avast_secure_browser_setup.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 aj75D5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 2 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj75D5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj75D5.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe 3640 avast_secure_browser_setup.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3640 avast_secure_browser_setup.exe 4112 aj75D5.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3640 wrote to memory of 4112 3640 avast_secure_browser_setup.exe 102 PID 3640 wrote to memory of 4112 3640 avast_secure_browser_setup.exe 102 PID 3640 wrote to memory of 4112 3640 avast_secure_browser_setup.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\avast_secure_browser_setup.exe"C:\Users\Admin\AppData\Local\Temp\avast_secure_browser_setup.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks for any installed AV software in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\aj75D5.exe"C:\Users\Admin\AppData\Local\Temp\aj75D5.exe" /relaunch=8 /was_elevated=1 /tagdata2⤵
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:4112
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.8MB
MD51deb81b483e500b96aabc4c8761e642e
SHA1389a03ce92bd5869f24caccae43855331b4a9800
SHA2567a48d929d17de49160db68b3be58aba7d354f73f7292125adbb024bcd65d82c5
SHA512703eb1e3cad9349e1772d552b30e69ce07b3fb80b78311c0f698a79ca7cfb04d424bda1b722f4d8c586d9862ed56e1c2b99cd2d7df64509d3d66d1862e9ed936
-
Filesize
5.8MB
MD51deb81b483e500b96aabc4c8761e642e
SHA1389a03ce92bd5869f24caccae43855331b4a9800
SHA2567a48d929d17de49160db68b3be58aba7d354f73f7292125adbb024bcd65d82c5
SHA512703eb1e3cad9349e1772d552b30e69ce07b3fb80b78311c0f698a79ca7cfb04d424bda1b722f4d8c586d9862ed56e1c2b99cd2d7df64509d3d66d1862e9ed936
-
Filesize
44B
MD52ec65a257499e518b624e07fa5a6bec7
SHA16fda961264c69d30c1db21e72d07c4cc7c73ffb5
SHA256fac1758f6f77b68e6590cb530c84091c308b96475118bf9c0f9d9aead73f7d7d
SHA512b56cd3ba7c5a16fa736c2b746854024fd18b83ef64be3b9aa2a1c1b370e33837d44d9373522ea8f465a6e46c522ae589cd936d74151abda577749e982841a734
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
2.1MB
MD504091b9dc274a8aeceaa250d9d5aed4e
SHA139a8988a05b866ec3505be1650e521d2b3e71c1b
SHA256dd54abccddbfdf9ad318f2434ea61fe16c446b0e0eb1b86f6f06124c6e3708eb
SHA5127b2fc948b84d71f39b124690eb9fc4110d49b9750874171be634f39b747613e3380d4ff3968dae26eac127b66838f09781f8716549cc74046a36f9c8c5e8008b
-
Filesize
2.1MB
MD504091b9dc274a8aeceaa250d9d5aed4e
SHA139a8988a05b866ec3505be1650e521d2b3e71c1b
SHA256dd54abccddbfdf9ad318f2434ea61fe16c446b0e0eb1b86f6f06124c6e3708eb
SHA5127b2fc948b84d71f39b124690eb9fc4110d49b9750874171be634f39b747613e3380d4ff3968dae26eac127b66838f09781f8716549cc74046a36f9c8c5e8008b
-
Filesize
126KB
MD526ae155bc699bb8d535006d9889366ec
SHA147990e176505ba8fe8c9aa43018c71ce84702ed8
SHA2567fd5d84381997482870359c50f43eeb52228ae3f75311405c6e80fb79203aea9
SHA51203a21e68b8c5d5e2206bcd4b2795b6fabda9b6bafe5339f213dcfe7297a557cde93b85321f0fdc7b14fb7c602b71d8e0673c326994a43e72e6cab532843a7161
-
Filesize
126KB
MD526ae155bc699bb8d535006d9889366ec
SHA147990e176505ba8fe8c9aa43018c71ce84702ed8
SHA2567fd5d84381997482870359c50f43eeb52228ae3f75311405c6e80fb79203aea9
SHA51203a21e68b8c5d5e2206bcd4b2795b6fabda9b6bafe5339f213dcfe7297a557cde93b85321f0fdc7b14fb7c602b71d8e0673c326994a43e72e6cab532843a7161
-
Filesize
126KB
MD526ae155bc699bb8d535006d9889366ec
SHA147990e176505ba8fe8c9aa43018c71ce84702ed8
SHA2567fd5d84381997482870359c50f43eeb52228ae3f75311405c6e80fb79203aea9
SHA51203a21e68b8c5d5e2206bcd4b2795b6fabda9b6bafe5339f213dcfe7297a557cde93b85321f0fdc7b14fb7c602b71d8e0673c326994a43e72e6cab532843a7161
-
Filesize
195KB
MD5f6e528af6e8b1e819c5c9f8138d38098
SHA1f4e3e035648be7711aade5d1ae594d1069efd816
SHA256e0922e33fdbc433e36fa069791b6ced6e8d3177544b1331bd0e181ad600c628e
SHA512389bed7716d725f598a85f5e8a3806a351c40992dd5ed9bc1c4e4450b150d0d74f28df61d7cb0cbf6ebf681f49a454f9b04aec86a88fac9b7a33e6cdf964bb48
-
Filesize
195KB
MD5f6e528af6e8b1e819c5c9f8138d38098
SHA1f4e3e035648be7711aade5d1ae594d1069efd816
SHA256e0922e33fdbc433e36fa069791b6ced6e8d3177544b1331bd0e181ad600c628e
SHA512389bed7716d725f598a85f5e8a3806a351c40992dd5ed9bc1c4e4450b150d0d74f28df61d7cb0cbf6ebf681f49a454f9b04aec86a88fac9b7a33e6cdf964bb48
-
Filesize
127KB
MD56b740d7060e09cfee3523704436ba00f
SHA1f369460d22992b8a468f08fc19f208de52e2cb18
SHA25665c041a218bf05cfe824ebc155b4bf5749b3a2eca84be5e8f092927f09152b1b
SHA5122c0cf9c8470d70a381c8ee0c09c81a6a643123c8bd96a5b32eaabf368d347cbd2eb771488a7ea150bd817b8fd2cc5b8ac84dd81830e5e6e31b9f01bc4ae50486
-
Filesize
127KB
MD56b740d7060e09cfee3523704436ba00f
SHA1f369460d22992b8a468f08fc19f208de52e2cb18
SHA25665c041a218bf05cfe824ebc155b4bf5749b3a2eca84be5e8f092927f09152b1b
SHA5122c0cf9c8470d70a381c8ee0c09c81a6a643123c8bd96a5b32eaabf368d347cbd2eb771488a7ea150bd817b8fd2cc5b8ac84dd81830e5e6e31b9f01bc4ae50486
-
Filesize
36KB
MD50acda819bacbed7d368f036847960ae3
SHA18a4367182e41076e28870ef60efa8630ecdf846c
SHA2562508170aa8ed183c2dba984cb22c0d622359963b4ee0099c734875b862b17800
SHA512d501737aa62fae54552f382ab87e749ef9f3bc1349fd0945fa3eca9ebbcd6c690961a5f764aafe994f396bc303fa44d9670969b84810fa5fcadd1a20a469d321
-
Filesize
36KB
MD50acda819bacbed7d368f036847960ae3
SHA18a4367182e41076e28870ef60efa8630ecdf846c
SHA2562508170aa8ed183c2dba984cb22c0d622359963b4ee0099c734875b862b17800
SHA512d501737aa62fae54552f382ab87e749ef9f3bc1349fd0945fa3eca9ebbcd6c690961a5f764aafe994f396bc303fa44d9670969b84810fa5fcadd1a20a469d321
-
Filesize
93KB
MD53f2dd5b3899d0abf2ed4e7749d85900a
SHA1682f8f786422a25ab5f525fb1d30928ab3f094c7
SHA2566d81bd6f69d6005d0ebeea74ff185842dfd1df5ec1c84304370b88bde38da497
SHA5123474a8e6d9550dff4b75af772248b2f48a95820554d10f27ac9dbc9178c659d8f7fde4ecfec26f648d5a93bdac3ec838b8ff581fb65f36d5b9e2475b16f659c1
-
Filesize
93KB
MD53f2dd5b3899d0abf2ed4e7749d85900a
SHA1682f8f786422a25ab5f525fb1d30928ab3f094c7
SHA2566d81bd6f69d6005d0ebeea74ff185842dfd1df5ec1c84304370b88bde38da497
SHA5123474a8e6d9550dff4b75af772248b2f48a95820554d10f27ac9dbc9178c659d8f7fde4ecfec26f648d5a93bdac3ec838b8ff581fb65f36d5b9e2475b16f659c1
-
Filesize
2.1MB
MD504091b9dc274a8aeceaa250d9d5aed4e
SHA139a8988a05b866ec3505be1650e521d2b3e71c1b
SHA256dd54abccddbfdf9ad318f2434ea61fe16c446b0e0eb1b86f6f06124c6e3708eb
SHA5127b2fc948b84d71f39b124690eb9fc4110d49b9750874171be634f39b747613e3380d4ff3968dae26eac127b66838f09781f8716549cc74046a36f9c8c5e8008b
-
Filesize
195KB
MD5f6e528af6e8b1e819c5c9f8138d38098
SHA1f4e3e035648be7711aade5d1ae594d1069efd816
SHA256e0922e33fdbc433e36fa069791b6ced6e8d3177544b1331bd0e181ad600c628e
SHA512389bed7716d725f598a85f5e8a3806a351c40992dd5ed9bc1c4e4450b150d0d74f28df61d7cb0cbf6ebf681f49a454f9b04aec86a88fac9b7a33e6cdf964bb48
-
Filesize
127KB
MD56b740d7060e09cfee3523704436ba00f
SHA1f369460d22992b8a468f08fc19f208de52e2cb18
SHA25665c041a218bf05cfe824ebc155b4bf5749b3a2eca84be5e8f092927f09152b1b
SHA5122c0cf9c8470d70a381c8ee0c09c81a6a643123c8bd96a5b32eaabf368d347cbd2eb771488a7ea150bd817b8fd2cc5b8ac84dd81830e5e6e31b9f01bc4ae50486
-
Filesize
36KB
MD50acda819bacbed7d368f036847960ae3
SHA18a4367182e41076e28870ef60efa8630ecdf846c
SHA2562508170aa8ed183c2dba984cb22c0d622359963b4ee0099c734875b862b17800
SHA512d501737aa62fae54552f382ab87e749ef9f3bc1349fd0945fa3eca9ebbcd6c690961a5f764aafe994f396bc303fa44d9670969b84810fa5fcadd1a20a469d321
-
Filesize
93KB
MD53f2dd5b3899d0abf2ed4e7749d85900a
SHA1682f8f786422a25ab5f525fb1d30928ab3f094c7
SHA2566d81bd6f69d6005d0ebeea74ff185842dfd1df5ec1c84304370b88bde38da497
SHA5123474a8e6d9550dff4b75af772248b2f48a95820554d10f27ac9dbc9178c659d8f7fde4ecfec26f648d5a93bdac3ec838b8ff581fb65f36d5b9e2475b16f659c1
-
Filesize
5.7MB
MD5f36f05628b515262db197b15c7065b40
SHA174a8005379f26dd0de952acab4e3fc5459cde243
SHA25667abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31
SHA512280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8
-
Filesize
5.7MB
MD5f36f05628b515262db197b15c7065b40
SHA174a8005379f26dd0de952acab4e3fc5459cde243
SHA25667abd9e211b354fa222e7926c2876c4b3a7aca239c0af47c756ee1b6db6e6d31
SHA512280390b1cf1b6b1e75eaa157adaf89135963d366b48686d48921a654527f9c1505c195ca1fc16dc85b8f13b2994841ca7877a63af708883418a1d588afa3dbe8