Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
176s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
11/10/2023, 18:48
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20230915-en
General
-
Target
setup.exe
-
Size
880KB
-
MD5
43d3ff349ad31e0ad76201755445cb1e
-
SHA1
7b3b15c369203cf892fb0b023201c5627e23973a
-
SHA256
5c402fd8244e177338a2a8f0c7b8df055d5a06ebd7a5225edb3d3cdaf1d1c749
-
SHA512
771f98fcade1687c3714e6631d800ba8f186cc6de46ee36e52e78d04727f0bc7f9352d5f32788a315bd1dc5b84fabd585ea50c1bf32bbd7fc168b87a8a97d101
-
SSDEEP
24576:L20Bj512nz5ME9t+Fez6ovAJv9aGk3KgY7rmvZf5/I:L2Xzh/fvAJ4GkJECvTI
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2972 setup.tmp -
Loads dropped DLL 3 IoCs
pid Process 1080 setup.exe 2972 setup.tmp 2972 setup.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2972 setup.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2972 1080 setup.exe 27 PID 1080 wrote to memory of 2972 1080 setup.exe 27 PID 1080 wrote to memory of 2972 1080 setup.exe 27 PID 1080 wrote to memory of 2972 1080 setup.exe 27 PID 1080 wrote to memory of 2972 1080 setup.exe 27 PID 1080 wrote to memory of 2972 1080 setup.exe 27 PID 1080 wrote to memory of 2972 1080 setup.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\is-1UDPV.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-1UDPV.tmp\setup.tmp" /SL5="$9015A,660927,54272,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2972
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD5e60a74a65005e4c4f61cbe9c09d368df
SHA11d649b2ab5e08632d64e23f5f9e5675b68e184b4
SHA25678f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758
SHA512a73b84739f4da0827976cf473e63ba3dc7649ab2d37be13c8fb786487d0dc7ef5b2bd446d8c745d75266447357bde4f32f58f1f1c92b156f06f141fea2873856
-
Filesize
680KB
MD5e60a74a65005e4c4f61cbe9c09d368df
SHA11d649b2ab5e08632d64e23f5f9e5675b68e184b4
SHA25678f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758
SHA512a73b84739f4da0827976cf473e63ba3dc7649ab2d37be13c8fb786487d0dc7ef5b2bd446d8c745d75266447357bde4f32f58f1f1c92b156f06f141fea2873856
-
Filesize
680KB
MD5e60a74a65005e4c4f61cbe9c09d368df
SHA11d649b2ab5e08632d64e23f5f9e5675b68e184b4
SHA25678f6692d50d07bd78a97294d196f9ae7d1fc48b058375e5d7bb766970faab758
SHA512a73b84739f4da0827976cf473e63ba3dc7649ab2d37be13c8fb786487d0dc7ef5b2bd446d8c745d75266447357bde4f32f58f1f1c92b156f06f141fea2873856
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3