Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 10:11

General

  • Target

    Setup.exe

  • Size

    1.6MB

  • MD5

    8f0717916432e1e4f3313c8ebde55210

  • SHA1

    41456cd9c3b66cfb22f9bbeefb6750cce516bf3a

  • SHA256

    8dc4d5deef19fb4da195c270819a6ee283b67408fc9ee187216a0ce80ee61bab

  • SHA512

    d1c4696541ec1d8d44e820902828bfbbd16afbb9c4a251080fc62262fbf879b268ed0fff80ea84aacdc58f424c516a979bb8fa82f0dfe920d71cad92f17bcfee

  • SSDEEP

    12288:N2EDigMo6E50Hmy00qEEmxnA7ECCXuiAK6xXHDJBIMQV2:bFaky0wEmxAQCCXuiA3XH8N2

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:312
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\SysWOW64\cmd.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:3480
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        3⤵
          PID:4856

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\3a81a7d6

      Filesize

      1008KB

      MD5

      80069a82d6545e6202c504ab002179bf

      SHA1

      c56f68179ae6d0abb6389ec157bc9c7dd1807947

      SHA256

      7288cd9212609a0f4fc4067eddf00592d3e109893ac483befdcc690d221d7c1f

      SHA512

      f7638c9c3cca68bbf3d3fd9652090e5bfa8b1d4cdc974e9a4dc81a7157790ab56e4b882c4cb5f3ce4671e2f13f2db29eae8c38c6f25d1925d066d51e0d5f7162

    • memory/312-0-0x00007FF8D9D70000-0x00007FF8DB3E7000-memory.dmp

      Filesize

      22.5MB

    • memory/312-1-0x00007FF8D9D70000-0x00007FF8DB3E7000-memory.dmp

      Filesize

      22.5MB

    • memory/312-2-0x00007FF8D9D70000-0x00007FF8DB3E7000-memory.dmp

      Filesize

      22.5MB

    • memory/3480-5-0x00007FF8F93D0000-0x00007FF8F95C5000-memory.dmp

      Filesize

      2.0MB

    • memory/3480-7-0x00000000740A0000-0x00000000752F4000-memory.dmp

      Filesize

      18.3MB

    • memory/3480-8-0x00000000740A0000-0x00000000752F4000-memory.dmp

      Filesize

      18.3MB

    • memory/3480-12-0x00000000740A0000-0x00000000752F4000-memory.dmp

      Filesize

      18.3MB

    • memory/4856-13-0x0000000000D30000-0x0000000000DA8000-memory.dmp

      Filesize

      480KB

    • memory/4856-15-0x00007FF8F93D0000-0x00007FF8F95C5000-memory.dmp

      Filesize

      2.0MB

    • memory/4856-16-0x0000000000D30000-0x0000000000DA8000-memory.dmp

      Filesize

      480KB