Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
5Static
static
3MpGear.dll
windows7-x64
1MpGear.dll
windows10-2004-x64
1Setup.exe
windows7-x64
Setup.exe
windows10-2004-x64
5VBoxDDU.dll
windows7-x64
VBoxDDU.dll
windows10-2004-x64
1en-US/Auto...eN.dll
windows7-x64
1en-US/Auto...eN.dll
windows10-2004-x64
1en-US/avicap32.dll
windows7-x64
1en-US/avicap32.dll
windows10-2004-x64
1engine/engine.js
windows7-x64
1engine/engine.js
windows10-2004-x64
1engine/mod...are.js
windows7-x64
1engine/mod...are.js
windows10-2004-x64
1engine/mod...ion.js
windows7-x64
1engine/mod...ion.js
windows10-2004-x64
engine/mod...fig.js
windows7-x64
1engine/mod...fig.js
windows10-2004-x64
1engine/mod...mer.js
windows7-x64
1engine/mod...mer.js
windows10-2004-x64
1engine/mod...ile.js
windows7-x64
1engine/mod...ile.js
windows10-2004-x64
1engine/mod.../cn.js
windows7-x64
1engine/mod.../cn.js
windows10-2004-x64
1engine/mod.../en.js
windows7-x64
1engine/mod.../en.js
windows10-2004-x64
1engine/mod.../jp.js
windows7-x64
1engine/mod.../jp.js
windows10-2004-x64
engine/mod...-BR.js
windows7-x64
1engine/mod...-BR.js
windows10-2004-x64
1engine/mod.../tc.js
windows7-x64
engine/mod.../tc.js
windows10-2004-x64
1Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 10:11
Static task
static1
Behavioral task
behavioral1
Sample
MpGear.dll
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
MpGear.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
Setup.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
Setup.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
VBoxDDU.dll
Resource
win7-20230831-en
Behavioral task
behavioral6
Sample
VBoxDDU.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral7
Sample
en-US/AutoWorkplaceN.dll
Resource
win7-20230831-en
Behavioral task
behavioral8
Sample
en-US/AutoWorkplaceN.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral9
Sample
en-US/avicap32.dll
Resource
win7-20230831-en
Behavioral task
behavioral10
Sample
en-US/avicap32.dll
Resource
win10v2004-20230915-en
Behavioral task
behavioral11
Sample
engine/engine.js
Resource
win7-20230831-en
Behavioral task
behavioral12
Sample
engine/engine.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral13
Sample
engine/modules/auth/middleware.js
Resource
win7-20230831-en
Behavioral task
behavioral14
Sample
engine/modules/auth/middleware.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral15
Sample
engine/modules/collection/collection.js
Resource
win7-20230831-en
Behavioral task
behavioral16
Sample
engine/modules/collection/collection.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral17
Sample
engine/modules/config/config.js
Resource
win7-20230831-en
Behavioral task
behavioral18
Sample
engine/modules/config/config.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral19
Sample
engine/modules/db/performer.js
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
engine/modules/db/performer.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
engine/modules/file/file.js
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
engine/modules/file/file.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
engine/modules/language/cn.js
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
engine/modules/language/cn.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
engine/modules/language/en.js
Resource
win7-20230831-en
Behavioral task
behavioral26
Sample
engine/modules/language/en.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral27
Sample
engine/modules/language/jp.js
Resource
win7-20230831-en
Behavioral task
behavioral28
Sample
engine/modules/language/jp.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral29
Sample
engine/modules/language/pt-BR.js
Resource
win7-20230831-en
Behavioral task
behavioral30
Sample
engine/modules/language/pt-BR.js
Resource
win10v2004-20230915-en
Behavioral task
behavioral31
Sample
engine/modules/language/tc.js
Resource
win7-20230831-en
Behavioral task
behavioral32
Sample
engine/modules/language/tc.js
Resource
win10v2004-20230915-en
General
-
Target
Setup.exe
-
Size
1.6MB
-
MD5
8f0717916432e1e4f3313c8ebde55210
-
SHA1
41456cd9c3b66cfb22f9bbeefb6750cce516bf3a
-
SHA256
8dc4d5deef19fb4da195c270819a6ee283b67408fc9ee187216a0ce80ee61bab
-
SHA512
d1c4696541ec1d8d44e820902828bfbbd16afbb9c4a251080fc62262fbf879b268ed0fff80ea84aacdc58f424c516a979bb8fa82f0dfe920d71cad92f17bcfee
-
SSDEEP
12288:N2EDigMo6E50Hmy00qEEmxnA7ECCXuiAK6xXHDJBIMQV2:bFaky0wEmxAQCCXuiA3XH8N2
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 312 set thread context of 3480 312 Setup.exe 87 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 312 Setup.exe 3480 cmd.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 312 Setup.exe 3480 cmd.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 312 wrote to memory of 3480 312 Setup.exe 87 PID 312 wrote to memory of 3480 312 Setup.exe 87 PID 312 wrote to memory of 3480 312 Setup.exe 87 PID 312 wrote to memory of 3480 312 Setup.exe 87 PID 3480 wrote to memory of 4856 3480 cmd.exe 103 PID 3480 wrote to memory of 4856 3480 cmd.exe 103 PID 3480 wrote to memory of 4856 3480 cmd.exe 103 PID 3480 wrote to memory of 4856 3480 cmd.exe 103 PID 3480 wrote to memory of 4856 3480 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:312 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵PID:4856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1008KB
MD580069a82d6545e6202c504ab002179bf
SHA1c56f68179ae6d0abb6389ec157bc9c7dd1807947
SHA2567288cd9212609a0f4fc4067eddf00592d3e109893ac483befdcc690d221d7c1f
SHA512f7638c9c3cca68bbf3d3fd9652090e5bfa8b1d4cdc974e9a4dc81a7157790ab56e4b882c4cb5f3ce4671e2f13f2db29eae8c38c6f25d1925d066d51e0d5f7162