Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
14/10/2023, 19:08
231014-xtafqagd67 914/10/2023, 09:34
231014-ljwenabg2t 707/10/2023, 01:02
231007-bdzvsagf4z 9Analysis
-
max time kernel
320s -
max time network
373s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 09:34
Static task
static1
Behavioral task
behavioral1
Sample
SephioneInstallerx64.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SephioneInstallerx64.exe
Resource
win10-20230915-en
Behavioral task
behavioral3
Sample
SephioneInstallerx64.exe
Resource
win10v2004-20230915-en
General
-
Target
SephioneInstallerx64.exe
-
Size
67.6MB
-
MD5
742066e6d7103fa65e2af4db9063db3d
-
SHA1
3fe605e0a6260d4442e7b67663624cd6b4525636
-
SHA256
2cd9a6de7cabf360187ad8fc4163e10be7bcf4bbd768f8db635cc57438385352
-
SHA512
a9f7cab452cd1106884150e4d494fa684dda9931e2d448559158de979d8b134cf83f3603e9e0bf0a41b72e16bece6a421645b0d01a31375f4a91d7c1196e965f
-
SSDEEP
1572864:jhF1s9gK1YPHnrgsOu/Yy/KAtkui9bTBBfTzy4:jhF1s6oXyyAtviRPy4
Malware Config
Signatures
-
Loads dropped DLL 5 IoCs
pid Process 2152 SephioneInstallerx64.exe 2152 SephioneInstallerx64.exe 2152 SephioneInstallerx64.exe 2152 SephioneInstallerx64.exe 2152 SephioneInstallerx64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3728 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2152 SephioneInstallerx64.exe 2152 SephioneInstallerx64.exe 3728 tasklist.exe 3728 tasklist.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3728 tasklist.exe Token: SeSecurityPrivilege 2152 SephioneInstallerx64.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2152 wrote to memory of 3748 2152 SephioneInstallerx64.exe 92 PID 2152 wrote to memory of 3748 2152 SephioneInstallerx64.exe 92 PID 2152 wrote to memory of 3748 2152 SephioneInstallerx64.exe 92 PID 3748 wrote to memory of 3728 3748 cmd.exe 94 PID 3748 wrote to memory of 3728 3748 cmd.exe 94 PID 3748 wrote to memory of 3728 3748 cmd.exe 94 PID 3748 wrote to memory of 4988 3748 cmd.exe 95 PID 3748 wrote to memory of 4988 3748 cmd.exe 95 PID 3748 wrote to memory of 4988 3748 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\SephioneInstallerx64.exe"C:\Users\Admin\AppData\Local\Temp\SephioneInstallerx64.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\cmd.execmd /c tasklist /FI "USERNAME eq %USERNAME%" /FI "IMAGENAME eq Setup_.exe" | %SYSTEMROOT%\System32\find.exe "Setup_.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3748 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "USERNAME eq Admin" /FI "IMAGENAME eq Setup_.exe"3⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Windows\SysWOW64\find.exeC:\Windows\System32\find.exe "Setup_.exe"3⤵PID:4988
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
9KB
MD517309e33b596ba3a5693b4d3e85cf8d7
SHA17d361836cf53df42021c7f2b148aec9458818c01
SHA256996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
SHA5121abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
-
Filesize
100KB
MD5c6a6e03f77c313b267498515488c5740
SHA13d49fc2784b9450962ed6b82b46e9c3c957d7c15
SHA256b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
SHA5129870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
-
Filesize
12KB
MD50d7ad4f45dc6f5aa87f606d0331c6901
SHA148df0911f0484cbe2a8cdd5362140b63c41ee457
SHA2563eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
SHA512c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
-
Filesize
6KB
MD5ec0504e6b8a11d5aad43b296beeb84b2
SHA191b5ce085130c8c7194d66b2439ec9e1c206497c
SHA2565d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
SHA5123f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
-
Filesize
424KB
MD580e44ce4895304c6a3a831310fbf8cd0
SHA136bd49ae21c460be5753a904b4501f1abca53508
SHA256b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
SHA512c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df