Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
30/10/2023, 23:45
Static task
static1
Behavioral task
behavioral1
Sample
cloudinstaller.exe
Resource
win7-20231025-en
Behavioral task
behavioral2
Sample
cloudinstaller.exe
Resource
win10v2004-20231023-en
General
-
Target
cloudinstaller.exe
-
Size
148.1MB
-
MD5
f5d600a7d609db799b6cf7f73b16a6ef
-
SHA1
86bff7148ff31d9de41aa0522a81b0b35e0bec3c
-
SHA256
908d936dfcaead65c4e67d93d3e5d9f28ef4637c822132c1d8ee865dff9ff147
-
SHA512
fdccace34dcc165811c3ae1fcac47606c26b67a0ad667d35deddb448ee65a4ae24c94159244e84f48f66c17c887a998ac4818e1d74b7003b59c890d4aa52ea5e
-
SSDEEP
786432:2pz24RRx7jChNQNt/ZYLy/pGyjpy5l7y953zQ3TtLwSTRpf4P1wT1XKTTmBEA/R:2Z2ExfWNQNt/ZLq+jRuBd
Malware Config
Signatures
-
Loads dropped DLL 3 IoCs
pid Process 2124 cloudinstaller.exe 2124 cloudinstaller.exe 2124 cloudinstaller.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2124 cloudinstaller.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2124 wrote to memory of 304 2124 cloudinstaller.exe 30 PID 2124 wrote to memory of 304 2124 cloudinstaller.exe 30 PID 2124 wrote to memory of 304 2124 cloudinstaller.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\cloudinstaller.exe"C:\Users\Admin\AppData\Local\Temp\cloudinstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2124 -s 15402⤵PID:304
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\.net\cloudinstaller\G1j7YMNsR8bHIjgrpIl7f66GN+OXfZ4=\D3DCompiler_47_cor3.dll
Filesize4.7MB
MD5ca68272d2c97f1e145f50b8cd1edf3a6
SHA183097400436f111c13ee34740e66b3de0542914b
SHA256ff5dddae92b3798cc00c14a706ecb6329c27aa6d7bb6e82b393cf8b7366458ba
SHA512ffc670aea4dad0113196d594c0fd07a838123e485ffebe3b728b8a18403b0bb82b042ccf23019c850a62466990b10a2e94102178326df735e4815dba7811d502
-
\Users\Admin\AppData\Local\Temp\.net\cloudinstaller\G1j7YMNsR8bHIjgrpIl7f66GN+OXfZ4=\PresentationNative_cor3.dll
Filesize1.2MB
MD55a137f1c0db458b0e5bb642f5293d3e6
SHA16f66bf8ad1a930c7021a95025b81af6169508a08
SHA256334a78b0e495b25b9b828216c4613a8a169129c583245da3c3b2b923d4e4c39b
SHA512d645f9c57523296923e2753202dbcd2a09f75bf46ac9a5a5525182d1d90b6f2fb078789150f4aeeafca8717098670780cbdb1e81fdb7fdd32d5ad791a2cafc79
-
\Users\Admin\AppData\Local\Temp\.net\cloudinstaller\G1j7YMNsR8bHIjgrpIl7f66GN+OXfZ4=\wpfgfx_cor3.dll
Filesize1.9MB
MD5c8af68f307e0868e673d6e69924b3b81
SHA1fbf565bdc0c1fe97b57690e3be751452d7e2fc56
SHA25623db27f5a6d7b9993f3d5179e4021913cd977d810fbfd8c482f601aee9759e47
SHA512cb4d21179504de09c62629a7b4cb23d4b771f477bf888927896abb143214451c4ad6210f2586a4e442b68eb39b9af7f42c916931849dd650044152ce7bf25720