Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
204s -
max time network
199s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20231023-en
General
-
Target
setup.exe
-
Size
3.4MB
-
MD5
2b7d84ac6ac4bf01b47495cfde554f10
-
SHA1
c585c2205270d5871f1a88b738fd31bdacddd4d6
-
SHA256
4901c1e0321024a1d7b42be8eaae3da45a9cd8f3c33a32ef1dc4402340728b23
-
SHA512
ac787509ef8b57aca3671045e332f02e56e8371e21685f819a61fa19937b90e33a8bd16ae748cf6b09789def747ed917bb9e26e28fdc9a067ee614869608d51e
-
SSDEEP
98304:5cwg7hhj02coKAHqxa98G84hCrxwbInkp6qxZZLFtotexd:SwgFhkAHq4FCrjng1r9Fto2
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1652 setup.tmp -
Loads dropped DLL 10 IoCs
pid Process 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp 1652 setup.tmp -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1652 setup.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 552 wrote to memory of 1652 552 setup.exe 90 PID 552 wrote to memory of 1652 552 setup.exe 90 PID 552 wrote to memory of 1652 552 setup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\is-7SMCO.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-7SMCO.tmp\setup.tmp" /SL5="$5021A,2671298,437760,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1652
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD58b76ba3243d3c91698f3ea5121cf9c3a
SHA1e7fb06c76a6567a91d59a6d2102f2349421df0b5
SHA256c1075e1556820049b6bd4f1145364cfa6550883540f2e616c69c016c77af0a92
SHA512d2c037d9704be4ec1d661e45260d7b9b9f95e2dc5b818441e8e53d7ce5b3fcf0f1f83a8763509932d487b4401a4f1ecfbe1a6312b273ba3418bfe1ce1e5c6ff6
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
452KB
MD54feafa8b5e8cdb349125c8af0ac43974
SHA17f17e5e1b088fc73690888b215962fbcd395c9bd
SHA256bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71
SHA512d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc
-
Filesize
46KB
MD5dae5ed5f828c64e0a2adc0a98a08ca46
SHA15edb2b599e174eeb4bf64da8cbbc8a2950551fec
SHA25689ff2808ec92b072f347c10d30d1cde0441925ee626d0c192ec4ba86f0e8398e
SHA51201db144904f413f170dc699f99f686c09d471406f73d1b423896201c7eb0e84afabbbb7386827db4bdd67ed393297ec774947654c6de20c8c1a43d4d0c466442
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
385KB
MD592c2e247392e0e02261dea67e1bb1a5e
SHA1db72fed8771364bf8039b2bc83ed01dda2908554
SHA25625fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68
SHA512e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5
-
Filesize
641KB
MD55433529438821bd90f0e7e4bffc77590
SHA161d22a89f746ed85dd8f134fb0e88bd8cff64d80
SHA25621c9303153eb253e08aaa62393a24be8ce20e396d2575e9c3f442a97c413665f
SHA512d6ed131d02644ca54ca16af8c1929381774d4c7baa0be076a6d7f356fc7aad1b3de93fb16bb4b0e7ca07cf38e9a81411b278ad4891978dd62c4d6f89d6263df8
-
Filesize
641KB
MD55433529438821bd90f0e7e4bffc77590
SHA161d22a89f746ed85dd8f134fb0e88bd8cff64d80
SHA25621c9303153eb253e08aaa62393a24be8ce20e396d2575e9c3f442a97c413665f
SHA512d6ed131d02644ca54ca16af8c1929381774d4c7baa0be076a6d7f356fc7aad1b3de93fb16bb4b0e7ca07cf38e9a81411b278ad4891978dd62c4d6f89d6263df8