Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    204s
  • max time network
    199s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/11/2023, 12:09

General

  • Target

    setup.exe

  • Size

    3.4MB

  • MD5

    2b7d84ac6ac4bf01b47495cfde554f10

  • SHA1

    c585c2205270d5871f1a88b738fd31bdacddd4d6

  • SHA256

    4901c1e0321024a1d7b42be8eaae3da45a9cd8f3c33a32ef1dc4402340728b23

  • SHA512

    ac787509ef8b57aca3671045e332f02e56e8371e21685f819a61fa19937b90e33a8bd16ae748cf6b09789def747ed917bb9e26e28fdc9a067ee614869608d51e

  • SSDEEP

    98304:5cwg7hhj02coKAHqxa98G84hCrxwbInkp6qxZZLFtotexd:SwgFhkAHq4FCrjng1r9Fto2

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Users\Admin\AppData\Local\Temp\is-7SMCO.tmp\setup.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7SMCO.tmp\setup.tmp" /SL5="$5021A,2671298,437760,C:\Users\Admin\AppData\Local\Temp\setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-7SMCO.tmp\setup.tmp

    Filesize

    2.2MB

    MD5

    8b76ba3243d3c91698f3ea5121cf9c3a

    SHA1

    e7fb06c76a6567a91d59a6d2102f2349421df0b5

    SHA256

    c1075e1556820049b6bd4f1145364cfa6550883540f2e616c69c016c77af0a92

    SHA512

    d2c037d9704be4ec1d661e45260d7b9b9f95e2dc5b818441e8e53d7ce5b3fcf0f1f83a8763509932d487b4401a4f1ecfbe1a6312b273ba3418bfe1ce1e5c6ff6

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\CallbackCtrl.dll

    Filesize

    4KB

    MD5

    f07e819ba2e46a897cfabf816d7557b2

    SHA1

    8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

    SHA256

    68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

    SHA512

    7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\CallbackCtrl.dll

    Filesize

    4KB

    MD5

    f07e819ba2e46a897cfabf816d7557b2

    SHA1

    8d5fd0a741dd3fd84650e40dd3928ae1f15323cc

    SHA256

    68f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d

    SHA512

    7ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\ISDone.dll

    Filesize

    452KB

    MD5

    4feafa8b5e8cdb349125c8af0ac43974

    SHA1

    7f17e5e1b088fc73690888b215962fbcd395c9bd

    SHA256

    bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

    SHA512

    d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\ISDone.dll

    Filesize

    452KB

    MD5

    4feafa8b5e8cdb349125c8af0ac43974

    SHA1

    7f17e5e1b088fc73690888b215962fbcd395c9bd

    SHA256

    bb8a0245dcc5c10a1c7181bad509b65959855009a8105863ef14f2bb5b38ac71

    SHA512

    d63984ee385b4f1eba8e590d6de4f082fb0121689295ec6e496539209459152465f6db09e6d8f92eec996a89fc40432077cbfa807beb2de7f375154fef6554bc

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\b2p.dll

    Filesize

    46KB

    MD5

    dae5ed5f828c64e0a2adc0a98a08ca46

    SHA1

    5edb2b599e174eeb4bf64da8cbbc8a2950551fec

    SHA256

    89ff2808ec92b072f347c10d30d1cde0441925ee626d0c192ec4ba86f0e8398e

    SHA512

    01db144904f413f170dc699f99f686c09d471406f73d1b423896201c7eb0e84afabbbb7386827db4bdd67ed393297ec774947654c6de20c8c1a43d4d0c466442

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\botva2.dll

    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\botva2.dll

    Filesize

    37KB

    MD5

    67965a5957a61867d661f05ae1f4773e

    SHA1

    f14c0a4f154dc685bb7c65b2d804a02a0fb2360d

    SHA256

    450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105

    SHA512

    c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\isskin.dll

    Filesize

    385KB

    MD5

    92c2e247392e0e02261dea67e1bb1a5e

    SHA1

    db72fed8771364bf8039b2bc83ed01dda2908554

    SHA256

    25fdb94e386f8a41f10aba00ed092a91b878339f8e256a7252b11169122b0a68

    SHA512

    e938d2a1870ccb437d818b5301e6ecffaa6efbf4f0122e1a1ae0981057d7d0376039ea927c6fd326456da2d6904803fca26b87245367a4c5de2aebc47bdcd4b5

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\skin.tm

    Filesize

    641KB

    MD5

    5433529438821bd90f0e7e4bffc77590

    SHA1

    61d22a89f746ed85dd8f134fb0e88bd8cff64d80

    SHA256

    21c9303153eb253e08aaa62393a24be8ce20e396d2575e9c3f442a97c413665f

    SHA512

    d6ed131d02644ca54ca16af8c1929381774d4c7baa0be076a6d7f356fc7aad1b3de93fb16bb4b0e7ca07cf38e9a81411b278ad4891978dd62c4d6f89d6263df8

  • C:\Users\Admin\AppData\Local\Temp\is-QGR6U.tmp\skin.tm

    Filesize

    641KB

    MD5

    5433529438821bd90f0e7e4bffc77590

    SHA1

    61d22a89f746ed85dd8f134fb0e88bd8cff64d80

    SHA256

    21c9303153eb253e08aaa62393a24be8ce20e396d2575e9c3f442a97c413665f

    SHA512

    d6ed131d02644ca54ca16af8c1929381774d4c7baa0be076a6d7f356fc7aad1b3de93fb16bb4b0e7ca07cf38e9a81411b278ad4891978dd62c4d6f89d6263df8

  • memory/552-0-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/552-198-0x0000000000400000-0x0000000000475000-memory.dmp

    Filesize

    468KB

  • memory/1652-67-0x0000000076B40000-0x0000000076C1C000-memory.dmp

    Filesize

    880KB

  • memory/1652-73-0x0000000073FE0000-0x0000000074104000-memory.dmp

    Filesize

    1.1MB

  • memory/1652-43-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-45-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-46-0x0000000076CB0000-0x0000000076D2A000-memory.dmp

    Filesize

    488KB

  • memory/1652-48-0x0000000076CB0000-0x0000000076D2A000-memory.dmp

    Filesize

    488KB

  • memory/1652-47-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-49-0x0000000076730000-0x0000000076755000-memory.dmp

    Filesize

    148KB

  • memory/1652-50-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-51-0x0000000076CB0000-0x0000000076D2A000-memory.dmp

    Filesize

    488KB

  • memory/1652-52-0x0000000076730000-0x0000000076755000-memory.dmp

    Filesize

    148KB

  • memory/1652-53-0x0000000074170000-0x00000000741A0000-memory.dmp

    Filesize

    192KB

  • memory/1652-55-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-56-0x0000000076730000-0x0000000076755000-memory.dmp

    Filesize

    148KB

  • memory/1652-57-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-54-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-59-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-58-0x0000000073FE0000-0x0000000074104000-memory.dmp

    Filesize

    1.1MB

  • memory/1652-60-0x00000000765B0000-0x0000000076693000-memory.dmp

    Filesize

    908KB

  • memory/1652-61-0x0000000075B70000-0x0000000076123000-memory.dmp

    Filesize

    5.7MB

  • memory/1652-62-0x0000000076DF0000-0x0000000076E9F000-memory.dmp

    Filesize

    700KB

  • memory/1652-63-0x00000000746C0000-0x00000000748D0000-memory.dmp

    Filesize

    2.1MB

  • memory/1652-64-0x0000000073870000-0x00000000738F3000-memory.dmp

    Filesize

    524KB

  • memory/1652-65-0x00000000736F0000-0x0000000073859000-memory.dmp

    Filesize

    1.4MB

  • memory/1652-66-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-42-0x0000000076CB0000-0x0000000076D2A000-memory.dmp

    Filesize

    488KB

  • memory/1652-68-0x00000000765B0000-0x0000000076693000-memory.dmp

    Filesize

    908KB

  • memory/1652-69-0x0000000075B70000-0x0000000076123000-memory.dmp

    Filesize

    5.7MB

  • memory/1652-70-0x0000000076DF0000-0x0000000076E9F000-memory.dmp

    Filesize

    700KB

  • memory/1652-71-0x00000000746C0000-0x00000000748D0000-memory.dmp

    Filesize

    2.1MB

  • memory/1652-72-0x0000000074EB0000-0x0000000074F24000-memory.dmp

    Filesize

    464KB

  • memory/1652-44-0x0000000076CB0000-0x0000000076D2A000-memory.dmp

    Filesize

    488KB

  • memory/1652-74-0x00000000736F0000-0x0000000073859000-memory.dmp

    Filesize

    1.4MB

  • memory/1652-75-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-76-0x0000000075B70000-0x0000000076123000-memory.dmp

    Filesize

    5.7MB

  • memory/1652-77-0x0000000076DF0000-0x0000000076E9F000-memory.dmp

    Filesize

    700KB

  • memory/1652-78-0x00000000746C0000-0x00000000748D0000-memory.dmp

    Filesize

    2.1MB

  • memory/1652-79-0x0000000074EB0000-0x0000000074F24000-memory.dmp

    Filesize

    464KB

  • memory/1652-80-0x0000000073FE0000-0x0000000074104000-memory.dmp

    Filesize

    1.1MB

  • memory/1652-81-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-82-0x0000000075B70000-0x0000000076123000-memory.dmp

    Filesize

    5.7MB

  • memory/1652-83-0x0000000076DF0000-0x0000000076E9F000-memory.dmp

    Filesize

    700KB

  • memory/1652-86-0x0000000074EB0000-0x0000000074F24000-memory.dmp

    Filesize

    464KB

  • memory/1652-85-0x0000000076730000-0x0000000076755000-memory.dmp

    Filesize

    148KB

  • memory/1652-88-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-89-0x0000000075B70000-0x0000000076123000-memory.dmp

    Filesize

    5.7MB

  • memory/1652-90-0x0000000076DF0000-0x0000000076E9F000-memory.dmp

    Filesize

    700KB

  • memory/1652-87-0x0000000073FE0000-0x0000000074104000-memory.dmp

    Filesize

    1.1MB

  • memory/1652-84-0x00000000746C0000-0x00000000748D0000-memory.dmp

    Filesize

    2.1MB

  • memory/1652-91-0x00000000746C0000-0x00000000748D0000-memory.dmp

    Filesize

    2.1MB

  • memory/1652-92-0x0000000074EB0000-0x0000000074F24000-memory.dmp

    Filesize

    464KB

  • memory/1652-93-0x0000000073FE0000-0x0000000074104000-memory.dmp

    Filesize

    1.1MB

  • memory/1652-96-0x00000000765B0000-0x0000000076693000-memory.dmp

    Filesize

    908KB

  • memory/1652-95-0x0000000076B40000-0x0000000076C1C000-memory.dmp

    Filesize

    880KB

  • memory/1652-94-0x0000000010000000-0x0000000010060000-memory.dmp

    Filesize

    384KB

  • memory/1652-97-0x0000000075B70000-0x0000000076123000-memory.dmp

    Filesize

    5.7MB

  • memory/1652-98-0x0000000076DF0000-0x0000000076E9F000-memory.dmp

    Filesize

    700KB

  • memory/1652-99-0x00000000746C0000-0x00000000748D0000-memory.dmp

    Filesize

    2.1MB

  • memory/1652-101-0x0000000073FE0000-0x0000000074104000-memory.dmp

    Filesize

    1.1MB

  • memory/1652-100-0x0000000074EB0000-0x0000000074F24000-memory.dmp

    Filesize

    464KB

  • memory/1652-27-0x0000000003FC0000-0x0000000003FCF000-memory.dmp

    Filesize

    60KB

  • memory/1652-14-0x0000000003490000-0x0000000003507000-memory.dmp

    Filesize

    476KB

  • memory/1652-5-0x0000000002400000-0x0000000002401000-memory.dmp

    Filesize

    4KB

  • memory/1652-200-0x0000000002400000-0x0000000002401000-memory.dmp

    Filesize

    4KB