Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20231130-en -
resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2023, 13:23
Static task
static1
Behavioral task
behavioral1
Sample
mmm-setup.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
mmm-setup.exe
Resource
win10v2004-20231130-en
General
-
Target
mmm-setup.exe
-
Size
2.0MB
-
MD5
d416e704c3a4821d54f6176911e4ca1d
-
SHA1
bf30bfc04f6c99c2ff6b9c4c5ede6e21bd386a2b
-
SHA256
abee9f014c44a565c431298569644024d17d0be5723e1bf5a230fec2327e895f
-
SHA512
a0cae9e0e41951d8c00504c41b02d31ed0513f12b612328268e999ff561b5dab98e823f60474f42c43ce6002b1abfca08287a582510a8b4b2e4ddce0ec9d2d61
-
SSDEEP
49152:7tfrWDO5BpVnWh7RtpO11+FKAqKMPhEYmdke:7tfrWOpVWpRfK0MGYmee
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-433534792-1200107535-3148087551-1000\Control Panel\International\Geo\Nation mmm-setup.exe -
Executes dropped EXE 1 IoCs
pid Process 852 OnlineInstall.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2296 wrote to memory of 852 2296 mmm-setup.exe 90 PID 2296 wrote to memory of 852 2296 mmm-setup.exe 90 PID 2296 wrote to memory of 852 2296 mmm-setup.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\mmm-setup.exe"C:\Users\Admin\AppData\Local\Temp\mmm-setup.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\OnlineInstall.exe"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\OnlineInstall.exe"2⤵
- Executes dropped EXE
PID:852
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.1MB
MD5de1900752b7126dca36cd4b52ccf1742
SHA1f36d9e20c5443dd04d12a2927297b0f639daefa8
SHA2568d3c1c0f912db997d3327249d0f03ee6581d8e9a90bdf060fc9e0526e292fb7a
SHA5124809004771b09ca1a39071f5f8919b6893335588bb8ff58efb804430413878820848d5b4cc34db864df0de84051d35d14032152e0adcd2f1a1782ec588181bcd
-
Filesize
4.1MB
MD5de1900752b7126dca36cd4b52ccf1742
SHA1f36d9e20c5443dd04d12a2927297b0f639daefa8
SHA2568d3c1c0f912db997d3327249d0f03ee6581d8e9a90bdf060fc9e0526e292fb7a
SHA5124809004771b09ca1a39071f5f8919b6893335588bb8ff58efb804430413878820848d5b4cc34db864df0de84051d35d14032152e0adcd2f1a1782ec588181bcd
-
Filesize
4.1MB
MD5de1900752b7126dca36cd4b52ccf1742
SHA1f36d9e20c5443dd04d12a2927297b0f639daefa8
SHA2568d3c1c0f912db997d3327249d0f03ee6581d8e9a90bdf060fc9e0526e292fb7a
SHA5124809004771b09ca1a39071f5f8919b6893335588bb8ff58efb804430413878820848d5b4cc34db864df0de84051d35d14032152e0adcd2f1a1782ec588181bcd
-
Filesize
1KB
MD56d116dccaac5056d7d1f4a593d5ac0db
SHA1242a6a198c7e1e22bda176065cf0b26a276b6f72
SHA2560946efee104652f084c6fb2f271b06fcdfb50de893d64cd4287cc8e64deced92
SHA512037c4cb011492a27da3f7a6d2e7e75cabac8c58eca3607d57df248491b4786247c08a2f9ffd5fe49d3ef0b9f862b3ecb4a4783e04b1801c13935f271df224e79
-
Filesize
1KB
MD599fcff2aca703823e083cb90a3192146
SHA1376158f2e3e6c4f42e67415f180539d562bd27fb
SHA256cbe96210dc6c28e21625c01db80e510152eecbf4ddbc75a30feeefb9ffa318ef
SHA51286b51f428a34f7de88f8aa5268028c86dee41a894ec3704c7ba10c0c8f7ef065af9c18d8d1999c903c5aa062abb2910630477b3b11db02f33c6e77373cff3d2c
-
Filesize
554B
MD54d1bb1565683540ad56454b56452d4d1
SHA1b62197a6ed3aaaa5fe8bae786d5f799216eb913c
SHA256d0dc023be6bc07f186d21682c649990fac01ecf8f63e994468d6a01dbab8b567
SHA512acdf6ba0a02daa367c965ae463ff0bcefe9a118d4bb3bf006b29a9b40042ba50408d1ecee87f4dc93b68414dbbfe4c63e68644930996a4b1f6d631a9d233855a
-
Filesize
1KB
MD579a297af3cc5d3501558bfc2344f250a
SHA17cae747038212afaf6ac69ae57e99cdf9a7ee97d
SHA2560f8ed5fdb53a8895e0159855268e0b8bb084766473ceb3ced8b96209844e359f
SHA512e5e4a5feb042725564885be76d8a6bf7d1e68fcd8734822c8f5b5653f1cef9065dfa7d07e57df24332a95567020bb9135ae2233b9d7fbe0a6caa4cd5691b0c0a
-
Filesize
1KB
MD55a02fb88141286b03e5c96bfab807c11
SHA14639a647d31d267cf08f4d3e92d62e61749ca1fa
SHA2567a668d959b0c980edb8fa1b1a359e881f7865a4ec78f879afb2460f99c45367c
SHA512f6d8b34e7c60ec8ad8d43b6cdb449dd608d29efd2abe377b2439e8fbdb70b72b048948fb17a65dd8b4469c2c65bbfb2e7c583cb880441e26a0d41b14f1e27c7b
-
Filesize
38B
MD5abacaded57bf1c4c7e02647433e6a8da
SHA1d2b8df8a815bad3d3314dc21cd0b800289d62b9a
SHA2568b5b7693577d05ef72bc63bcf31aaa5327aab2fb7790e00d3794f924a117fba7
SHA5127320a3d005d69df933e6c5c69cefdd27fc50eece20607202c891318d82c20def3c651f0377f1799e0f51e6af9af2a6de2720066ab011be8b93b46ed63d105189
-
Filesize
15KB
MD556153153df832979e4963af537eda094
SHA1e9804deb056a0b991935ff500d9a0f789e7abb86
SHA256a993eb488b04a2ac6112cad1463881423924f0aadea90e5d35506e7226c7b3b9
SHA512517ed9c610700aa9f2a07867600bbc08f0e1ec2067822c79239935cb03437d5624bbe53ef32b4d2849b47355e0084fb3a902d1e8f8d10dcfb72422756e733042
-
Filesize
9KB
MD5ea1eb245ad1843da4fd09176eb27b4c1
SHA1759cf4fe2b48b31eb428f034e720562153a85eff
SHA256ded685dc3d3aad3064b341e4969dd2beb91efd0fbfdb30eac990dc75a91b16bf
SHA51200b8b121583295b3549c9b8538b1119a2384a8032b5d94ba5cab429f58e724d337f4d0e0d388b52da712efd477f591b6b51d823643f9581d15b6ed2cefe38112