Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 18:11
Static task
static1
Behavioral task
behavioral1
Sample
337b0e190043b53ec5a510bd91971785.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
337b0e190043b53ec5a510bd91971785.exe
Resource
win10v2004-20231215-en
General
-
Target
337b0e190043b53ec5a510bd91971785.exe
-
Size
1.1MB
-
MD5
337b0e190043b53ec5a510bd91971785
-
SHA1
4a27fc2a14e1f224ddd37c6a23300f0bd98bda98
-
SHA256
226545c8833b1610cb65f36b26cbcea373d0ccf92f36d1161e59ae8602892623
-
SHA512
838fe130623877e4bd1b5007dca6d7ff525cb0897945d4c6c0ab23e1139ace6786933f4c150ec8c55811a8ec09f3d6ec3e3821b711632c0e72767dc80fdcd203
-
SSDEEP
24576:nWvknOMEfFIT1Xc78ktFDDZNtN8bO/Actcl13+8VNr5v5V+9:nUeOMmvo4DDZN4i/Ac7415V+9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2540 Setup.exe -
Loads dropped DLL 4 IoCs
pid Process 1792 337b0e190043b53ec5a510bd91971785.exe 2540 Setup.exe 2540 Setup.exe 2540 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Setup.exe Key created \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1792 wrote to memory of 2540 1792 337b0e190043b53ec5a510bd91971785.exe 14 PID 1792 wrote to memory of 2540 1792 337b0e190043b53ec5a510bd91971785.exe 14 PID 1792 wrote to memory of 2540 1792 337b0e190043b53ec5a510bd91971785.exe 14 PID 1792 wrote to memory of 2540 1792 337b0e190043b53ec5a510bd91971785.exe 14 PID 1792 wrote to memory of 2540 1792 337b0e190043b53ec5a510bd91971785.exe 14 PID 1792 wrote to memory of 2540 1792 337b0e190043b53ec5a510bd91971785.exe 14 PID 1792 wrote to memory of 2540 1792 337b0e190043b53ec5a510bd91971785.exe 14
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2FlvYgdyT\JHJGYrth\Setup.exeC:\Users\Admin\AppData\Local\Temp\a2FlvYgdyT\JHJGYrth\Setup.exe --relaunch1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:2540
-
C:\Users\Admin\AppData\Local\Temp\337b0e190043b53ec5a510bd91971785.exe"C:\Users\Admin\AppData\Local\Temp\337b0e190043b53ec5a510bd91971785.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792