Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
30/12/2023, 14:25
Static task
static1
Behavioral task
behavioral1
Sample
1b5a487bf2fd380a538bec52e0357f5c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1b5a487bf2fd380a538bec52e0357f5c.exe
Resource
win10v2004-20231215-en
General
-
Target
1b5a487bf2fd380a538bec52e0357f5c.exe
-
Size
1.1MB
-
MD5
1b5a487bf2fd380a538bec52e0357f5c
-
SHA1
2fdcf6066ac6d1000cfccffbdbbef9354897b835
-
SHA256
100195463cbd001de1f65ce9ca131f86c6c150f02a639d7a14ce6160923fc8d0
-
SHA512
0564ef01cf38ba0ef326aa19556f00f94459c1d13b02eebdc1159728abb6b3c55adc0fe4027328880885ac11fa38087b9593b69766e38a678b39568349cebcd6
-
SSDEEP
24576:OWvknOMEdkLrlbSeeiTC9DNJyZKyZFCigixeOxtiu2GQR7yS+:OUeOMckLr1eYCFNsDoijiBR7D+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4016 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0" Setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4500 wrote to memory of 4016 4500 1b5a487bf2fd380a538bec52e0357f5c.exe 16 PID 4500 wrote to memory of 4016 4500 1b5a487bf2fd380a538bec52e0357f5c.exe 16 PID 4500 wrote to memory of 4016 4500 1b5a487bf2fd380a538bec52e0357f5c.exe 16
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b5a487bf2fd380a538bec52e0357f5c.exe"C:\Users\Admin\AppData\Local\Temp\1b5a487bf2fd380a538bec52e0357f5c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\a20bQQvos8\ZqkOuY2Q\Setup.exeC:\Users\Admin\AppData\Local\Temp\a20bQQvos8\ZqkOuY2Q\Setup.exe --relaunch2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:4016
-