Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
31/12/2023, 05:48
Static task
static1
Behavioral task
behavioral1
Sample
2aa2773907c7589704fe5af884702232.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2aa2773907c7589704fe5af884702232.exe
Resource
win10v2004-20231215-en
General
-
Target
2aa2773907c7589704fe5af884702232.exe
-
Size
1.1MB
-
MD5
2aa2773907c7589704fe5af884702232
-
SHA1
43407bad946db1d4eed4d69455377ea868647082
-
SHA256
24a1531af0a4cd3e5906871c4b590c5ecc7c575c3e1628cdf943331c05a1bfd0
-
SHA512
fb2de436ff0a77f8cc96d83479e6ae13f058a4e9de51d2d6fdbdd48c4fd193e7e4d32484f0b4efa01c5b8b7daabea2ea795ce23a265fdb13341baacacef8fb9b
-
SSDEEP
24576:rWvknOMEdnSj8ZcGBaAfnsMpTdEA6Ov8qB6Rnuts8QrnKK:rUeOMcR2GBPnigN9C8KKK
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2968 Setup.exe -
Loads dropped DLL 4 IoCs
pid Process 2948 2aa2773907c7589704fe5af884702232.exe 2968 Setup.exe 2968 Setup.exe 2968 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main Setup.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2968 2948 2aa2773907c7589704fe5af884702232.exe 14 PID 2948 wrote to memory of 2968 2948 2aa2773907c7589704fe5af884702232.exe 14 PID 2948 wrote to memory of 2968 2948 2aa2773907c7589704fe5af884702232.exe 14 PID 2948 wrote to memory of 2968 2948 2aa2773907c7589704fe5af884702232.exe 14 PID 2948 wrote to memory of 2968 2948 2aa2773907c7589704fe5af884702232.exe 14 PID 2948 wrote to memory of 2968 2948 2aa2773907c7589704fe5af884702232.exe 14 PID 2948 wrote to memory of 2968 2948 2aa2773907c7589704fe5af884702232.exe 14
Processes
-
C:\Users\Admin\AppData\Local\Temp\a26cB0R2Pw\XpqhE3cP\Setup.exeC:\Users\Admin\AppData\Local\Temp\a26cB0R2Pw\XpqhE3cP\Setup.exe --relaunch1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2aa2773907c7589704fe5af884702232.exe"C:\Users\Admin\AppData\Local\Temp\2aa2773907c7589704fe5af884702232.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2948