Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 07:16
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
安装说明.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
安装说明.url
Resource
win10v2004-20231215-en
General
-
Target
setup.exe
-
Size
1.8MB
-
MD5
841451e01863ba09a3a7327da616e642
-
SHA1
735a3eb50f247fe6bd13e8a8f40eb8741f19642c
-
SHA256
7dbe11f7b8cbc7f7eba8311ae51cdb6c8def800f04401c44306b04de812cb927
-
SHA512
2b17d0fec6124ca778e4a0ba761501f138dbe2e7010dcfe0c3b036ce706b3ba9bc3fba0e1f8aeccc25c6cf2d17c69650feeffc91736af69ecc0d35cfe427bc4b
-
SSDEEP
49152:gGpT0dFZSi7Tb4T7xC/4K20TT2xzBpux3y1rs3xHE/lz0:9pIdSiruo/4K20TT2xlMk9CdEC
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3740 is-M89IG.tmp -
Loads dropped DLL 1 IoCs
pid Process 3740 is-M89IG.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4116 wrote to memory of 3740 4116 setup.exe 22 PID 4116 wrote to memory of 3740 4116 setup.exe 22 PID 4116 wrote to memory of 3740 4116 setup.exe 22
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\is-5HK15.tmp\is-M89IG.tmp"C:\Users\Admin\AppData\Local\Temp\is-5HK15.tmp\is-M89IG.tmp" /SL4 $501F0 "C:\Users\Admin\AppData\Local\Temp\setup.exe" 1595381 496642⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3740
-