Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 12:31
Static task
static1
Behavioral task
behavioral1
Sample
43b0c5988a73db725d1f4f975c1de11c.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
43b0c5988a73db725d1f4f975c1de11c.exe
Resource
win10v2004-20231215-en
General
-
Target
43b0c5988a73db725d1f4f975c1de11c.exe
-
Size
1.1MB
-
MD5
43b0c5988a73db725d1f4f975c1de11c
-
SHA1
cd519f1f92fbe0cc6f6cc0b170a910455862838d
-
SHA256
066687f51b9bf88217f7abef257679622a0caaf9be12878241a219435d22a21d
-
SHA512
c7424fb8dbe9885bb57e53bf4a1882d5f8ff7927d69c7662af26c156c25affe9b415b5f337532f4ff38004a857c10487257e59b2fefce4840816718c3f15eeaa
-
SSDEEP
24576:VWvknOMEfqmINsg9x+nAzw+eoJb/t/2Pzk/kVnaozLzcpNN+n:VUeOMmMswkAzHlmjaonQ9+n
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 400 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_NAVIGATION_SOUNDS\Setup.exe = "1" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Setup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\Setup.exe = "0" Setup.exe Key created \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SECURITYBAND Setup.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4940 wrote to memory of 400 4940 43b0c5988a73db725d1f4f975c1de11c.exe 94 PID 4940 wrote to memory of 400 4940 43b0c5988a73db725d1f4f975c1de11c.exe 94 PID 4940 wrote to memory of 400 4940 43b0c5988a73db725d1f4f975c1de11c.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\43b0c5988a73db725d1f4f975c1de11c.exe"C:\Users\Admin\AppData\Local\Temp\43b0c5988a73db725d1f4f975c1de11c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\a2PIf6k36Q\OB6ABJA0\Setup.exeC:\Users\Admin\AppData\Local\Temp\a2PIf6k36Q\OB6ABJA0\Setup.exe --relaunch2⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
PID:400
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD543b0c5988a73db725d1f4f975c1de11c
SHA1cd519f1f92fbe0cc6f6cc0b170a910455862838d
SHA256066687f51b9bf88217f7abef257679622a0caaf9be12878241a219435d22a21d
SHA512c7424fb8dbe9885bb57e53bf4a1882d5f8ff7927d69c7662af26c156c25affe9b415b5f337532f4ff38004a857c10487257e59b2fefce4840816718c3f15eeaa