Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
05/01/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
Delta V3.61 b_46956732.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Delta V3.61 b_46956732.exe
Resource
win10v2004-20231215-en
General
-
Target
Delta V3.61 b_46956732.exe
-
Size
9.5MB
-
MD5
93d16508432c3ff3512eb9de584f48e6
-
SHA1
6ed9fd4d190afc6c5154730d85cf883fd3ad4d2e
-
SHA256
be5357f63b036da79d198978cbc5b652ea02b1ccfcb1538352442cdc7f4d5549
-
SHA512
08ad71f9b6b3a65cb22b6a65c8e44d4e004de2d10683dd89a8eac5af67127b126db301ca55e00740e7342c2896cf4b7178257e9d4e446a03db13e122c4116338
-
SSDEEP
196608:MulB4qN8C0lgVk2rqNemQ3bKfIiaNPFHNRsiK:jee87gbrqNeL3bIIiEHMn
Malware Config
Signatures
-
Checks for any installed AV software in registry 1 TTPs 8 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast setup46956732.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Version setup46956732.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast setup46956732.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir setup46956732.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV setup46956732.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir setup46956732.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV setup46956732.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Version setup46956732.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Executes dropped EXE 1 IoCs
pid Process 5080 setup46956732.exe -
Loads dropped DLL 39 IoCs
pid Process 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Opera GXStable Delta V3.61 b_46956732.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Opera GXStable Delta V3.61 b_46956732.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe 5080 setup46956732.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5080 setup46956732.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3492 Delta V3.61 b_46956732.exe 3492 Delta V3.61 b_46956732.exe 5080 setup46956732.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3492 wrote to memory of 5080 3492 Delta V3.61 b_46956732.exe 74 PID 3492 wrote to memory of 5080 3492 Delta V3.61 b_46956732.exe 74 PID 3492 wrote to memory of 5080 3492 Delta V3.61 b_46956732.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\Delta V3.61 b_46956732.exe"C:\Users\Admin\AppData\Local\Temp\Delta V3.61 b_46956732.exe"1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\setup46956732.exeC:\Users\Admin\AppData\Local\setup46956732.exe hhwnd=458814 hreturntoinstaller hextras=id:ad413892c2b60f5-RO-KA1rz2⤵
- Checks for any installed AV software in registry
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5.6MB
MD52af3b73289222f53daf512d4fb3a55be
SHA1d2fa2d364f9e00988910075cd146cea7c2ec9801
SHA2564ac54c921cd71a01c199d9b2785712d2af30f13214bbbeed5baa75f9ac0a21ac
SHA5126440b1e8036f9a71f1444ffd4cb82d88eef94b98a139170c10d0abee38b5c657c9fee14a14c90569017845d25281dd97bcc6a11980096a76e77b95f20be7fdfe
-
Filesize
5.1MB
MD5146c221743720d8f725490472edf4aea
SHA10e3ae82d97f3aea6152de616bc6e3a8bdefbb92c
SHA25699a5a3e811a9d6162cf3e7974b0cf038afb03df87c1052292378cd9299ad0b21
SHA5125db926af7d29370cfe281b6d7ff133f0e4f62a9cd2fadfc39f5c12a2137b391c464d5840bd24fd1610ed93505b8bdf7519ae4f8e3c9bfd4a9ce0bcada69a5a21
-
Filesize
168KB
MD528f1996059e79df241388bd9f89cf0b1
SHA16ad6f7cde374686a42d9c0fcebadaf00adf21c76
SHA256c3f8a46e81f16bbfc75de44dc95f0d145213c8af0006bb097950ac4d1562f5ce
SHA5129654d451cb2f184548649aa04b902f5f6aff300c6f03b9261ee3be5405527b4f23862d8988f9811987da22e386813e844e7c5068fd6421c91551f5b33c625f29
-
Filesize
541KB
MD59de86cdf74a30602d6baa7affc8c4a0f
SHA19c79b6fbf85b8b87dd781b20fc38ba2ac0664143
SHA25656032ade45ccf8f4c259a2e57487124cf448a90bca2eeb430da2722d9e109583
SHA512dca0f6078df789bb8c61ffb095d78f564bfc3223c6795ec88aeb5f132c014c5e3cb1bd8268f1e5dc96d7302c7f3de97e73807f3583cb4a320d7adbe93f432641
-
Filesize
5.1MB
MD5bf5f25e1d9089b4d22b5a17cbe85abd8
SHA1e384b185310b17394f3dc6260d7ee24a41d09795
SHA2565d156ebeef94d94ee092c34f07507ff828e46ff20d67449680b834baabeea76a
SHA5129d51554575cb294eb00746aabe85b6e2f6306dee683845295dfbe7ddd646b3f59ec51e20ffa403d14d991cc90bff99aa2baa773d7febf18dae448ce0c88082bf
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84