Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

5

Static

static

3

Driver/2K_...er.sys

windows7-x64

1

Driver/2K_...er.sys

windows10-2004-x64

1

Driver/Vis...er.sys

windows7-x64

1

Driver/Vis...er.sys

windows10-2004-x64

1

Driver/Win...er.sys

windows7-x64

1

Driver/Win...er.sys

windows10-2004-x64

1

Driver/ins...er.exe

windows7-x64

5

Driver/ins...er.exe

windows10-2004-x64

5

Driver/ins...64.exe

windows7-x64

1

Driver/ins...64.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 04:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Driver/install_driver.exe

  • Size

    622KB

  • MD5

    66519e67c90c3f2b86ee443e3b41415f

  • SHA1

    a09a2fbf06fefe6dfd85fc4c69008ade42b432c9

  • SHA256

    958d60178914ac74e36c4218279eec2b18760bab0ab97e7fed18005a691a4ba6

  • SHA512

    5dce8fc0404b539862d16db51c35b0bb70d6db0877046a6903ba83ae65e11c185eab100e73e1bf7972d420723710e5d76af94c3ad3de50452b8034e678c7cac4

  • SSDEEP

    12288:byfUVjJQKXxXjjAZkU5UUXiy8Xtd9AsyG5/tAp3fLO6EwgbA6:byU82bU/Xiy8ZFAp3fLOH

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 21 IoCs
  • Drops file in Windows directory 8 IoCs
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Driver\install_driver.exe
    "C:\Users\Admin\AppData\Local\Temp\Driver\install_driver.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2496
    • C:\Users\Admin\AppData\Local\Temp\Driver\installdrv64.exe
      installdrv64.exe UpdateDriverForPlugAndPlayDevices USB\Vid_0e8d&Pid_0023&MI_02 "C:\Users\Admin\AppData\Local\Temp\Driver\Win7\usb2ser_Win764.inf"
      2⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:4928
    • C:\Users\Admin\AppData\Local\Temp\Driver\installdrv64.exe
      installdrv64.exe UpdateDriverForPlugAndPlayDevices USB\Vid_0e8d&Pid_0023&MI_00 "C:\Users\Admin\AppData\Local\Temp\Driver\Win7\usb2ser_Win764.inf"
      2⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:3624
    • C:\Users\Admin\AppData\Local\Temp\Driver\installdrv64.exe
      installdrv64.exe UpdateDriverForPlugAndPlayDevices USB\Vid_0e8d&Pid_0003 "C:\Users\Admin\AppData\Local\Temp\Driver\Win7\usb2ser_Win764.inf"
      2⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      PID:4716
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{54a7fdc8-e32c-ac47-ad92-858322ab798b}\usb2ser_Win764.inf" "9" "4fdf53997" "0000000000000154" "WinSta0\Default" "0000000000000164" "208" "C:\Users\Admin\AppData\Local\Temp\Driver\Win7"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:3500
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{b4daec0a-b6ca-0044-8c52-55852946a319}\usb2ser_Win764.inf" "9" "4fdf53997" "0000000000000168" "WinSta0\Default" "0000000000000144" "208" "C:\Users\Admin\AppData\Local\Temp\Driver\Win7"
    1⤵
    • Drops file in System32 directory
    • Drops file in Windows directory
    PID:3200
  • C:\Windows\system32\DrvInst.exe
    DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{c8bab828-ea1b-2d49-bd7c-2143360c173d}\usb2ser_Win764.inf" "9" "4fdf53997" "0000000000000164" "WinSta0\Default" "0000000000000168" "208" "C:\Users\Admin\AppData\Local\Temp\Driver\Win7"
    1⤵
      PID:2176
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4804
    • C:\Windows\system32\backgroundTaskHost.exe
      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:2176

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\{54A7F~1\usbser.sys
      Filesize

      25KB

      MD5

      49106ee29074e6a3d3ac9e24c6d791d8

      SHA1

      54b690cfd6b81b556239bc6409c408d26d9fafc6

      SHA256

      b96b19a92e720f284741f8a2dcb30a9423ad58ba8f795d4f2e30403ceef20099

      SHA512

      e6737b08ee1bdfcce4b59a02fa53507f894c8bc285e71e4fe8130e0046ff098847a245b1299f3f6120fa8ec54a53bb531f999eb6043aaaf4e499b97a8ac87a69

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\{54a7fdc8-e32c-ac47-ad92-858322ab798b}\usb2ser_Win764.inf
      Filesize

      3KB

      MD5

      bccc7e837e3c0105830295b7a772d40f

      SHA1

      230e7173e5bd5631c78fd86d29602fe969805e9b

      SHA256

      e3063428ed325a2c570677182ffb9df3c0821a706cd9f754ea5150aeaa98ac2e

      SHA512

      eac0d13d56c83c9a1a492a79273a7952e00b2c631e77cd3a8895c496e8895d5f943521584aec10a8132ebb93f808539acf37ebf1da385ed336f8d3c9c7217122

      Download Submit

    • C:\Windows\System32\DriverStore\Temp\{8a9ca293-cd55-5844-9dc8-f9edcb60b017}\SET3BB1.tmp
      Filesize

      7KB

      MD5

      916153992d59f8d93e6d1c0cf08a3a06

      SHA1

      dc38d428091d7801d482de519498541c3a209e34

      SHA256

      c422129074f85c7d3d1ddcabc0b31015cb83d4f96041ed10840ceeb56e59b3d7

      SHA512

      d3506734c75412fe66a3745e770b9e62a7e6bd18d77704ddb684434cb82820a346a1390e8aa92c13b49c3b1fed11cbee4235cf04442dca570a4e13126add44e3

      Download Submit