Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2024, 11:21
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10v2004-20231215-en
General
-
Target
Installer.exe
-
Size
72.4MB
-
MD5
6793e3d4fa6dfcdc57d8d81675ab01d8
-
SHA1
ee42938dbd0a31f14bc975d9a78c6a68ed0cb253
-
SHA256
e031f5d53a854cb545bb0ca5e3d632946c6f5ba4dc775f2d9b9405b5899ff590
-
SHA512
d77fa6e3c18cde8c428b05c9bef1afe954562d7993241652770ed0ce2a4fea8efa7231c66ef1386d9faaa53a7286b5ff6c7708fe7982b0bcebb5795be5904a7b
-
SSDEEP
1572864:1a5sz+nsB4ptQ34bgbJ42l6bCiAvmMIEdXOBp9N/m0TMHVkRPHgW+eN0:w5sz+sBmkbJVZux+XW9N/m0TMH2Pz90
Malware Config
Signatures
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Installer.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Runtime Broker.exe Installer.exe -
Loads dropped DLL 5 IoCs
pid Process 2680 Installer.exe 2680 Installer.exe 2680 Installer.exe 2680 Installer.exe 2680 Installer.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2956 wrote to memory of 2680 2956 Installer.exe 48 PID 2956 wrote to memory of 2680 2956 Installer.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"2⤵
- Drops startup file
- Loads dropped DLL
PID:2680
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
Filesize
21KB
MD5a148dc22ea14cd5578de22b2dfb0917f
SHA1eaccb66f62e5b6d7154798e596eabd3cef00b982
SHA2567603e172853a9711fbdc53b080432ad12984b463768dbc3aa842a26f5b26ae23
SHA5124e3c927692fc41889b596273aea8bbd776cf7644dae26c411c12bda23cd3299a5c9adc06a930294310f002de74592a244767378fc9e37ec76e86bfa23f4c0478
-
Filesize
21KB
MD53095c9577395249e105410bdcc585f77
SHA17dfc0c81f8f28cbf36c5acdb83523569b430b944
SHA256c08be448195f46c4b423d0ce0c2cdc343e842ff1f91b16a8d3c09d5152150917
SHA512555568fc23ade238bcc13a447520d395546def4409a002d795dd3abea03b15321491bc63c97f4ed8eb78aa411a0b1267dce5c528e51dcac8ca9e93b8f5265786
-
Filesize
21KB
MD5a00ebd3cf88d668be6d62a25fa4fb525
SHA1edb07eafd08991611389293e2be80f8ee98f1e62
SHA256b44646453584305d4edf8ab5f5d1adea6b9650bd2b75f8486fc275be52b86433
SHA512d63f0e9f2e079ee06aa3ab96a0bd2d169564896027b731ee2597327bdc55456c5fd0c2d8c7e68165fc80bbc3fe0c24a3388d4c3615f33fc9f9fc0b205ae9ba7a
-
Filesize
21KB
MD598340ffd2b1d8affef27d4b1260aeac5
SHA1b428b39aa814a7038a1ddff9b64b935f51833a26
SHA2567388a019922e9a0a3d05a8605a5307e3141b39f7d57b7faca5d34e72adfd5fa5
SHA5126165c5be0360d55403e9dfd4e9df4ff9a12e5fb6057ed9278da09e688751487e46d9dd64949375c00764cbb4355cc13a1ea714055050f2ab7d432977b8443f81
-
Filesize
25KB
MD5abf9850eb219be4976a94144a9eba057
SHA13d8c37588b36296240934b2f63a1b135a52fcee2
SHA25641c5c577fea3ce13d5beb64ce0920f1061f65bcf39eafa8cd3dfc09ff48bcf76
SHA512dfaafb43ce7f05b2db35eac10b314fb506c6aada80f6c4327b09ec33c170478ebd0eea19f1c6ca2e4832bfa41f769046deca8f15d54b7966134d166ee6036bda
-
Filesize
21KB
MD52b36752a5157359da1c0e646ee9bec45
SHA1708aeb7e945c9c709109cea359cb31bd7ac64889
SHA2563e3eb284937b572d1d70ce27be77b5e02eb73704c8b50feb5eb933db1facd2fc
SHA512fc56080362506e3f38f1b3eb9d3193cdb9e576613c2e672f0fe9df203862f8a0f31938fa48b4ff7115dfe6016fa1fd5c5422fdc1913df63b3fde5f478a8417a1
-
Filesize
18KB
MD5bfffa7117fd9b1622c66d949bac3f1d7
SHA1402b7b8f8dcfd321b1d12fc85a1ee5137a5569b2
SHA2561ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
SHA512b319cc7b436b1be165cdf6ffcab8a87fe29de78f7e0b14c8f562be160481fb5483289bd5956fdc1d8660da7a3f86d8eede35c6cc2b7c3d4c852decf4b2dcdb7f
-
Filesize
21KB
MD5567ff20a8d330cbb3278d3360c8d56f5
SHA1cdf0cfc650da3a1b57dc3ef982a317d37ffb974d
SHA25647dfbe1ecc8abc002bd52dcd5281ed7378d457789be4cb1e9bee369150d7f5c8
SHA5121643e900f13509f0ef9c7b7f8f2401fb3b6f2c0c39b512c623615df92b1e69df042ef1a0c6aace82173ce5d4d3c672c1636d6ee05545ce5c3b7374ab745e0e87
-
Filesize
21KB
MD5a8b967b65232ecce7261eaecf39e7d6d
SHA1df0792b29c19d46a93291c88a497151a0ba4366d
SHA2568fcc9a97a8ad3be9a8d0ce6bb502284dd145ebbe587b42cdeaa4262279517c1d
SHA512b8116208eb646ec1c103f78c768c848eb9d8d7202ebdab4acb58686e6f0706f0d6aaa884e11065d7ece63ebbd452f35b1422bd79e6eb2405fb1892758195ccbb
-
Filesize
1.3MB
MD544db87e9a433afe94098d3073d1c86d7
SHA124cc76d6553563f4d739c9e91a541482f4f83e05
SHA2562b8b36bd4b1b0ee0599e5d519a91d35d70f03cc09270921630168a386b60ac71
SHA51255bc2961c0bca42ef6fb4732ec25ef7d7d2ec47c7fb96d8819dd2daa32d990000b326808ae4a03143d6ff2144416e218395cccf8edaa774783234ec7501db611
-
Filesize
6.7MB
MD548ebfefa21b480a9b0dbfc3364e1d066
SHA1b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA2560cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
SHA5124e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
-
Filesize
5.4MB
MD5fb0edf91b4a8796b8827dccce7a6e721
SHA18b33935517414875650f94443176f3b49c9940a5
SHA2562cd987b4a058a01b4849fed255869418a996c0e11c1a73c29eaa4a34da647655
SHA512defb906ba1aec4b327fbb4aa10272adb3e5e13c72e41a30fb391b64c217ad0fc96371228ea83f015b4f18148faffb59de3813779b090ebdd7842e0ede7482faf
-
Filesize
877KB
MD5b2cc4e5f0afd49f38f1478f5c2752fd0
SHA14879fc267e6aef5cfabae7e30de1e0c885251013
SHA2562b5dca304aa2d42255fc3b9ef166e509bc3ec2fd1c7dc0d01a41d60a857c6951
SHA512c9db63edc2db55d46a909d7dc0f84c76b5f93ff09e014448dec364320f5540312bb44bb5526147c7456e8e7fcb8e1514ece7175864ec2de0bb0fdea00d1975ed
-
Filesize
992KB
MD50e0bac3d1dcc1833eae4e3e4cf83c4ef
SHA14189f4459c54e69c6d3155a82524bda7549a75a6
SHA2568a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
SHA512a45946e3971816f66dd7ea3788aacc384a9e95011500b458212dc104741315b85659e0d56a41570731d338bdf182141c093d3ced222c007038583ceb808e26fd