Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

Setup_WinT...24.exe

windows7-x64

7

Setup_WinT...24.exe

windows10-2004-x64

4

Analysis

  • max time kernel
    141s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    01/02/2024, 02:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup_WinThruster_2024.exe

  • Size

    7.3MB

  • MD5

    62f9258f3ae4774f9dc169a2a0b1d68e

  • SHA1

    56164f50722724275c0db381235d3b793f85acd5

  • SHA256

    82f5a693742c6c35f1280dbc5a4148598c129208dfc0544a5cd457b7ac8e824a

  • SHA512

    ef04a48d957d646e0b4fbdb68bfe59bedfb6f5701dd9497b2bc5abeea57b5d7be5f8694ca59d535c8d14514ecacfb6773476abcd3d2f65a1da7c0c75241d7fd2

  • SSDEEP

    98304:cSi3CpUYtyBI5sdXR/YVTWXumt2Q7VJedSNtjrk8rNF3y0HWRR4cmWDjzK45:IClt4I+yTd2rJzrjr7H3r2R2qHb

Score
7/10
discoverypersistencespywarestealer

Malware Config

Signatures

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 41 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • Registers COM server for autorun 1 TTPs 64 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1688
    • C:\Users\Admin\AppData\Local\Temp\is-SPNKP.tmp\Setup_WinThruster_2024.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-SPNKP.tmp\Setup_WinThruster_2024.tmp" /SL5="$30150,6737092,878080,C:\Users\Admin\AppData\Local\Temp\Setup_WinThruster_2024.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2136
      • C:\Program Files (x86)\WinThruster\WinThruster.exe
        "C:\Program Files (x86)\WinThruster\WinThruster.exe" /START
        3⤵
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Executes dropped EXE
        • Loads dropped DLL
        • Registers COM server for autorun
        • Checks processor information in registry
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:2788
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "WinThruster automatic scan and notifications" /TR "\"C:\Program Files (x86)\WinThruster\WTNotifications.exe\"" /SC ONLOGON /RL HIGHEST /F
          4⤵
          • Creates scheduled task(s)
          PID:1436
      • C:\Program Files (x86)\WinThruster\WTNotifications.exe
        "C:\Program Files (x86)\WinThruster\WTNotifications.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:2784

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\WinThruster\Cookies.txt
    Filesize

    177B

    MD5

    2bde23fc871c1b6a552f83d4e18157f2

    SHA1

    bd00a74b0c45898195295464a1e6105774a034da

    SHA256

    60ece1ea1e17fd213400438616aacc395665e5e56fbc04c2c98067b445fe68e9

    SHA512

    72402035285dfc8da6a3d1200bca65982fc5495b50fc0e61ce5d4082e256571508f460e81477a331f120a70d3fd536ef73a5e4ead59ab76ff5348a3a710bd052

    Download Submit

  • C:\Program Files (x86)\WinThruster\English.ini
    Filesize

    81KB

    MD5

    05d92a969983b83314a0ea2fcef74203

    SHA1

    9ee3aa567438a28285e1141e4014bb6c473195fc

    SHA256

    7d07617e39f7dfeccaf894c89b6f85d35d41082b8bed893513bb1b7cad4ac823

    SHA512

    00fde33bc30148f2e81f2054fe585c9a7605390af013c3aa84b23d59f35413c5f2d494974878d9891db14c9bb43ab2e77a1c707326e7052f2440655272914033

    Download Submit

  • C:\Program Files (x86)\WinThruster\IDs.txt
    Filesize

    1KB

    MD5

    3773c8efba54912d59c27b03d4790479

    SHA1

    48c71bf4680d180295be0c975dbcfbf8d89840dd

    SHA256

    a4e44a28ccac2dfbcd03104ec32f8589bd55988af981cd167a486c2181112514

    SHA512

    64f0de1c862391bf86bc15bd8e4f430420cb0c8f6d4eaef67770e6c9f99cff874fa44ef73d8ae73f6416df35f7763d56da451f5237e3c3b1868371f4bf534957

    Download Submit

  • C:\Program Files (x86)\WinThruster\SList.txt
    Filesize

    77KB

    MD5

    e246b232635098d4f0fb5fa2d33b15fd

    SHA1

    92a900a20d5f00923cc69902409310990df6cd68

    SHA256

    75143874b8165e82187d430a55bb732e7eb765cc0b378c1b9da8638b091875b1

    SHA512

    19da2beee854d9c2d66f2556a5744ff311666f9d7d8a27e7ac5c50c9d3b3754ef37f13690df42cb0468f18d0619c35c789080415aecf3d22373fc1f3e55be2ca

    Download Submit

  • C:\Program Files (x86)\WinThruster\SiteNtf.txt
    Filesize

    4KB

    MD5

    023938522a2335379044391c1b83656a

    SHA1

    1761b2dcadb48689c7c052393490043e050e5fea

    SHA256

    66aae467ef3636628b6eb4c4dc2e210990bb6440653cc3aafb7800b89a8da1ec

    SHA512

    0f88726ee74a9d51dfd888120d0e0dc1c66949374388ef4a394b4a2cd59056dbada68fe75929f4374b4441cfd8b8100e5edfaaa2982dba9f02d0322f1d1dd389

    Download Submit

  • C:\Program Files (x86)\WinThruster\WTNotifications.exe
    Filesize

    1.1MB

    MD5

    4e8601b100f1c06c8dd9d2e59b7f5b03

    SHA1

    63898d07382fd65c2633627838cd70ee0b6645a0

    SHA256

    d006c79e1833c2c4962870b7eb63baaad3cc757f39dd766a7fde4aadb685bb9f

    SHA512

    4aa3a19e41c87461eb00900b3bbce53cec89f177117276ed2579f2e7e982923d521d7840cd07367da845358ddbbb26202d6b7650a8e15a6ea16f654f95a13e1f

    Download Submit

  • C:\Program Files (x86)\WinThruster\WinThruster.exe
    Filesize

    1.6MB

    MD5

    c5b9aa13cc069f4eeead8cdb4d8cd744

    SHA1

    66fde536f929183a0b556b56bb491018fd5a34db

    SHA256

    90750d2967b4e5d106ba857ac958051f9114515da89f58bc6146fac6b71fc0f2

    SHA512

    9f81e408d248cb67548d11168506a7ef6a9e8795d7c4f4d49c8a5d40538343da17ff54dc0f76de9eca6247deeff47569f39686f1cec2b8f3de9098806e3ec81c

    Download Submit

  • C:\Program Files (x86)\WinThruster\WinThruster.exe
    Filesize

    370KB

    MD5

    966cf0c9773a3774bc1262b748e0a654

    SHA1

    07050837cad6f3cbf0cd52da786959cc260dc2e1

    SHA256

    b04efc2de158029110c798babd24a4a6650ae4e497fe5830aee40076f8a4114b

    SHA512

    726568fcb2e2dbc1f8555cd285ca509af6e2270b945592e81bc812554673de2b46d072fe897b1c735f61e646d01f57e926c5357f9bc080785921dec971238400

    Download Submit

  • C:\Program Files (x86)\WinThruster\WinThruster.exe
    Filesize

    1.9MB

    MD5

    2054d050be976063652663dfe1e1809f

    SHA1

    841c051277eaf487e3c329ec6b9b062a7be5d2b9

    SHA256

    6a1c7651f15a6b2dc46c9661d9b24fd694dae50dc478f9333866e5d204be2ff6

    SHA512

    f9f8fca84d1d7739d419d6fef9acda9cf679e6869b7a2bf2e01d8451c2e06a571557aab79487667fba29d692fa9954a54ce3ebe59d563545d67f90cc21aa67c0

    Download Submit

  • C:\Program Files (x86)\WinThruster\net.db
    Filesize

    1.2MB

    MD5

    0dbd2a5a724a726bd1090af1b931a201

    SHA1

    fff56ea8658c3e3b697f1563941bb3748e0c543d

    SHA256

    1bbc401b93dd2508de9a3f1a4e9e0c5f92dfe288a5ebc5c13f91d6745b36f591

    SHA512

    6f5e0187aae681e6bd25d18af48ff6d772b0d3680556d13e447478e8dac5914d603fe44529f58fbed18c1c03638016ee5e8d8052deda94cefd43dcd197c6b41e

    Download Submit

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinThruster\Uninstall WinThruster.lnk
    Filesize

    1KB

    MD5

    0e61b9c3fa79fa2b5c2c5321edc30d70

    SHA1

    172ba7cdea840d0bd2c7607c70bc804a4110779e

    SHA256

    67f233c517d90fb917f6988bf812cc325b0d8bcf7017d3a67f00b2bb481f9201

    SHA512

    7ee37d0f736f239e85b83609c0ffeb70b26f0edb3f6a92fdb0fe85fa9edb155629dc9203800c2b5a421ac3a5b5e37121b1577238a70f8e08f09c51c88653fa31

    Download Submit

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinThruster\WinThruster on the Web.lnk
    Filesize

    1KB

    MD5

    777408d0c74916fa1c9fc82b96e8407d

    SHA1

    5c684e96d3a57d8667734dbcb9c9a97b58fd22f5

    SHA256

    b3d81df235925bdf9001f9ec6f2e1012f8e3db74356d0dac42f5b2120ae48f0a

    SHA512

    f192be59336d3176a16614fffb0e4f81776b7b074489cdc8770e9285bbab40d7f8bdbc9cc27be3de37b3148aaff085e901ffbdd67db91f01bfc60be5511d59a3

    Download Submit

  • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinThruster\WinThruster.lnk
    Filesize

    1KB

    MD5

    49a6312d14de8e1b415d3deaf1aaeba0

    SHA1

    6dd9e5aba43572917318bb66dc1af42743625352

    SHA256

    7b9870e226b43dd74c4bc75fa3f8b07d4e99d273af8a08763a58a2fd2edcb670

    SHA512

    a0d773f8113743015de9805c912918ba0c4faa6cb1ef0167fe9a0f676cff7151cf59f4307539d5aff83281f604e670524a720da722dc7f2eb4b42ca152c9275a

    Download Submit

  • C:\Users\Admin\AppData\Roaming\WinThruster\Log\Tasks.log
    Filesize

    416B

    MD5

    f3dbef81b21879b19cb6b032346cd38a

    SHA1

    cfb07be05e66db66a64448ac005650ee82eb519d

    SHA256

    dfc6f6215a152211543914daa81e726b5598d7f68c1d748c77a29fc870a91acb

    SHA512

    d85ec8161e448cc85327f158c81a765e474d2da359781c0f8871e279a1c8dd6295de2edcc582eceae606cff87e04927e8ae68670c78e0c9b14e08c7af5fa0b26

    Download Submit

  • C:\Users\Admin\Desktop\WinThruster.lnk
    Filesize

    1KB

    MD5

    4c2db38c9ccfb3fdf108a493663a7891

    SHA1

    33852dbd029529acbf91d966fb6aeebcb12e26a6

    SHA256

    807876a6b594dfc8955dc55a0b1d0c85a0b68af137d16749a9c0f09afddc54ad

    SHA512

    22656b1001476a92c2d88c13a71892579bd5d473d4729640ab29b4fd8c95e0f9e81b258d5775ad74f32d5769976d936ec586330ecd768a49d06a8a8da0911a71

    Download Submit

  • \Program Files (x86)\WinThruster\WTNotifications.exe
    Filesize

    1.6MB

    MD5

    d0dc3d8f06003a61fac301a8eeeee76a

    SHA1

    fccf833a8dcbf2dc0a1a99fc239f33f505c7d75b

    SHA256

    af9bc96440542c40ccbe131a7edf352b5510358e69e0f0cfaba008519f96192e

    SHA512

    bbcd5991d879387e71c4fb1f89c0de78166569966bdc0c28233bf6b097c39bcc97101b2e11437fc08b4f33e4e97849b0b20707fd4f1d3296d3a55f7be6e8bc72

    Download Submit

  • \Program Files (x86)\WinThruster\WinThruster.exe
    Filesize

    310KB

    MD5

    c9504bab9feb64ebbbe06ed053c0dccb

    SHA1

    5e246b156b14600d076f803a5e430dd8e859dee7

    SHA256

    c3b0ba517a757dde8fe4f42bfda8c39746565464175b642c0c9f0174c130c628

    SHA512

    e806a5e38b306c1de4df5cbe572e86078af3b68fcebb51fd7770d8ee779bc9e383905bdae5fe58fcb385581ec61da48ec53257d9ea5d1f0f0922668b33943530

    Download Submit

  • \Program Files (x86)\WinThruster\WinThruster.exe
    Filesize

    2.4MB

    MD5

    19ba5413289bd5bdb23016dd81f68df5

    SHA1

    e78f400fd1d08ff49ba6f9ca497de9d68bbf1e49

    SHA256

    9e679d2e9a1b06dc676128c9899f3ddd5f607f42c1776836714b6370846cb2d2

    SHA512

    ec275c5fdcead323753ca3e3384d3edf9b99955ad7ed4d64fcd4c32be9570a44eef24a53360b2c95160878607e415c2b0f47a09223bfe4841d76f01f341ac61b

    Download Submit

  • \Program Files (x86)\WinThruster\WinThruster.exe
    Filesize

    1.6MB

    MD5

    3cb3ad207b050c6e7722071efaed7e31

    SHA1

    a4212194185dc949dcfa46e266e323579d9d5ad5

    SHA256

    6cdd1c8d553c1c8b21d376b5e2c974960cc674a203794bd993e001fdd1be7cfe

    SHA512

    0b241ad33eb66898cd11c0168b59160b654387c083f4f16be92d6cebfb326516938d02bf16047da8a535d06e0ec1b163eebdc043689b09f9a8bf4d56230e99d6

    Download Submit

  • \Program Files (x86)\WinThruster\WinThruster.exe
    Filesize

    1.3MB

    MD5

    1990e34c5997476abeef4ac6ed945555

    SHA1

    99cf28fe3a61eeca6fc5d1a42a8ef89e9aae9053

    SHA256

    9e91496fba927e9ae82e7a0ac687c496053c1e7b2108c0c519ef2ce6655f5429

    SHA512

    c1c4608e4fed6e4b94721ffc6b0b9af08899d69e3e8dd289e79ef778c742d55d7953625f6392de35e4efbddc5a8beeb1b1c51c7dedbd4cf0656f02d2efae49da

    Download Submit

  • \Program Files (x86)\WinThruster\sqlite3.dll
    Filesize

    1.1MB

    MD5

    fdf0245a035f89de1af8a2091258c9ac

    SHA1

    78536c09808a207f45e901f14de5b038aabaede3

    SHA256

    6120e410ff9e5cad41b47cd5fcb23cc3f8bd8f505a86e158c578e15869489367

    SHA512

    4bd214bc4dbd749a429e1753c59c395344607884e20cfa3e1c0dde655e2c6c1e49ab5388e70112e83c7c71b005a985019e39bb00c1e5c1b8e90b5a3d6219e1c3

    Download Submit

  • \Program Files (x86)\WinThruster\unins000.exe
    Filesize

    1.3MB

    MD5

    2b951ce60041dab07e5cd7f3a1548473

    SHA1

    a342fd447166dbff03f12b6d13637e951e263401

    SHA256

    47dd8e2cdc2af38c518e0566463dd8715f0e97d6ab6563633652be53c65b60e2

    SHA512

    0fee475da945136c0f45254fee15f0dc864654e434ae30036765ddad25e2eb9850b3995ed4f6db43b46aad4999f42af6555d2c4435e79b68bbb21a732b0d9ce2

    Download Submit

  • \Users\Admin\AppData\Local\Temp\is-SPNKP.tmp\Setup_WinThruster_2024.tmp
    Filesize

    3.1MB

    MD5

    16a420e714bb48a8d432e3fd4f30db9f

    SHA1

    989fcf9a41445934e108b0e6b5c65936e9aa242a

    SHA256

    a0b1ac070ed5fc2b0c7e0dcbcfa3d5a127d3fe2c33ac62baf1976ed244bef7a7

    SHA512

    79b866dffad2f0ef572700449a1bd56fd8fee86fb2b454fea2938e14cba3a1ebb979f3d233b81ea19b74480334947f157f7218bb8214c4b86142528d5dd01193

    Download Submit

  • memory/1688-1-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB

    Download

  • memory/1688-109-0x0000000000400000-0x00000000004E4000-memory.dmp

    Filesize

    912KB

    Download

  • memory/2136-107-0x0000000000400000-0x000000000071D000-memory.dmp

    Filesize

    3.1MB

    Download

  • memory/2136-8-0x0000000000240000-0x0000000000241000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2784-176-0x0000000000220000-0x0000000000721000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/2784-215-0x0000000000220000-0x0000000000721000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/2784-158-0x0000000000220000-0x0000000000721000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/2784-159-0x0000000061E00000-0x0000000061EF4000-memory.dmp

    Filesize

    976KB

    Download

  • memory/2784-166-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2784-108-0x0000000000080000-0x0000000000081000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2784-168-0x0000000000220000-0x0000000000721000-memory.dmp

    Filesize

    5.0MB

    Download

  • memory/2788-161-0x0000000061E00000-0x0000000061EF4000-memory.dmp

    Filesize

    976KB

    Download

  • memory/2788-164-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-178-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-183-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-187-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-170-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-167-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2788-174-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-160-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-195-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-199-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-211-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-213-0x0000000000C00000-0x000000000165E000-memory.dmp

    Filesize

    10.4MB

    Download

  • memory/2788-214-0x0000000061E00000-0x0000000061EF4000-memory.dmp

    Filesize

    976KB

    Download

  • memory/2788-111-0x0000000000200000-0x0000000000201000-memory.dmp

    Filesize

    4KB

    Download