Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/02/2024, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
blur-installer.exe
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
blur-installer.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
blur-installer.exe
Resource
win11-20231215-en
General
-
Target
blur-installer.exe
-
Size
56.0MB
-
MD5
cc8d0921084401992c3f84cf6db0a9a5
-
SHA1
0f85447fa43ba0d77d60e857ed238f046347c4c5
-
SHA256
adeb24697fb2c829c513f1812aa5645717640599a5aeb964d45ec616e0ebd6b6
-
SHA512
dc662cfb40416553cad0738fe4c7407f3b04457f47bd766832a694f896e5834956eefe5bacce32022de33bca1a637e85f589479fe38b89b03ef259439753e644
-
SSDEEP
1572864:njXb31SEpfRrEE1sioTNq9ikYyjgL7c31nppNOnFMQi:njx1J7+ioyikY+gH41nppNlH
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1672 blur-installer.tmp 4236 VC_redist.x86.exe 6096 VC_redist.x86.exe -
Loads dropped DLL 1 IoCs
pid Process 6096 VC_redist.x86.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1672 blur-installer.tmp 1672 blur-installer.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1672 blur-installer.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4500 wrote to memory of 1672 4500 blur-installer.exe 80 PID 4500 wrote to memory of 1672 4500 blur-installer.exe 80 PID 4500 wrote to memory of 1672 4500 blur-installer.exe 80 PID 1672 wrote to memory of 4236 1672 blur-installer.tmp 81 PID 1672 wrote to memory of 4236 1672 blur-installer.tmp 81 PID 1672 wrote to memory of 4236 1672 blur-installer.tmp 81 PID 4236 wrote to memory of 6096 4236 VC_redist.x86.exe 82 PID 4236 wrote to memory of 6096 4236 VC_redist.x86.exe 82 PID 4236 wrote to memory of 6096 4236 VC_redist.x86.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\blur-installer.exe"C:\Users\Admin\AppData\Local\Temp\blur-installer.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\is-1QTRA.tmp\blur-installer.tmp"C:\Users\Admin\AppData\Local\Temp\is-1QTRA.tmp\blur-installer.tmp" /SL5="$7020E,57819947,879104,C:\Users\Admin\AppData\Local\Temp\blur-installer.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\is-GAQKF.tmp\VC_redist.x86.exe"C:\Users\Admin\AppData\Local\Temp\is-GAQKF.tmp\VC_redist.x86.exe" /install /passive /norestart3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\Temp\{3D93C64B-BE4D-4F86-8787-24A668E1C871}\.cr\VC_redist.x86.exe"C:\Windows\Temp\{3D93C64B-BE4D-4F86-8787-24A668E1C871}\.cr\VC_redist.x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\is-GAQKF.tmp\VC_redist.x86.exe" -burn.filehandle.attached=564 -burn.filehandle.self=572 /install /passive /norestart4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6096
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Lib\site-packages\setuptools-58.0.4.dist-info\is-TM545.tmp
Filesize4B
MD5365c9bfeb7d89244f2ce01c1de44cb85
SHA1d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
-
C:\Users\Admin\AppData\Local\Programs\blur\lib\vapoursynth\Lib\site-packages\wheel\vendored\packaging\is-3ECCM.tmp
Filesize1KB
MD5b0dac8ef6953fb835c7d633e6a427ba7
SHA1f521b39e0501e178412d557ac85d625626b85326
SHA256c79f44850e7b4cc4fe9134722d9576e4766f6061b06ee713a3a88a87f3b4b4cc
SHA512de5d2189075a26dc2e9ba41c1bbf2d4ccd3d5fb475802a0d7a70e311a301c4c4cb619d9f15c6263a420583b4f8bf87fcd589d6f96fe7b1edc367b875d54cfdda
-
Filesize
103KB
MD5449919a8dbc0882ab75fbeb012634dd7
SHA1c457948d731f7d414a0f06a75c348d4035b19c86
SHA256f5ddfb8a27580e38c964a5455704a51df94e3796723ba145ed8ac44734110e93
SHA5120d0d94e063d6c49c4e4fc8e1dd933e6a4acca48cd875d274543a134b849f0db2aa5f92826c0dc3f728817b9adf005947ca0f94c878ae139ac9d372518c43fb91
-
Filesize
2.4MB
MD5631a84aa53ac86810c968de7cc3ad668
SHA15b2668a23901e518d8afe227084d15fb9827a42c
SHA256063f708bb216d19679baf007405c3b928b0ae00ef8a6d0e458ffa1a69403f261
SHA5124d12cc9979d0a9fd83e60e729731eb9faceec12e6822bc2101329983cc5fbefe3b9d49a55d6110a88cdd0243d805bd4ea8d2aa157d7873c1fdef7c70f8540510
-
Filesize
422KB
MD58ee366a5cbd12d0ba374d206337c49a7
SHA1c9045aeaffaa0070ecc6851833b01df041ca3065
SHA2562fc8dcb79e7eddfd92136ff2edb8f46b6351077ca30cce70be7b9c055970ddf9
SHA5128dfb6280994887118e7b7ab369a8eec22b9bc3b759c80c58823f0cdd36e74f7ce5ae3baf16879fb583298da69971fe955d9e7c72b1e63352e9f01c58ff630e31
-
Filesize
1.2MB
MD5fead96953149186cc5f8cbdc83fb22bd
SHA1316bce9c71a233a272abb29af0e40d1beee349ee
SHA256f30d30b24c31ba87ad822a09b79a74ef3eb9dc7ed8307bb22a4289ef05d0ccbe
SHA5127ea2435c79dd5822fcf0e88e4b020643f35d6763bacd51d01d57bfabc2886af49afbdfac4ab223356f6d6f41febf4acc194ec59526df6ff687923a9847e78b90
-
Filesize
1.1MB
MD59b757b69017da67662e6a9661018cc46
SHA1df563c37b3abb914b8aefc1784c77758024666d9
SHA2567a3d4bf81cc0232b84029d05fbc90728fa9c4e95c3de784e64ccd013305b3c2f
SHA5126e54abc59c91d0651d05ff9c0b2909aecde1c8ea38679cb404eed5dde8644a3be31fda21f2805799c5e923b3e68e7a5def83e22f0f5f99549e1c1d987c86912c
-
Filesize
618KB
MD51d85081c270ceb9d1ed815cc42cedf28
SHA11b0c179e4518acd1adc3d61c6f1e7f6b4e2c229b
SHA2565fbac8182425faa2db5db47aae68d01ae52528d5855f2dc6307c7cc4ec530bf7
SHA512ddbfd12db80f6fc76bb6ca19c0f0429b6730a3a8f29e66284a6b0ded3e8ea8e86bffc4c87491bc9242362564ec61eb1d97fe48b3c8cefe82c146e6ee3a21ae4b
-
Filesize
632KB
MD51636039e4940c80acaeb369852f79cef
SHA17d2b5110d1bf729d7fcd9e42a2b01a58dcc66a69
SHA256d116ecd1f04402430eb8ff5e07357f7ab2a2e0aa12dd6c5156e7f92705568e0e
SHA5123ba5c3225b74594d6121a45f225204e8eb4b80afc60849fe78a933afcc81f8db7221cdcbe5789ade1b3f2d784dc3659c08692f7bd808b85198cb78e601d8da02
-
Filesize
1KB
MD5d6bd210f227442b3362493d046cea233
SHA1ff286ac8370fc655aea0ef35e9cf0bfcb6d698de
SHA256335a256d4779ec5dcf283d007fb56fd8211bbcaf47dcd70fe60ded6a112744ef
SHA512464aaab9e08de610ad34b97d4076e92dc04c2cdc6669f60bfc50f0f9ce5d71c31b8943bd84cee1a04fb9ab5bbed3442bd41d9cb21a0dd170ea97c463e1ce2b5b
-
Filesize
191KB
MD5eab9caf4277829abdf6223ec1efa0edd
SHA174862ecf349a9bedd32699f2a7a4e00b4727543d
SHA256a4efbdb2ce55788ffe92a244cb775efd475526ef5b61ad78de2bcdfaddac7041
SHA51245b15ade68e0a90ea7300aeb6dca9bc9e347a63dba5ce72a635957564d1bdf0b1584a5e34191916498850fc7b3b7ecfbcbfcb246b39dbf59d47f66bc825c6fd2