Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
14/02/2024, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
setup1.31.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
setup1.31.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
新云软件.url
Resource
win10v2004-20231215-en
General
-
Target
setup1.31.exe
-
Size
1.8MB
-
MD5
26a90f40ec53ec0ccbd942a4181a2bb1
-
SHA1
0ff8b60227cb8bbc44e2cc310e3eab7bc549b0f3
-
SHA256
e028fe537bb56b17538879f5ca317b558c750a44d4b5c78f8fbb5e6a62fbc8c5
-
SHA512
d4188733ee8c4c7aed738dd647ae193959a17371b947536fe20e01fb1040e64760002e0748cfd2f9b11c6cc6f431225cc793d7d01a85ce529e3d484008fa50e2
-
SSDEEP
49152:wl8eOFRXWnr3GuAy0rtrh/TOpopGYefxOj:wZznDh0zLpefE
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 632 irsetup.exe -
Loads dropped DLL 4 IoCs
pid Process 2448 setup1.31.exe 632 irsetup.exe 632 irsetup.exe 632 irsetup.exe -
resource yara_rule behavioral1/files/0x000d000000012716-5.dat upx behavioral1/memory/2448-4-0x00000000021F0000-0x0000000002317000-memory.dmp upx behavioral1/memory/632-6-0x0000000000400000-0x0000000000527000-memory.dmp upx behavioral1/memory/632-11-0x0000000000AB0000-0x0000000000BD7000-memory.dmp upx behavioral1/memory/632-23-0x0000000000400000-0x0000000000527000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\º£´æÍøÅÌ Setup Log.txt irsetup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 632 irsetup.exe 632 irsetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2448 wrote to memory of 632 2448 setup1.31.exe 28 PID 2448 wrote to memory of 632 2448 setup1.31.exe 28 PID 2448 wrote to memory of 632 2448 setup1.31.exe 28 PID 2448 wrote to memory of 632 2448 setup1.31.exe 28 PID 2448 wrote to memory of 632 2448 setup1.31.exe 28 PID 2448 wrote to memory of 632 2448 setup1.31.exe 28 PID 2448 wrote to memory of 632 2448 setup1.31.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup1.31.exe"C:\Users\Admin\AppData\Local\Temp\setup1.31.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\_ir_sf7_temp_0\irsetup.exe__IRAOFF:520716 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\setup1.31.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:632
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
440KB
MD575ca7ff96bf5a316c3af2de6a412bd54
SHA10a093950790ff0dddff6f5f29c6b02c10997e0c5
SHA256d95b5bf9ca97c1900de5357743282bab655d61d616606485088e1708559b7cf1
SHA512b8da86f2f1e908955254e5168d0447f479cec7815a8b081a7b38eb87187cb2eb992109c67e006361b96bc1529ee8abc9dc477d78e9ca565e43f5415b492771d4