Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
28/02/2024, 02:50
Static task
static1
Behavioral task
behavioral1
Sample
Crack/GiantDiskCleaner.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Crack/GiantDiskCleaner.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Crack/非常世纪资源网.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Crack/非常世纪资源网.url
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Setup.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
Setup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
非常世纪资源网.url
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
非常世纪资源网.url
Resource
win10v2004-20240226-en
General
-
Target
Setup.exe
-
Size
1.8MB
-
MD5
931e5d0a37b8dcc4ba8420dc697b5989
-
SHA1
257459cbf737b4b602371400664e7d63ad123101
-
SHA256
e8600415d5338fb1aece5778b7154535c9965bdd2624b5f75756d54253521de5
-
SHA512
c8d7de99d53db53a9525b5c7106a9bc44abd590139fc55f9cb3371585e27a2b7be3f918669d430a42d63a64ca08b9041afe64657a30c0ea5595820ca8786ab77
-
SSDEEP
49152:76dRjGssmTPQOAYMrdBAV89KzmhDKndKhVbv4e:edRjGFmT4OAYMrdBu89Kzm2d0Vb1
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2932 is-2J678.tmp -
Loads dropped DLL 3 IoCs
pid Process 2112 Setup.exe 2932 is-2J678.tmp 2932 is-2J678.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2932 is-2J678.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2112 wrote to memory of 2932 2112 Setup.exe 28 PID 2112 wrote to memory of 2932 2112 Setup.exe 28 PID 2112 wrote to memory of 2932 2112 Setup.exe 28 PID 2112 wrote to memory of 2932 2112 Setup.exe 28 PID 2112 wrote to memory of 2932 2112 Setup.exe 28 PID 2112 wrote to memory of 2932 2112 Setup.exe 28 PID 2112 wrote to memory of 2932 2112 Setup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\is-8OJU2.tmp\is-2J678.tmp"C:\Users\Admin\AppData\Local\Temp\is-8OJU2.tmp\is-2J678.tmp" /SL4 $70120 "C:\Users\Admin\AppData\Local\Temp\Setup.exe" 1623082 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2932
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
647KB
MD5b683339ce008e97a0243a0f83bca1e09
SHA1a8a4c078225ec9d94912762bda3a745d83dbe8f4
SHA2565c6b8a1ab73cd03140040a3093e0d8466c666cd3fe17e8660dbc1a30d0b6f925
SHA512c39b2501f5887c363633c94b04d58396a0d285ff65963ed513e99ff2dd7f36da323904278c6a64b9f1f637aaeed17e3d9d40540baa9805369cc664a32c62c780
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3