Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
05/03/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
setuppig.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
setuppig.exe
Resource
win10v2004-20240226-en
General
-
Target
setuppig.exe
-
Size
820KB
-
MD5
d0ae361cb1868061739d782b630753e8
-
SHA1
c6fb1d1f69c38300799421fd6a6599ee9a096115
-
SHA256
c862479a4b5a154be9281898bdac95d696d7747ca29ac0f73c63b7dc2e55f299
-
SHA512
afb68b204af6f58607a3518868615c8c63edd7bec2e3df20ad79d314ac7ee219b0b1b8214011055c1ef58d8b9be046277144036ca668b7b1df336457376c5335
-
SSDEEP
24576:7I39dwOfdl5EEDkEmaWRBjTIFDSXCu6XNA15UrMV:76dwI53maWbH69E5UrM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2184 is-J3SBI.tmp -
Loads dropped DLL 3 IoCs
pid Process 2868 setuppig.exe 2184 is-J3SBI.tmp 2184 is-J3SBI.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2184 is-J3SBI.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2868 wrote to memory of 2184 2868 setuppig.exe 28 PID 2868 wrote to memory of 2184 2868 setuppig.exe 28 PID 2868 wrote to memory of 2184 2868 setuppig.exe 28 PID 2868 wrote to memory of 2184 2868 setuppig.exe 28 PID 2868 wrote to memory of 2184 2868 setuppig.exe 28 PID 2868 wrote to memory of 2184 2868 setuppig.exe 28 PID 2868 wrote to memory of 2184 2868 setuppig.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\setuppig.exe"C:\Users\Admin\AppData\Local\Temp\setuppig.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\is-JI9NI.tmp\is-J3SBI.tmp"C:\Users\Admin\AppData\Local\Temp\is-JI9NI.tmp\is-J3SBI.tmp" /SL4 $70120 "C:\Users\Admin\AppData\Local\Temp\setuppig.exe" 605953 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2184
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
635KB
MD55ba571eb89bacef396539841970711b0
SHA1f51e65174a43784710cc2b03a5129f21f3578644
SHA256440f88196d6586d81917097b39bfb98bf338afc24116434de0c25c356e2d7452
SHA512ee46d826d1da230f75ec2e2d96ad1aa918a7f71f530422ee58cc4c50272fce08950eceadd52b103937b36039af44ce1cadeb9d6a1c8eeecdf6e8d07274471a54
-
Filesize
365KB
MD5da631dc814f2895fed7234d095b3e820
SHA17f3bbcec8cefe96f298afbbc42d42ebcb42adf1d
SHA256b6db5e24731b6e5d856bdd2f5653939b64be675d0461a505361df67169f8851f
SHA5120fbfcb07d07309489114758d37ff2947e4ba7412b4b70ff55baca05096a7f6503502f41c19c938604aa79434023c20fcd800689bed3ebfe4b07b61f8ba219abf
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3