Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    05/03/2024, 15:47

General

  • Target

    setuppig.exe

  • Size

    820KB

  • MD5

    d0ae361cb1868061739d782b630753e8

  • SHA1

    c6fb1d1f69c38300799421fd6a6599ee9a096115

  • SHA256

    c862479a4b5a154be9281898bdac95d696d7747ca29ac0f73c63b7dc2e55f299

  • SHA512

    afb68b204af6f58607a3518868615c8c63edd7bec2e3df20ad79d314ac7ee219b0b1b8214011055c1ef58d8b9be046277144036ca668b7b1df336457376c5335

  • SSDEEP

    24576:7I39dwOfdl5EEDkEmaWRBjTIFDSXCu6XNA15UrMV:76dwI53maWbH69E5UrM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setuppig.exe
    "C:\Users\Admin\AppData\Local\Temp\setuppig.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\is-JI9NI.tmp\is-J3SBI.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JI9NI.tmp\is-J3SBI.tmp" /SL4 $70120 "C:\Users\Admin\AppData\Local\Temp\setuppig.exe" 605953 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: GetForegroundWindowSpam
      PID:2184

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-JI9NI.tmp\is-J3SBI.tmp

    Filesize

    635KB

    MD5

    5ba571eb89bacef396539841970711b0

    SHA1

    f51e65174a43784710cc2b03a5129f21f3578644

    SHA256

    440f88196d6586d81917097b39bfb98bf338afc24116434de0c25c356e2d7452

    SHA512

    ee46d826d1da230f75ec2e2d96ad1aa918a7f71f530422ee58cc4c50272fce08950eceadd52b103937b36039af44ce1cadeb9d6a1c8eeecdf6e8d07274471a54

  • \Users\Admin\AppData\Local\Temp\is-JI9NI.tmp\is-J3SBI.tmp

    Filesize

    365KB

    MD5

    da631dc814f2895fed7234d095b3e820

    SHA1

    7f3bbcec8cefe96f298afbbc42d42ebcb42adf1d

    SHA256

    b6db5e24731b6e5d856bdd2f5653939b64be675d0461a505361df67169f8851f

    SHA512

    0fbfcb07d07309489114758d37ff2947e4ba7412b4b70ff55baca05096a7f6503502f41c19c938604aa79434023c20fcd800689bed3ebfe4b07b61f8ba219abf

  • \Users\Admin\AppData\Local\Temp\is-RTQ1N.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • memory/2184-16-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/2868-1-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2868-15-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB