Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    165s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/03/2024, 15:47

General

  • Target

    setuppig.exe

  • Size

    820KB

  • MD5

    d0ae361cb1868061739d782b630753e8

  • SHA1

    c6fb1d1f69c38300799421fd6a6599ee9a096115

  • SHA256

    c862479a4b5a154be9281898bdac95d696d7747ca29ac0f73c63b7dc2e55f299

  • SHA512

    afb68b204af6f58607a3518868615c8c63edd7bec2e3df20ad79d314ac7ee219b0b1b8214011055c1ef58d8b9be046277144036ca668b7b1df336457376c5335

  • SSDEEP

    24576:7I39dwOfdl5EEDkEmaWRBjTIFDSXCu6XNA15UrMV:76dwI53maWbH69E5UrM

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setuppig.exe
    "C:\Users\Admin\AppData\Local\Temp\setuppig.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2484
    • C:\Users\Admin\AppData\Local\Temp\is-UB046.tmp\is-GII9A.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-UB046.tmp\is-GII9A.tmp" /SL4 $A0044 "C:\Users\Admin\AppData\Local\Temp\setuppig.exe" 605953 52224
      2⤵
      • Executes dropped EXE
      PID:1556

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-UB046.tmp\is-GII9A.tmp

    Filesize

    635KB

    MD5

    5ba571eb89bacef396539841970711b0

    SHA1

    f51e65174a43784710cc2b03a5129f21f3578644

    SHA256

    440f88196d6586d81917097b39bfb98bf338afc24116434de0c25c356e2d7452

    SHA512

    ee46d826d1da230f75ec2e2d96ad1aa918a7f71f530422ee58cc4c50272fce08950eceadd52b103937b36039af44ce1cadeb9d6a1c8eeecdf6e8d07274471a54

  • memory/1556-6-0x0000000002250000-0x0000000002251000-memory.dmp

    Filesize

    4KB

  • memory/1556-12-0x0000000000400000-0x00000000004CD000-memory.dmp

    Filesize

    820KB

  • memory/1556-15-0x0000000002250000-0x0000000002251000-memory.dmp

    Filesize

    4KB

  • memory/2484-0-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB

  • memory/2484-11-0x0000000000400000-0x0000000000413000-memory.dmp

    Filesize

    76KB