Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 15:47
Static task
static1
Behavioral task
behavioral1
Sample
setuppig.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
setuppig.exe
Resource
win10v2004-20240226-en
General
-
Target
setuppig.exe
-
Size
820KB
-
MD5
d0ae361cb1868061739d782b630753e8
-
SHA1
c6fb1d1f69c38300799421fd6a6599ee9a096115
-
SHA256
c862479a4b5a154be9281898bdac95d696d7747ca29ac0f73c63b7dc2e55f299
-
SHA512
afb68b204af6f58607a3518868615c8c63edd7bec2e3df20ad79d314ac7ee219b0b1b8214011055c1ef58d8b9be046277144036ca668b7b1df336457376c5335
-
SSDEEP
24576:7I39dwOfdl5EEDkEmaWRBjTIFDSXCu6XNA15UrMV:76dwI53maWbH69E5UrM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1556 is-GII9A.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2484 wrote to memory of 1556 2484 setuppig.exe 88 PID 2484 wrote to memory of 1556 2484 setuppig.exe 88 PID 2484 wrote to memory of 1556 2484 setuppig.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\setuppig.exe"C:\Users\Admin\AppData\Local\Temp\setuppig.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\is-UB046.tmp\is-GII9A.tmp"C:\Users\Admin\AppData\Local\Temp\is-UB046.tmp\is-GII9A.tmp" /SL4 $A0044 "C:\Users\Admin\AppData\Local\Temp\setuppig.exe" 605953 522242⤵
- Executes dropped EXE
PID:1556
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
635KB
MD55ba571eb89bacef396539841970711b0
SHA1f51e65174a43784710cc2b03a5129f21f3578644
SHA256440f88196d6586d81917097b39bfb98bf338afc24116434de0c25c356e2d7452
SHA512ee46d826d1da230f75ec2e2d96ad1aa918a7f71f530422ee58cc4c50272fce08950eceadd52b103937b36039af44ce1cadeb9d6a1c8eeecdf6e8d07274471a54