Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
cdcsetup.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cdcsetup.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
keygen/keygen.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
keygen/keygen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
安装说明.url
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
安装说明.url
Resource
win10v2004-20240226-en
General
-
Target
cdcsetup.exe
-
Size
1.5MB
-
MD5
fb9464d4514205f98d5457cca062525f
-
SHA1
8ed1337bd4b2f82394b0bf4a33d28fe94007632e
-
SHA256
c63a0619d25440c0ae7722dc587f0507f379b64cbdc15406c2b4bc2dade6ddcb
-
SHA512
4fc3c922f87fb4ccc96212cc7b667c8b3fc0d1e5d336e0e9bca7e236972e6c3a3a555ee997272d20ea643f35bdd8a56541646a568936b5f751ecfec8029a2d43
-
SSDEEP
24576:0pniR/ZlShrl/BdJ9sqZC/RvvxcGJdfykoLt+TgOSPrnkmZgc+CsDHSw5AkNE1zn:qinmp/Tz1C5H/DgZPbVSDyYATky7
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2696 is-5HUOP.tmp -
Loads dropped DLL 3 IoCs
pid Process 1540 cdcsetup.exe 2696 is-5HUOP.tmp 2696 is-5HUOP.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2696 is-5HUOP.tmp -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1540 wrote to memory of 2696 1540 cdcsetup.exe 28 PID 1540 wrote to memory of 2696 1540 cdcsetup.exe 28 PID 1540 wrote to memory of 2696 1540 cdcsetup.exe 28 PID 1540 wrote to memory of 2696 1540 cdcsetup.exe 28 PID 1540 wrote to memory of 2696 1540 cdcsetup.exe 28 PID 1540 wrote to memory of 2696 1540 cdcsetup.exe 28 PID 1540 wrote to memory of 2696 1540 cdcsetup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdcsetup.exe"C:\Users\Admin\AppData\Local\Temp\cdcsetup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\is-AE5T7.tmp\is-5HUOP.tmp"C:\Users\Admin\AppData\Local\Temp\is-AE5T7.tmp\is-5HUOP.tmp" /SL4 $70120 "C:\Users\Admin\AppData\Local\Temp\cdcsetup.exe" 1210183 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2696
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
642KB
MD53c9f925549a51f9017e08a072332fa47
SHA11bff860e744467a58ef986b1016a4454844f5ad7
SHA2561eb6ba689a47d91d01c9b3caa93daacec49c7b6daafb217678b9ad8f545c8ac2
SHA51286112ec0d9f4254bceb0a576bc03e09384a15a4a5e94b08ca65ddfbc60d9d8d459885138c2644c9309ac86bca0b86d41c92dbc8ed23d7d381cdbeb2d7963ec18
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3