Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/06/2024, 16:07
Static task
static1
Behavioral task
behavioral1
Sample
setup.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
setup.exe
Resource
win11-20240508-en
General
-
Target
setup.exe
-
Size
7.3MB
-
MD5
a1df486847d419d03a3a4f2073d1d570
-
SHA1
c047c6ef9a5d224f7875dde8fa30caf76bdf80f1
-
SHA256
fda22578cd2482b6709d3a8a29c727605940f839971e15b3d3d9fea11e09f4f2
-
SHA512
90935f3b854c3779e4790eae376e0e44f5fc9e36c3167b49c0f4d9a1dd11df0de2b5e45dc0b165395fbb5f0824d86b8f728847604947ec75360d32d370ac9366
-
SSDEEP
98304:yf7wCQInrje/CAVMJy1WEEOOMBUUneNpqwVJ8aN5cOKIekjC5wTg4Er9dtQN:yfn6/VSlE/RQPyIJxE5dM
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3516 setup.tmp -
Loads dropped DLL 11 IoCs
pid Process 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp 3516 setup.tmp -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 3768 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 3768 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3516 setup.tmp -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3140 wrote to memory of 3516 3140 setup.exe 82 PID 3140 wrote to memory of 3516 3140 setup.exe 82 PID 3140 wrote to memory of 3516 3140 setup.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\is-N8FRB.tmp\setup.tmp"C:\Users\Admin\AppData\Local\Temp\is-N8FRB.tmp\setup.tmp" /SL5="$7006C,7086566,140800,C:\Users\Admin\AppData\Local\Temp\setup.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:3516
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x47c 0x42c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3768
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
103KB
MD58005750ec63eb5292884ad6183ae2e77
SHA1c83e31655e271cd9ef5bff62b10f8d51eb3ebf29
SHA256df9f56c4da160101567b0526845228ee481ee7d2f98391696fa27fe41f8acf15
SHA512febbc6374e9a5c7c9029ccbff2c0ecf448d76927c8d720a4eae513b345d2a3f6de8cf774ae40dcd335af59537666e83ce994ec0adc8b9e8ab4575415e3c3e206
-
Filesize
4KB
MD5f07e819ba2e46a897cfabf816d7557b2
SHA18d5fd0a741dd3fd84650e40dd3928ae1f15323cc
SHA25668f42a7823ed7ee88a5c59020ac52d4bbcadf1036611e96e470d986c8faa172d
SHA5127ed26d41ead2ace0b5379639474d319af9a3e4ed2dd9795c018f8c5b9b533fd36bfc1713a1f871789bf14884d186fd0559939de511dde24673b0515165d405af
-
Filesize
380KB
MD563dc27b7bc65243efaa59a9797a140ba
SHA122f893aefcebecc9376e2122a3321befa22cdd73
SHA256c652b4b564b3c85c399155cbb45c6fb5a9f56f074e566bfd20f01da6e0412c74
SHA5123df72dc171baa4698dfd0c324a96dde79eb1c8909f2ff7d8da40e5ca1de08f1fc26298139ab618e0bb3fa168efe5d6059398b90d8ff5f88e54c7988c21fb679e
-
Filesize
1KB
MD5473a683962d3375a00f93dd8ce302158
SHA11c0709631834fd3715995514eef875b2b968a6be
SHA2567f4ad4d912cdabdfbb227387759db81434e20583687737f263d4f247326f0c1a
SHA51224ffe03b5de8aec324c363b4be1d0ae4c8981176a9f78a359f140de792251e4f2e3e82e2a6f3c19ff686de5588e8665409ddc56fc9532418f6d476869f3f1f9e
-
Filesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
Filesize
220KB
MD5af555ac9c073f88fe5bf0d677f085025
SHA15fff803cf273057c889538886f6992ea05dd146e
SHA256f4fc0187491a9cb89e233197ff72c2405b5ec02e8b8ea640ee68d034ddbc44bb
SHA512c61bf21a5b81806e61aae1968d39833791fd534fc7bd2c85887a5c0b2caedab023d94efdbbfed2190b087086d3fd7b98f2737a65f4536ab603dec67c9a8989f5
-
Filesize
63KB
MD51c55ae5ef9980e3b1028447da6105c75
SHA1f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA2566afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
SHA5121ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
-
Filesize
16KB
MD59436df49e08c83bad8ddc906478c2041
SHA1a4fa6bdd2fe146fda2e78fdbab355797f53b7dce
SHA2561910537aa95684142250ca0c7426a0b5f082e39f6fbdbdba649aecb179541435
SHA512f9dc6602ab46d709efdaf937dcb8ae517caeb2bb1f06488c937be794fd9ea87f907101ae5c7f394c7656a6059dc18472f4a6747dcc8cc6a1e4f0518f920cc9bf
-
Filesize
1.4MB
MD5ae9890548f2fcab56a4e9ae446f55b3f
SHA1e17c970eebbe6d7d693c8ac5a7733218800a5a96
SHA25609af8004b85478e1eca09fa4cb5e3081dddcb2f68a353f3ef6849d92be47b449
SHA512154b6f66ff47db48ec0788b8e67e71f005b51434920d5d921ac2a5c75745576b9b960e2e53c6a711f90f110ad2372ef63045d2a838bc302367369ef1731c80eb