Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1791s -
max time network
1560s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
15/06/2024, 15:59
Static task
static1
Behavioral task
behavioral1
Sample
revosetup.exe
Resource
win7-20240611-en
General
-
Target
revosetup.exe
-
Size
6.6MB
-
MD5
63150c4846bfbcf27fa70ccaa8a01943
-
SHA1
bfe32dcc00b041e0007a883af1588f354bb9f032
-
SHA256
a05acc9172e98ec6a6a7f923f5c648cc7a7c4e02bbcaaa5a6d9663229e662c24
-
SHA512
7c0c8065c83529ffe9cf092a7ffb19f59252015d643bded9cf5459e6e6a4c582962ab6e36b330275a79649fa6e8d3da01cb95352870a52fa159bb278b967cd90
-
SSDEEP
98304:MPyYn2kIIR7ABl27MwarecfhZzwStzDtAVl3gaSZmg4MPyDv0bSpkmmf6osFQaiS:q7Vty27MJzw6z8X4mgJSyNyos6ac4l
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2184 revosetup.tmp -
Loads dropped DLL 1 IoCs
pid Process 2192 revosetup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2192 wrote to memory of 2184 2192 revosetup.exe 28 PID 2192 wrote to memory of 2184 2192 revosetup.exe 28 PID 2192 wrote to memory of 2184 2192 revosetup.exe 28 PID 2192 wrote to memory of 2184 2192 revosetup.exe 28 PID 2192 wrote to memory of 2184 2192 revosetup.exe 28 PID 2192 wrote to memory of 2184 2192 revosetup.exe 28 PID 2192 wrote to memory of 2184 2192 revosetup.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\revosetup.exe"C:\Users\Admin\AppData\Local\Temp\revosetup.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\is-4DNET.tmp\revosetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-4DNET.tmp\revosetup.tmp" /SL5="$50154,6355320,266240,C:\Users\Admin\AppData\Local\Temp\revosetup.exe"2⤵
- Executes dropped EXE
PID:2184
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD57b77e7c3ebd213d95c4d909716f10030
SHA11c00eb97b4f154e209162bee83a84a6f1d1ef034
SHA256a1bab1631135a982dfec6024b1ef8eb1ea2bce519cd832d9151e95e8def916d2
SHA512fb6f95d42a936911b66861280cdeee77e2125c6b30141eb66daff402453d635a87a7f8ec9435ceb7ad4fddb473d6347a787bedb5649aa3abb234aceeeaaf8dcd