Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    51s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/06/2024, 00:38

General

  • Target

    setup.exe

  • Size

    3.1MB

  • MD5

    e2aca2b2deb86d9ea1d6366a64116409

  • SHA1

    61b41909160be6c93c8541a24d3fd38f354ddbea

  • SHA256

    d3b72b8843161aab5e17f1a9b2f0bc14be06a9c905328b48eb39230cfe638f5c

  • SHA512

    11f22c59276b518e3303548e3e8321347052de048844a48a75b840d141f1dd5ba5c4ef105aa35924d380eff8dbdf9454bdf99cba55ff6d70c5d24f6fe96df1ea

  • SSDEEP

    49152:6kVfvS+pDTGuzVnck9inHEywFQXHdG5DSDgWeLB38EwAxaJq1EWgges5y1a2rT9h:6Gf62yuzAH9w8HA5+Dz6tAQsjT9

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 1 IoCs
  • Drops file in System32 directory 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Modifies firewall policy service
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    PID:3400
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    1⤵
      PID:4040
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
      1⤵
        PID:2724

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\System32\GroupPolicy\gpt.ini

        Filesize

        127B

        MD5

        8ef9853d1881c5fe4d681bfb31282a01

        SHA1

        a05609065520e4b4e553784c566430ad9736f19f

        SHA256

        9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

        SHA512

        5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

      • memory/3400-0-0x00007FF7E1425000-0x00007FF7E15EB000-memory.dmp

        Filesize

        1.8MB

      • memory/3400-1-0x00007FFE9F050000-0x00007FFE9F052000-memory.dmp

        Filesize

        8KB

      • memory/3400-2-0x00007FFE9F060000-0x00007FFE9F062000-memory.dmp

        Filesize

        8KB

      • memory/3400-3-0x00007FFE9D6E0000-0x00007FFE9D6E2000-memory.dmp

        Filesize

        8KB

      • memory/3400-4-0x00007FFE9D6F0000-0x00007FFE9D6F2000-memory.dmp

        Filesize

        8KB

      • memory/3400-5-0x00007FFE9C9C0000-0x00007FFE9C9C2000-memory.dmp

        Filesize

        8KB

      • memory/3400-7-0x00007FF7E12C0000-0x00007FF7E18F1000-memory.dmp

        Filesize

        6.2MB

      • memory/3400-6-0x00007FFE9C9D0000-0x00007FFE9C9D2000-memory.dmp

        Filesize

        8KB

      • memory/3400-18-0x00007FF7E1425000-0x00007FF7E15EB000-memory.dmp

        Filesize

        1.8MB