Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
19/06/2024, 14:06
General
-
Target
Setupprogram_01234.exe
-
Size
26.8MB
-
MD5
8855431f6861ce61ae7b518373ce2454
-
SHA1
b4ac109a3e284df6a56af00aa7a1fe9ffd8f7fc4
-
SHA256
fa4fd0fbe285908c10eef2c6736de6c0776b38e5c6a7ba18371dedd39e36b451
-
SHA512
64b6e8b11cd6076f506f48918d9e7fff23acf1fdc00624440a2a5c4d3360402ed1c88b0105ec696d1211dab9f3e9b5d4d161dbd4cf21184d974fec40b34d3774
-
SSDEEP
786432:MGR2OZUU3y7UMxDsEUAsJYPBgGkpbqRAw2elablkTVI:MyrSPBgGzOeelkhI
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 4 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe"C:\Users\Admin\AppData\Local\Temp\Setupprogram_01234.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\verclsid.exe"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x4011⤵
-
C:\Users\Admin\AppData\Local\MPC-HC\MPC-HC.2.1.7.2.x86.exe"C:\Users\Admin\AppData\Local\MPC-HC\MPC-HC.2.1.7.2.x86.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-8OBN0.tmp\MPC-HC.2.1.7.2.x86.tmp"C:\Users\Admin\AppData\Local\Temp\is-8OBN0.tmp\MPC-HC.2.1.7.2.x86.tmp" /SL5="$11015A,18872303,845824,C:\Users\Admin\AppData\Local\MPC-HC\MPC-HC.2.1.7.2.x86.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.0MB
MD50cf0be4175f4c4cbc1f0244ea173f4f8
SHA1e9eef43e43ef820cc23f3a9b7259ae9f247474bf
SHA256495ee02835490d2fd1e18b688c904757e6d727f4f2e344d2e20700b6860a1047
SHA5125b913a1ee7dd250881f7236da76d7f7c43da4caa20b72610fffc7064170a82e5f42e084f278a054327ae3da947d74eb148d16d273218d88a0d97e5de68f4e8d9
-
Filesize
10.7MB
MD5d916a75438f717dc110c853782c8d2b2
SHA164cdf79c31f540f566b1eb188d52c8dafb835f27
SHA256573d620b32f8ccc1b95b071a7e3f689c77187b4fc898f85b81a24ee0e1570883
SHA512c5c25cb8c6a9539e5ce14bb7af0ff801679bef3b241ddafe1505ba5cf07b1808d6ddb2a253ef3d76c2eee93496fd2f1c5fd8f4f2aa3f7e7275492b3be18c82ff
-
Filesize
3.1MB
MD5cf72d288dfac9cb0b4bfe1ade5c719db
SHA1a77a3b2ed53e03b7043076f6710f0ddc3f8e7fac
SHA256629c5535fa98564b6b35a37b5c036471d22c8ed192319c7653f6ebc4166ea89f
SHA51228ba93aad40b10b912d0995abc4dbbd90e1594669ae708e7f4cfe40c93cbf2a0acb0af8c9e0557627bb53e0439ef12955fe5e50120c907e3824f70b4d9c1ead0
-
Filesize
3.0MB
MD5b60659b89de8a18b8819c0b65b28cf9a
SHA19fbcc417d1cc6a4c7fd1ce1bc04c3bf8cc1cb1da
SHA256356050b9cfc8d089772368a29771beb94f3325e2f223dd5deaec6e15e43667d3
SHA512c4df5f7e9a90bfbe823503bcf4e7b2bc401f59f7605f1e560bf85b219259125b6e8bcbddb81810289dcc12d1c74e4af7ec8e02f80e78210afef93d28a85412f4
-
Filesize
880KB
-
Filesize
728KB
-
Filesize
880KB
-
Filesize
3.1MB