Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

7

Static

static

1

Flash8-en.exe

windows7-x64

7

Flash8-en.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    03/07/2024, 16:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Flash8-en.exe

  • Size

    107.8MB

  • MD5

    4366b8abb6c5cf54239954a2e89c4e97

  • SHA1

    2b769067954561da9b91b87773fe9f1e2483e296

  • SHA256

    2cbf59c93f795175f3c729ac37a25ca3d7482ab50b6475f4647ae8a39abf394f

  • SHA512

    ddf30dbfb6504f4ebe6cf7a6cb6280a54bfd98bbd69a246757901b9c3e8d575c90b7a848413e018e6e1006524efd4c0c525094191e489b1f33f05b1a9e3c20b0

  • SSDEEP

    3145728:JyDSUW50GQiwf64O298IydrvzjxyKGrVKgVl:JcSD50Piwip298IYrL1yKGsgT

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 28 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Flash8-en.exe
    "C:\Users\Admin\AppData\Local\Temp\Flash8-en.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\Downloaded Installations\Macromedia Flash 8\FL_Client_Installer.exe
      "C:\Windows\Downloaded Installations\Macromedia Flash 8\FL_Client_Installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2668
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2520
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding F352B2A7914E1BD071DD333C8624FC32 C
      2⤵
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:2560
      • C:\Windows\syswow64\regsvr32.exe
        regsvr32 /s "C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\_ISRES~1.DLL"
        3⤵
        • Loads dropped DLL
        PID:2816
      • C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe
        "C:\Program Files (x86)\Common Files\InstallShield\Driver\10\Intel 32\IDriver.exe" /RegServer
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies registry class
        PID:2884
      • C:\Windows\syswow64\regsvr32.exe
        regsvr32 /s "C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IUserCnv.dll"
        3⤵
        • Loads dropped DLL
        PID:2188
      • C:\Windows\syswow64\regsvr32.exe
        regsvr32 /s "C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\ISRT.dll"
        3⤵
        • Loads dropped DLL
        PID:2016
      • C:\Windows\syswow64\regsvr32.exe
        regsvr32 /s "C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\objpscnv.dll"
        3⤵
        • Loads dropped DLL
        PID:804
      • C:\Windows\syswow64\regsvr32.exe
        regsvr32 /s "C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IScrCnv.dll"
        3⤵
        • Loads dropped DLL
        PID:2760
      • C:\Windows\syswow64\regsvr32.exe
        regsvr32 /s "C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\iGdiCnv.dll"
        3⤵
        • Loads dropped DLL
        PID:772
  • C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe
    C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe -Embedding
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:1800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MSI41A4.tmp
    Filesize

    76KB

    MD5

    de19ccdac19f2e454719f3f59e51169c

    SHA1

    0479204efaa2076d5c12dca17ea2c37154aeb1fe

    SHA256

    83cc9b0d75ce4a843f28f79fe9471aac8e34ae3683484c9cb024e2292d432662

    SHA512

    c4f09a76e60ebdfb13ecc3f5e07c4440259514ad130e9aef70d844097988d8f010d64c818d74c56e2fd56696bf118e5a81e7e0726f9f879070972b75f3de8f1b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI4444.tmp
    Filesize

    108KB

    MD5

    9478ddb628b317ce7e95097511cd898b

    SHA1

    1edc57f15628fbd5bc86d0a480f89b027984be4a

    SHA256

    970d8dbed67b3fd79e20077ab80650f9851985c6179d8d71f9108526c9303cf4

    SHA512

    794a9659d929390c15aff8e72f2b241f75c463dd17a3783530b1590ddf8a857e8335d81e9e2ca63bb32fb5e7fefa96848d6fa240d563fb50b02a8fb925cafd92

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\MSI480D.tmp
    Filesize

    48KB

    MD5

    fa13aa9996fe8d85aa680e9f5e4f23e8

    SHA1

    cbc23243a9a595b6d91431c4c275c1ab2adc6642

    SHA256

    8f40c1dc28323a3c5310bf21372b9756ca547c20c7cf63197e071a9e1e66b31b

    SHA512

    9f4bd08583dbaadaec281d05d79c11a1dc1651d2d96cc4ecddd68e74178c3eec843e43bea14c546ba18b371177684dde0c21211e8fdb0369bbeeb5e31fdbe87e

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\plf39C6.tmp
    Filesize

    5KB

    MD5

    9efcc61a0baa38a6d7c67a05a97c7b87

    SHA1

    72b713a72ef7e972dfd5be5f79da8e9aacedb296

    SHA256

    7ccb3a50ca08c66a220e4da614cbaba1d05157359edd174223c788b86d929edf

    SHA512

    ac57100b76826af9f7650417dd765c23b522e31a1f3b44bfe9e70ed520bf6c6eb1978118a8147c99487b05a7a4c4afc964f457b79f921ff8236e4d60561b1238

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{2BD5C305-1B27-4D41-B690-7A61172D2FEB}\String1033.txt
    Filesize

    95KB

    MD5

    f546ab518190982e7b91367f3606d3ad

    SHA1

    9abe582e10a1fb3b2dbde084e7aea785ff6a23ac

    SHA256

    cdc1fae9e2d849f46110f4561f1698bcd5b557a8cf573bc08cad6e08b6dea55f

    SHA512

    d4a36a0f71fa862857fb1553cde41c1c61245494938d1f24feded2159db3472e50442a50ec3d56f07271ab6941fa5caffbd2ea70bd67cef97a12b17ed3be4dac

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{2BD5C305-1B27-4D41-B690-7A61172D2FEB}\setup.inx
    Filesize

    287KB

    MD5

    20b1f50b5760bd1c3510690a350a5432

    SHA1

    8a0289cb8ccee48b0c259106c5b50ea09cf8ae02

    SHA256

    2b69e53eaa83a483d8b2ab80f88a396f050a34dda0a84bd75b03f1d2ad840094

    SHA512

    6df7f078fae20699f3c0221835a99fd039cfcf08dc3ee2ec899025e562e38401ff5a709872134c9b47d35bdbd2cec2215676909a4a007b9af75e9b6d602fa4f6

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{952D8B2E-D670-4A2A-8904-14BAC2735A39}\IDriver.exe
    Filesize

    744KB

    MD5

    a9d3658c5be72816812a5a32e4560ba3

    SHA1

    649003292ee74d2407fae441fb92b605a0d91f90

    SHA256

    b2527d1e2297506796f898e90907fb4c8c7e063f2898194e74152fa9ca21923f

    SHA512

    b80283aafbe8cd59720979d51a5524a1d53b001e59c6fe9693c754b238101ac6058122130e0be97ce22dc4f7edce9cd84aa4fde869bf728cff8fba1733638c5b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{952D8B2E-D670-4A2A-8904-14BAC2735A39}\ISRT.dll
    Filesize

    400KB

    MD5

    db28ca3ba3c2045aa7b6e59aa9831c68

    SHA1

    55b44ea55f3a04b916339c81e1cc3f3db62d54cc

    SHA256

    ca41725fb64338211a9f9740f45f1b0c4d80e6c7e84a1d2e5580dcecbf87e489

    SHA512

    82c409611e61acad6b2986372ff72682e611b7ee5a88e74fec9c7864ce50c7494adba4165a44f2cc99b93daee33ad67320aed4fd5f85ef2fbc4779bf69f55efb

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{952D8B2E-D670-4A2A-8904-14BAC2735A39}\IScrCnv.dll
    Filesize

    260KB

    MD5

    f6aabdf85821a9c61c61dec9408f40cc

    SHA1

    ddac695de73be7a67357aea89c7b9c2ca21fc4e1

    SHA256

    9ee23586d456db53d59fbaa8669e817461aeaf94f81237ead3f2c23cac8c40fa

    SHA512

    73d2e4352c4055c8d08ad5499fc4495ff6fa7613970f9c0a3cf73dae645fc9102e62cf9c7dd046d6bc3c909cbafd06a30812d1d9bcf8f34c4a253c09d628b538

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{952D8B2E-D670-4A2A-8904-14BAC2735A39}\IUserCnv.dll
    Filesize

    168KB

    MD5

    197c2ce7cf2a98ae895ece98d88b8245

    SHA1

    f734d8dc508138501e79b384fe1a689920c6ba93

    SHA256

    260924991dff4fbd2f691913007aee1f3136708671ef3309b4f9ec8687da6f1e

    SHA512

    a7ff5f0d56a13d340d9ec1b977f9e995bf7dc61f6bf4b8ecd7369793d39032a43e587146e6b9a9084be5a9cc709876bf971983a218c2af631d3950cd3391cd47

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{952D8B2E-D670-4A2A-8904-14BAC2735A39}\_ISRES1033.dll
    Filesize

    528KB

    MD5

    1c1332bf83f505cb60e06c76fe111cdd

    SHA1

    3c80e9bd5a41ac3f8fa129d61261ea07db29f801

    SHA256

    9602fafb7de17b14a3474c64944db928ef6c23e20935c0e82e918fa2447cc979

    SHA512

    bd7cb4113f5b6067c55e7df1f6dac6b4058a0bdc9b0e7d6875f1718bdcc84d315ea8a2d373a45c47c82326a74cbce41a508f493eac59db99f7cd5e4f33ac575f

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{952D8B2E-D670-4A2A-8904-14BAC2735A39}\iGdiCnv.dll
    Filesize

    176KB

    MD5

    afdfec6679ce99596261ff182afbe9e6

    SHA1

    3289711e3ce8bb72bd84bb0bc33f95d958648f4c

    SHA256

    81b931aaf908e1e372802db04dfbe5256209d488bfe88d58841fc13acadedfd6

    SHA512

    c8ce4617d03084f37b8766f0505922a8f380e0d2745658864197535c43c3b2f985c4a2bac2228752857782181cd41167bfa4b784c7ce3e8a94932d58d099753a

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\{952D8B2E-D670-4A2A-8904-14BAC2735A39}\objpscnv.dll
    Filesize

    32KB

    MD5

    aba70b81a5811e7b140271595d66f06f

    SHA1

    42ef824151e67cf921d861d83872c9ef13b500e6

    SHA256

    26d4765c2461fccd669e455d33659397d6f82fe261ece256c3f19b831dcfa0ba

    SHA512

    8780d68124e309b8ec2dbbbac18be3291fefabfd6ed9154645eddfb4dd8076e2fda97168d7c5ea9b378b54ee900f75bd409736cfc1262e0d167e0ff62078de0a

    Download Submit

  • C:\Windows\Downloaded Installations\Macromedia Flash 8\Macromedia Flash 8.msi
    Filesize

    22.8MB

    MD5

    76f5202cc91e743aca5fcd8406d3b822

    SHA1

    3db06724cbb8846befc7e5160e38a77076258226

    SHA256

    94c3625c061675d69cef758d7269e108867b39566fc678b03a9a70cc39caea46

    SHA512

    a449fb5eead86390fb1326c2f69afbeb300c7419aa512726581106bc1f9e4f9e85c676e72988a5ee2b468983c1698357b64a6d599b51c3449e9a4b0da6c5b171

    Download Submit

  • \Windows\Downloaded Installations\Macromedia Flash 8\FL_Client_Installer.exe
    Filesize

    117KB

    MD5

    7c7f6ecbea0a9efa788a1721a97ed3c1

    SHA1

    9c57fbad160dc7e79fa238b0381a17e993ac2d3a

    SHA256

    76c7b68a7406763ddf348e0adcf69d1224f2344574022178ac0b01402aeaf5a0

    SHA512

    491fbc1cdfa68796402b57606782e189edea57749dcfae8c764f15a41886777fb363d6ce04f2ef3a3cd58d27c418d1f3c69ecf8d119c59acf2e244f985d359a3

    Download Submit

  • memory/1800-176-0x0000000003500000-0x0000000003566000-memory.dmp

    Filesize

    408KB

    Download

  • memory/1800-179-0x0000000001DF0000-0x0000000001E1C000-memory.dmp

    Filesize

    176KB

    Download

  • memory/1800-183-0x0000000002CC0000-0x0000000002CEE000-memory.dmp

    Filesize

    184KB

    Download

  • memory/2560-164-0x00000000001A0000-0x00000000001BD000-memory.dmp

    Filesize

    116KB

    Download

  • memory/2560-189-0x00000000001A0000-0x00000000001AD000-memory.dmp

    Filesize

    52KB

    Download